SY0-701 Practice Exam 63 — 20 Questions

Question 1

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A configuration baseline. A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Answer

A file compression tool

Answer

A password vault

Answer

A network cable tester

Question 2

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 3

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Accepted Answer

Likelihood that the issue will be exploited. The likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Answer

The color used on the vulnerability report

Answer

The number of users in the IT department

Answer

The age of the server name in inventory

Question 4

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 5

An EDR alert shows a Windows workstation used certutil.exe to download an encoded script, then created a scheduled task named UpdateCheck that runs every 15 minutes. The machine is also making short HTTPS connections to the same external IP. What is the best description of what the attacker is doing?

Accepted Answer

Living-off-the-land abuse with persistence through a scheduled task is occurring.. The attacker is using certutil.exe, a native Windows tool, to download an encoded script (living-off-the-land), and then creating a scheduled task named UpdateCheck to maintain persistence by running every 15 minutes. This combination of abusing trusted binaries and establishing a recurring task is a classic indicator of LOTL abuse with persistence.

Answer

A buffer overflow exploit is likely corrupting memory in the operating system.

Answer

The evidence most strongly suggests a drive-by download from a compromised browser session.

Answer

A man-in-the-middle attack is intercepting and modifying the TLS session.

Question 6

A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address during off-hours. The analyst reviews the firewall logs and confirms the connection was established. Which of the following should the analyst perform NEXT to contain the threat?

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (Option B) is the immediate containment step because it stops the active communication with the known malicious IP address, preventing further data exfiltration, lateral movement, or command-and-control (C2) activity. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the threat before investigation or remediation. Disabling the user account (A) does not stop the network-level communication if the malware is running as a service or using cached credentials, and running a scan (C) or notifying management (D) are post-containment actions.

Answer

Disable the user's account immediately.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify the user's manager of the policy violation.

Question 7

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 8

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

Accepted Answer

The percentage of users who report simulated phishing emails to security.. The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Answer

The number of training emails sent to employees each month.

Answer

The number of spam emails blocked by the mail gateway.

Answer

The number of help desk tickets closed within the month.

Question 9

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

Accepted Answer

Server-side request forgery. The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 10

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Accepted Answer

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.. A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Answer

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

Answer

Deploy a secure web gateway and require all remote users to browse through a proxy.

Answer

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Question 11

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Use active-active or automatic failover between two sites with health checks.. Active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Answer

Keep only RAID 1 inside each server, because mirroring alone handles site outages.

Answer

Store nightly backups on the same storage array as the production data.

Answer

Replace the load balancer with a static DNS record for each server.

Question 12

Match each change-management practice to the best description for reducing patching risk in production.

Accepted Answer

Change Advisory Board: A group that reviews and approves changes to reduce unauthorized modifications.. These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Answer

Change Advisory Board: Testing patches in a staging environment before deployment.

Answer

Rollback plan: Performing patching during a time window that minimizes impact on operations.

Question 13

A SIEM analyst reviews authentication logs and sees the following pattern over 15 minutes: 68 different user accounts each had one failed login attempt from the same source IP, followed by no lockouts, and then one of the accounts successfully authenticated from that same IP using a valid password. What is the most likely explanation?

Accepted Answer

A password spraying attack using common passwords across many accounts.. The pattern of 68 different user accounts each experiencing a single failed login attempt from the same source IP, followed by one successful authentication from that IP using a valid password, is the classic signature of a password spraying attack. In password spraying, the attacker tries a small number of common passwords (often just one) against many accounts to avoid triggering account lockout policies, which typically lock an account after a small number of consecutive failures (e.g., 3–5 attempts). The single success indicates the attacker found an account using a weak or common password.

Answer

A brute-force attack against a single account using many password guesses.

Answer

A replay attack using captured authentication traffic.

Answer

A successful SSO federation event after a directory sync delay.

Question 14

A procurement team is evaluating a payroll SaaS vendor. They want independent evidence that the vendor's controls were designed and operating effectively over the last six months, not just at a single point in time. Which report should they request?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides independent assurance that a vendor's controls related to security, availability, processing integrity, confidentiality, or privacy were designed and operating effectively over a period of time (typically 6–12 months). This matches the procurement team's requirement for evidence of sustained control effectiveness, not just a point-in-time snapshot.

Answer

SOC 1 Type I report

Answer

Non-disclosure agreement

Answer

Network penetration test letter

Question 15

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.

Question 16

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

Accepted Answer

Nonrepudiation. Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 17

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

Accepted Answer

Smishing. This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Answer

Pretexting

Answer

Tailgating

Answer

Spoofing

Question 18

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

Accepted Answer

Document the change, get approval, and include a rollback plan.. Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Answer

Make the change directly in production without review to save time.

Answer

Disable the firewall temporarily while the update is tested.

Answer

Apply the rule but do not tell anyone so there is less paperwork.

Question 19

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Accepted Answer

Isolate the endpoint from the network through the EDR platform. Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Answer

Uninstall the spreadsheet application immediately

Answer

Reboot the endpoint to clear the suspicious script

Answer

Wait for a second alert before taking any action

Question 20

A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.

Accepted Answer

The message creates a short deadline and pressures the user to act quickly.. Phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.

Answer

The message includes the company's logo and professional-looking formatting.

Answer

The email refers to a shared document that the user should review.

Answer

The message was received during normal business hours.