SY0-701 Practice Exam 64 — 20 Questions

Question 1

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric encryption. B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Answer

Symmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 2

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Answer

A single server with a larger power supply

Answer

A daily screenshot of the website

Answer

A more restrictive password policy

Question 3

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Accepted Answer

Verify the request using a known supplier contact method before taking action. The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 4

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

Accepted Answer

A security addendum with SLA terms. A security addendum with SLA terms is the correct control because it contractually binds the vendor to specific security obligations — 24-hour incident notification, data segregation, and the right to audit or verify security commitments. An addendum supplements the master agreement with enforceable security requirements, and SLA terms define measurable performance and response expectations. This gives the company legal recourse if the vendor fails to meet those commitments.

Answer

A non-disclosure agreement only

Answer

A verbal assurance from the account representative

Answer

The vendor's standard public terms without changes

Question 5

A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?

Accepted Answer

Use federated identity with role mapping so the portal trusts each partner’s identity provider.. Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.

Answer

Create one shared partner account for each external company and reuse the same password.

Answer

Synchronize every partner user into the manufacturer’s directory and require a separate password change.

Answer

Store partner passwords in the portal database and use password reset emails for access control.

Question 6

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

Accepted Answer

Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.. It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Answer

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Answer

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Answer

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Question 7

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

Accepted Answer

A standard, because it specifies mandatory technical requirements.. A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Answer

A guideline, because employees can decide whether to follow it.

Answer

A risk register, because it tracks all security vulnerabilities on laptops.

Answer

A business impact analysis, because it identifies the most important laptop functions.

Question 8

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

Accepted Answer

Mitigate the risk with compensating controls until the migration is complete.. The exhibit shows a legacy portal with known vulnerabilities that is scheduled for migration to a modern platform. Since backups alone do not address the active security weaknesses, the best recommendation is to mitigate the risk with compensating controls (e.g., web application firewall rules, network segmentation, or strict access controls) to reduce the likelihood or impact of exploitation until the migration is complete. This aligns with the risk treatment strategy of mitigation, as it actively reduces the risk without prematurely retiring the service or relying solely on insurance.

Answer

Accept the risk because backups are already enabled.

Answer

Avoid the risk by immediately retiring the portal.

Answer

Transfer the risk by purchasing cyber insurance only.

Question 9

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

Accepted Answer

Implement federated single sign-on through a central identity provider with MFA and conditional access policies.. Federated single sign-on (SSO) through a central identity provider (IdP) like Microsoft Entra ID or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Use shared accounts for each department and keep one password vault for the team.

Answer

Require all users to connect through a VPN before any SaaS login and remove identity federation.

Question 10

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Accepted Answer

Connect through a VPN to a bastion host, then use SSH to the switches.. It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Answer

Telnet to the switches over a router port-forward rule.

Answer

SSH directly to the switches from the internet using password-only authentication.

Answer

Use SNMPv2c with restricted source IP addresses.

Question 11

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

Accepted Answer

Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.. Federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Microsoft Entra ID), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Answer

Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

Answer

Create a shared emergency administrator account so access can be revoked by changing one password.

Answer

Require users to clear browser cookies after termination so the SaaS session expires sooner.

Question 12

A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?

Accepted Answer

Use parameterized queries or prepared statements for the search filters.. Parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.

Answer

Escape apostrophes in the input before building the SQL statement.

Answer

Disable database error messages so attackers cannot see query details.

Answer

Place the application behind a VPN so only internal users can run searches.

Question 13

A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?

Accepted Answer

Disconnect the workstation from the network. According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.

Answer

Perform a forensic analysis of the workstation

Answer

Reimage the workstation

Answer

Alert the system administrator

Question 14

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Accepted Answer

An approved retention schedule or retention policy that defines the deletion period.. An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed. Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Answer

A folder of employee social media posts about data cleanup.

Answer

A list of all printers in the office environment.

Answer

A draft policy from last year that was never approved.

Question 15

Based on the exhibit, what should the security team recommend before sharing the report?

Accepted Answer

Remove unnecessary personal fields and share only the minimum data needed for the analysis.. The principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Answer

Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

Answer

Keep all fields and encrypt the file before sending it to the vendor.

Answer

Store the report in a shared folder so the vendor can access it later if needed.

Question 16

Match each PKI term to what it does.

Accepted Answer

CA: Issues and manages digital certificates. CA issues certificates, RA verifies identities, CRL lists revoked certificates, public key encrypts, private key decrypts, digital signature provides integrity and non-repudiation.

Answer

CA: Verifies identity of certificate requestors

Answer

RA: Issues and manages digital certificates

Answer

CRL: Issues and manages digital certificates

Question 17

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

Accepted Answer

Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.. Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Answer

Assume the provider's default settings are sufficient because encryption at rest is already enabled.

Answer

Move the documents to a public bucket so users can access them without friction.

Answer

Disable encryption at rest so administrators can troubleshoot access problems more easily.

Question 18

A customer portal team must keep an unsupported Linux appliance online for 60 days while a replacement is built. The appliance processes payment tokens and cannot be patched until the vendor certifies the new image. Which two actions best reduce the residual risk during the 60-day window? Select two.

Accepted Answer

Restrict network paths to only the required upstream and downstream systems through firewall allow-lists.. Restricting network paths to only required upstream and downstream systems via firewall allow-lists reduces the attack surface by limiting the appliance's exposure to unnecessary network traffic. This is a classic network segmentation compensating control that mitigates the risk of lateral movement from an unpatched, vulnerable system. By enforcing strict ingress/egress rules, the team can prevent unauthorized access and contain potential exploits during the 60-day window.

Answer

Move the appliance onto the flat user VLAN so the team can monitor it with standard workstation tools.

Answer

Declare the risk fully accepted and make no configuration changes until the replacement is ready.

Answer

Disable logging because the appliance is already at capacity and logs can slow it down.

Question 19

A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.

Accepted Answer

Restrict host firewall rules to required source addresses and ports.. Option A is correct because narrowing the host firewall to only the load balancer's and jump host's source IP addresses on the specific service ports enforces least-privilege network access while preserving the required traffic pattern. Option B is correct because running the web service under a dedicated nonadministrative service account removes the excessive privileges of a domain administrator, limiting the blast radius if the service is compromised. Option C is wrong because leaving SSH open to every subnet and relying on passwords violates least privilege and weakens authentication. Option D is wrong because granting local administrator rights to the service account expands privileges rather than hardening. Option E is wrong because permanently disabling patching leaves known vulnerabilities unaddressed.

Answer

Leave SSH open to every subnet and rely on strong passwords.

Answer

Give the service account local administrator rights so it can restart itself.

Answer

Disable patching during business hours permanently.

Question 20

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

Accepted Answer

Use client-side encryption before upload and keep the keys in an external HSM or key service.. Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Answer

Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

Answer

Place the storage account in a private subnet and block all Internet access.

Answer

Rely on immutable snapshots and versioning to prevent unauthorized access.