SY0-701 Practice Exam 61 — 20 Questions

Question 1

Based on the exhibit, which risk treatment should the security manager recommend first?

Accepted Answer

Mitigate the risk by replacing or isolating the appliance and removing direct internet exposure.. The exhibit shows a legacy file transfer appliance with direct internet exposure and known unpatched vulnerabilities. The most immediate and effective risk treatment is to mitigate the risk by replacing or isolating the appliance and removing its direct internet exposure. This directly reduces the likelihood of exploitation by eliminating the attack surface, which aligns with the principle of defense-in-depth and is the first step before considering acceptance, avoidance, or transfer.

Answer

Accept the risk and document it for the next quarterly review.

Answer

Avoid the risk by permanently shutting down the file transfer service.

Answer

Transfer the risk by purchasing cyber insurance and keeping the current configuration.

Question 2

A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?

Accepted Answer

Add a compensating control such as restricting access to the system.. Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.

Answer

Do nothing until the patch window opens.

Answer

Disable all logging so the system runs faster.

Answer

Rename the application so attackers cannot find it.

Question 3

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

Accepted Answer

Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.. Implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Answer

Enable backup encryption only, because encrypted backups cannot be read if stolen.

Answer

Move the USB drive into a different cabinet inside the same server room.

Answer

Reduce the retention period so backups consume less storage space.

Question 4

A remote user's laptop begins launching a legitimate-looking "System Update" application at login. After the update window appears, the browser homepage changes, outbound traffic increases, and the user later reports that saved passwords are being used in unauthorized logins. Which malware type is the most likely primary infection?

Accepted Answer

Trojan, because it is disguised as a harmless utility while delivering malicious payloads.. The malware is disguised as a legitimate 'System Update' application, which is the classic behavior of a Trojan. Trojans rely on social engineering to trick users into executing them, and once activated, they can deliver secondary payloads such as password stealers, browser hijackers, or backdoors. In this scenario, the Trojan likely installed a keylogger or credential harvester to exfiltrate saved passwords, changed browser settings via registry or configuration file manipulation, and increased outbound traffic to a command-and-control (C2) server.

Answer

Worm, because it is spreading automatically to nearby systems on the network.

Answer

Ransomware, because files would be encrypted and a payment demand would appear.

Answer

Rootkit, because the malware is hiding its own presence by modifying kernel behavior.

Question 5

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

Accepted Answer

A dedicated host or equivalent single-tenant compute placement in the provider's environment.. A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Answer

A public subnet with an internet gateway so the workload can be reached directly.

Answer

A shared-tenancy virtual machine in the provider's default compute pool.

Answer

A serverless function because it removes all underlying infrastructure concerns.

Question 6

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Accepted Answer

Place the application behind a load balancer with health checks.. A load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Answer

Run the application on a single server with nightly backups.

Answer

Disable health checks to avoid false failovers.

Answer

Put the database on the public internet for easier access.

Question 7

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

Accepted Answer

Enable SMB signing and remove anonymous access to the share.. Enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Answer

Remove all backup jobs until the scan is cleared.

Answer

Disable the file server and rebuild it from scratch immediately.

Answer

Increase the directory quota so the share cannot overflow.

Question 8

A branch office needs to send a confidential design document to headquarters over an untrusted network. Headquarters already has the public/private key pair available for document exchange. Which method is most appropriate to keep the file confidential during transit without first sharing a secret key?

Accepted Answer

Encrypt the file with headquarters' public key. Encrypting the file with headquarters' public key ensures that only headquarters, possessing the corresponding private key, can decrypt and read the file. This method provides confidentiality over an untrusted network without requiring a pre-shared secret key, as the public key can be freely distributed.

Answer

Publish a hash of the file for comparison

Answer

Sign the file with the branch office private key only

Answer

Compress the file before sending it

Question 9

Based on the exhibit, what is the BEST immediate containment action?

The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.

Accepted Answer

Immediately isolate the endpoint from the network using EDR containment or switch quarantine.. The immediate priority is to stop the active malicious activity (file renaming, system slowdown) by severing the workstation's network connectivity. EDR containment or switch quarantine isolates the endpoint at Layer 2, preventing the attacker from exfiltrating data, communicating with command-and-control servers, or spreading laterally, while preserving volatile memory for forensic analysis. This is faster and more controlled than powering off, which destroys evidence and may trigger destructive payloads.

Answer

Power off the workstation immediately to prevent any further file changes.

Answer

Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.

Answer

Block the destination IP address at the firewall and wait for the user to log off.

Question 10

A security analyst receives an automated alert indicating that a standard user account logged in from a geographic location that is unusual for the user, and the login occurred at 3:00 AM local time. The analyst has not yet verified whether this was a successful login or if any additional suspicious activity occurred. According to standard incident response procedures, what should the analyst do NEXT?

Accepted Answer

Review the account's recent activity for signs of compromise.. The correct next step is to review the account's recent activity to gather more context. According to the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), after detection the analyst should perform analysis to validate the alert and determine the scope. Reviewing recent logins, accessed files, and other actions helps decide if containment is needed. Immediately disabling the account (A) could be premature if the alert is a false positive or if the user is traveling. Conducting a full forensic analysis (B) is too resource-intensive for a single alert without further evidence. Reporting to law enforcement (D) is not appropriate at this stage; that would occur after a confirmed incident that meets legal thresholds.

Answer

Disable the user account immediately and reset the password.

Answer

Conduct a full forensic analysis of the user's workstation.

Answer

Report the incident to law enforcement.

Question 11

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

Accepted Answer

Digital signature, because only the vendor's private key can produce the verified signature.. A digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Answer

Hashing, because matching SHA-256 values alone prove the file came from the vendor.

Answer

Symmetric encryption, because only the vendor and the customer share the secret key.

Answer

Salting, because adding random data makes the update file easier to trust.

Question 12

A laptop is suspected of being compromised, and the responder wants to preserve useful evidence before shutting it down. What should be done first?

Accepted Answer

Capture volatile data such as memory and running processes if possible.. Volatile data (e.g., RAM contents, running processes, network connections) is lost when the laptop is powered off. Capturing this data first preserves critical evidence of the attacker's current activity, such as malware in memory or active network connections, which is essential for forensic analysis. This aligns with the forensic principle of order of volatility, where the most volatile data is collected first.

Answer

Power off the laptop immediately to stop all attacker activity.

Answer

Install a new antivirus product before collecting evidence.

Answer

Reimage the laptop so the user can return to work quickly.

Question 13

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Accepted Answer

Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.. Placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Answer

Put the database on the same subnet as the web front end so internal calls have lower latency.

Answer

Allow the database to accept connections from the internet if strong passwords are used.

Answer

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Question 14

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

Accepted Answer

Use federation with single sign-on from a central identity provider.. Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Answer

Create a separate local username and password in every cloud application.

Answer

Store the same shared password in a password manager for all applications.

Answer

Allow each application to authenticate users only by device MAC address.

Question 15

A SOC analyst receives an EDR alert showing a finance laptop creating encrypted archives and then attempting SMB connections to several internal file shares. The user is still logged in, and the business wants to stop possible spread without destroying volatile evidence. What should the analyst do first?

Accepted Answer

Isolate the endpoint from the network using the EDR containment feature.. The EDR containment feature isolates the endpoint from the network while preserving all running processes, memory, and disk state. This stops the encrypted archives from being exfiltrated via SMB and prevents lateral movement, but keeps volatile evidence (e.g., active malware processes, network connections) intact for forensic analysis.

Answer

Power off the laptop immediately to stop all activity.

Answer

Reimage the laptop from a gold image as soon as possible.

Answer

Disable the user account in Active Directory and wait for the malware to stop.

Question 16

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Answer

Port forwarding

Answer

Tokenization

Answer

Network address translation

Question 17

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Accepted Answer

Isolate the workstation from the network for containment.. The workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Answer

Allow the traffic because SMB is a normal file-sharing protocol.

Answer

Delete the local event logs to reduce alert noise.

Answer

Disable all SMB services on every server immediately.

Question 18

A company is implementing controls to protect against insider threats. Which three of the following controls are most effective for detecting and preventing data exfiltration by a malicious insider? (Choose three.)

Accepted Answer

Enforcing strict role-based access controls (RBAC) with the principle of least privilege. Data Loss Prevention (DLP) solutions are effective because they can inspect content in real time, blocking sensitive data from being sent via email, copied to USB, or uploaded to cloud services. User Behavior Analytics (UBA) detects anomalies such as a user downloading thousands of records at 3 AM, which is a strong indicator of malicious intent. Role-Based Access Control (RBAC) with least privilege limits the data a user can access, reducing the attack surface and making exfiltration harder even if credentials are compromised.

Answer

Installing antivirus software on all endpoints

Answer

Conducting annual security awareness training for all staff

Answer

Requiring all employees to use complex passwords changed every 30 days

Question 19

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Accepted Answer

Scan images for known vulnerabilities before they are promoted to production.. Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Answer

Run containers as root by default to simplify troubleshooting.

Answer

Mount the host operating system filesystem into every container.

Answer

Deploy images using the latest tag without reviewing version history.

Question 20

Based on the exhibit, what should the administrator do next?

Accepted Answer

Re-download the update from the trusted source and verify the hash again.. If the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Answer

Install the update because a longer hash means the file is newer.

Answer

Rename the file to match the vendor’s naming convention and retry installation.

Answer

Disable SHA-256 verification because patch files often change after download.