SY0-701 Practice Exam 63 — 20 Questions

Question 1

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. Option B is correct because it uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 2

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 3

A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Accepted Answer

Verify that the destination domain and IP match the vendor's documented update service.. Option A is correct because verifying that the destination domain and IP match the vendor's documented update service directly confirms whether the outbound HTTPS traffic is legitimate patch-management activity. This step uses threat intelligence or vendor documentation to correlate the observed destination with the expected update infrastructure, which is a standard validation technique for reducing false positives in SIEM alerts.

Answer

Immediately isolate the workstation from the network without reviewing any other evidence.

Answer

Suppress every future alert from that subnet permanently.

Answer

Assume the traffic is benign because it occurs at a regular interval.

Question 4

A support team wants to export customer tickets into a test analytics environment so developers can search real examples while minimizing privacy exposure. The exported data includes names, email addresses, and account IDs that are not needed for the test. What is the best first step?

Accepted Answer

Remove or tokenize unneeded personal identifiers before export. Option B is correct because data minimization is a core privacy principle: before exporting data to a test environment, any personally identifiable information (PII) not required for the analytics task should be removed or tokenized. This reduces the attack surface and ensures compliance with privacy regulations (e.g., GDPR, CCPA) without sacrificing the utility of the real customer ticket examples.

Answer

Export the full dataset and restrict access with a shared password

Answer

Keep the data unchanged because the test environment is internal

Answer

Store the export indefinitely because development data is exempt from retention rules

Question 5

An organization is developing a business continuity and disaster recovery (BC/DR) plan. Which three of the following are essential elements that should be included to ensure proper management and oversight? (Choose three.)

Accepted Answer

Defined roles and responsibilities for the BC/DR team during an incident. A list of prioritized critical business functions with their RTOs is essential because it directly drives recovery strategy and resource allocation. Without this, the BC/DR plan lacks measurable recovery targets and cannot ensure that the most vital operations are restored first, which is a core requirement of NIST SP 800-34 and ISO 22301.

Answer

Detailed diagrams of the network topology with IP addresses and firewall rules

Answer

An inventory of all employee personal devices used for remote work

Answer

A single backup copy stored on the primary server to minimize restoration time

Question 6

Which three of the following are examples of defense-in-depth security controls? (Choose three.)

Accepted Answer

Regular security awareness training for employees. Defense-in-depth is a layered security strategy that uses multiple, independent controls to protect assets. A firewall at the network perimeter provides network-level filtering (e.g., stateful inspection, ACLs) as the first line of defense. Mandatory access controls (MAC) on sensitive files enforce system-enforced restrictions based on labels (e.g., Bell-LaPadula model), adding a host-level layer. Regular security awareness training addresses the human factor, reducing social engineering and phishing risks, which is a critical administrative control.

Answer

Disabling all logging to save storage space

Answer

Using only one antivirus solution for all endpoints

Answer

A single password policy for all users

Question 7

A security analyst is reviewing the organization's incident response procedures. According to the NIST SP 800-61 framework, which four of the following are recognized phases of the incident response lifecycle? (Choose four.)

Accepted Answer

Containment, Eradication, and Recovery. The NIST SP 800-61 Revision 2 framework defines the incident response lifecycle as consisting of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. These phases form a continuous cycle, with lessons learned from Post-Incident Activity feeding back into Preparation. The question asks for the four recognized phases, and these four options directly match the NIST model.

Answer

Risk Assessment

Answer

Threat Hunting

Question 8

A security team downloads a software update package signed by the vendor. The team verifies the signature using the vendor's public key before approving deployment. What does this verification primarily confirm?

Accepted Answer

The package was likely created by the vendor and was not altered after signing. Digital signature verification using the vendor's public key confirms that the package was signed with the vendor's private key, which only the vendor possesses. This provides authentication of the signer's identity and integrity of the data, ensuring the package has not been modified since signing. It does not provide confidentiality, as the package itself is not encrypted.

Answer

The package can only be decrypted by the vendor's private key

Answer

The package is encrypted with the vendor's public key

Answer

The vendor's certificate has not expired

Question 9

A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?

Accepted Answer

Deploy the patch through the normal change process as soon as possible. Option B is correct because the patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.

Answer

Ignore the finding because the server is already protected by a firewall

Answer

Mark the vulnerability as accepted risk without notifying the business

Answer

Remove the web server from the asset inventory to prevent the scanner from finding it

Question 10

A small business web server still allows remote administration from the internet on port 3389, and the administrator password has never been changed from the vendor default. Which two issues should the security team prioritize first? Select two.

Accepted Answer

An exposed remote administration service. Port 3389 is used by Remote Desktop Protocol (RDP), which is a remote administration service. Exposing RDP directly to the internet is a critical vulnerability because it allows attackers to perform brute-force or credential-stuffing attacks against the service. This is a high-priority issue because it provides an attack vector that can lead to full system compromise.

Answer

A missing screen-lock timeout on nearby laptops

Answer

A lack of encrypted email attachments

Answer

An outdated printer driver on the finance network

Question 11

A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Accepted Answer

Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision.. Option B is correct because a SOC 2 Type II report provides an independent assessment of a vendor's controls over security, availability, processing integrity, confidentiality, and privacy over a period of time. Given the vendor's lack of customer-managed keys and outdated penetration test, the security manager needs a current, comprehensive audit report to evaluate whether compensating controls adequately mitigate the risks of storing PHI outside HIPAA jurisdiction. This action allows an informed risk acceptance or mitigation decision without prematurely terminating a potentially compliant service.

Answer

Accept the risk because the vendor uses strong encryption.

Answer

Terminate the contract immediately and select a different vendor.

Answer

Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

Question 12

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

Accepted Answer

A configuration baseline. A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Answer

A file compression tool

Answer

A password vault

Answer

A network cable tester

Question 13

A small internal reporting server has a low-severity vulnerability. Fixing it now would require several hours of downtime, while the business impact of exploitation is considered low. What is the BEST risk treatment for this situation?

Accepted Answer

Accept the risk after documenting the decision. The best risk treatment is to accept the risk because the vulnerability is low-severity, the business impact of exploitation is low, and the cost of remediation (several hours of downtime) exceeds the potential loss. Documenting the acceptance ensures auditability and informed management approval, which is a standard practice in risk management frameworks like NIST SP 800-37.

Answer

Transfer the risk to a third party

Answer

Avoid the risk by shutting down the server permanently

Answer

Mitigate the risk by immediately replacing the server

Question 14

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 15

A security team wants to verify that a server has not drifted from its approved hardened configuration after several months of changes. Which two actions help most? Select two.

Accepted Answer

Compare the current configuration against the approved baseline.. Comparing the current configuration against the approved baseline (Option A) is a direct method to identify any deviations from the hardened state. This process, often performed manually or with scripts, checks each setting against the known-good values defined in the baseline document, such as those from CIS Benchmarks or DISA STIGs. It is the most straightforward way to detect drift after months of changes.

Answer

Restart the server and wait for users to report problems.

Answer

Increase the storage capacity on the server.

Answer

Change the desktop wallpaper to remind users of the policy.

Question 16

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. Option B is correct because it implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 17

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

Accepted Answer

Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.. Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Answer

Disable all USB ports permanently on every laptop.

Answer

Uninstall the endpoint protection agent and replace it with manual inspections.

Answer

Move user data to cloud storage so rogue boot media can no longer access it.

Question 18

A SOC analyst confirms that a critical Linux virtual machine is making outbound connections to a known malicious IP address. The application owner says the VM hosts a revenue system that cannot be powered off without causing a major outage. What is the best containment action?

Accepted Answer

Isolate the VM at the network layer while keeping it powered on.. Option B is correct because network isolation (e.g., applying a firewall ACL or moving the VM to a quarantine VLAN) stops outbound malicious traffic while keeping the revenue-critical system powered on and available for forensic analysis. This balances security containment with business continuity, as shutting down the VM (Option A) would cause a major outage, and waiting (Option C) would allow continued data exfiltration or lateral movement.

Answer

Shut down the VM immediately to stop all malicious activity.

Answer

Wait for the next maintenance window before taking action.

Answer

Reimage the VM from a known-good template immediately.

Question 19

A server room is located next to a chilled-water pipe, and facilities staff want the earliest possible warning if moisture starts leaking under the raised floor. Which control is the best fit?

Accepted Answer

Install water leak sensors tied into the environmental monitoring system.. Water leak sensors are specifically designed to detect the presence of moisture, and when integrated into an environmental monitoring system, they provide immediate alerts (e.g., SNMP traps or email notifications) at the earliest sign of a leak. This allows facilities staff to respond before water damages server equipment under the raised floor, meeting the requirement for earliest possible warning.

Answer

Replace the badge reader with a biometric lock.

Answer

Add a security camera pointing at the server racks.

Answer

Move the servers onto a separate VLAN.

Question 20

A SOC analyst confirms that a user entered corporate credentials into a fake sign-in page. Mailbox logs now show a new forwarding rule sending messages to an external address, and the attacker may still have an active session. Which two actions should the analyst take first to contain the account compromise? Select two.

Accepted Answer

Reset the user's password and require a fresh authentication challenge.. Resetting the user's password (Option A) immediately invalidates the credentials the attacker phished, preventing further authentication with those stolen credentials. This is a foundational first step in account containment per NIST SP 800-61 incident response guidelines.

Answer

Delete the mailbox and create a new user account.

Answer

Disable all external email delivery for the entire organization.

Answer

Wait for the user to confirm whether the message was legitimate before acting.