SY0-701 Practice Exam 64 — 20 Questions

Question 1

A small company has two security issues and can fix only one this week. Which should be prioritized first? One issue is an internal lab server with a medium-severity flaw. The other is an internet-facing login portal using default administrator credentials.

Accepted Answer

Fix the internet-facing login portal first because default administrator credentials create a much higher risk.. The internet-facing login portal using default administrator credentials represents an immediate, high-impact risk because it allows unauthorized remote access with administrative privileges. Default credentials are well-known and actively targeted by automated scanners and attackers, making exploitation trivial. In contrast, the internal lab server with a medium-severity flaw is behind network segmentation and requires additional access, so its risk is lower and can be deferred.

Answer

Fix the internal lab server first because every vulnerability should be treated equally.

Answer

Wait until the monthly maintenance window so both issues can be fixed at the same time.

Answer

Ignore both issues until users report symptoms, then respond if something happens.

Question 2

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Accepted Answer

Patch the guest operating system running on the cloud virtual machine.. In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Answer

Replace failed power supplies in the cloud provider's data center.

Answer

Maintain the cloud provider's hypervisor firmware.

Answer

Manage the physical firewall blades inside the provider's facility.

Question 3

A SIEM alert shows five failed logins to an administrator account, followed by a successful login from a new city three minutes later. The account owner says they did not sign in. What should the analyst do first?

Accepted Answer

Temporarily disable the account and open an incident for investigation.. Option B is correct because the alert shows a classic indicator of account compromise: multiple failed logins followed by a successful authentication from an unusual location. The account owner's denial of the login confirms unauthorized access, so the immediate priority is to contain the threat by disabling the account and opening an incident for formal investigation. This aligns with the NIST SP 800-61 incident response process, specifically the containment phase before eradication or recovery.

Answer

Ignore the alert because the login eventually succeeded.

Answer

Reset the password only and close the alert.

Answer

Reboot the user's laptop to clear any malicious activity.

Question 4

A SIEM alert shows a successful VPN login for an executive account from an unusual country, followed 3 minutes later by large downloads from a file share the user rarely accesses. Which log source should the analyst review next to determine whether the session came from the user's assigned laptop or an unmanaged device?

Accepted Answer

Endpoint detection and response telemetry from the user's laptop. B is correct because endpoint detection and response (EDR) telemetry from the user's laptop provides granular process-level and network-level data, including the source IP of the VPN session, the device's hostname, and whether the VPN client software was initiated from the managed laptop's operating system. This allows the analyst to confirm if the VPN session originated from the assigned corporate device or from an unmanaged device using stolen credentials.

Answer

VPN concentrator logs

Answer

DNS query logs from the internal resolver

Answer

Email gateway logs for the executive mailbox

Question 5

A SOC analyst reviews email platform logs for a finance user account. At 08:12, the user successfully signs in from Denver. At 08:15, the same account signs in from a residential ISP in another state. At 08:16, the mailbox creates a new external forwarding rule and deletes the original alert message. The user says they did not set up forwarding. What is the best assessment?

Accepted Answer

True positive indicating likely account compromise and unauthorized mailbox abuse.. The rapid succession of logins from geographically distant locations (Denver and a different state via a residential ISP) within three minutes, followed immediately by creation of an external forwarding rule and deletion of the original alert message, is a classic indicator of account takeover. The user's denial of setting up forwarding confirms the activity is unauthorized. This pattern aligns with attacker behavior: after compromising credentials, they establish persistence (forwarding) and cover tracks (deleting alerts).

Answer

False positive caused by normal mailbox synchronization behavior across devices.

Answer

Benign activity because the user successfully authenticated with valid credentials and no malware was detected.

Answer

A denial-of-service event because the attacker is attempting to overwhelm the mail system.

Question 6

A SOC analyst reviews one user account and sees several failed logins from a single IP, then a successful login from the same IP, followed by a new inbox forwarding rule to an external address. Which two findings most strongly suggest account compromise? Select two.

Accepted Answer

Repeated failed logins followed by a successful login from the same source IP.. Option A is correct because a brute-force attack pattern—multiple failed logins followed by a successful authentication from the same external IP—strongly indicates credential compromise. This sequence suggests the attacker guessed or obtained the password and then successfully logged in. The single source IP ties the failed attempts to the eventual successful session, making it a classic indicator of account takeover.

Answer

The user authenticated during normal business hours.

Answer

The user accessed email from a corporate laptop.

Answer

The password age is 89 days.

Question 7

A security analyst is reviewing the perimeter firewall logs. The analyst observes repeated TCP SYN packets from a single external IP address (203.0.113.50) to multiple internal IP addresses on TCP port 3389. The packets are sent with a consistent 50-millisecond interval. There are no subsequent SYN-ACK or RST packets from the internal hosts in the logs. The analyst suspects this is a reconnaissance scan. Which of the following additional log sources would provide the most definitive evidence to confirm this suspicion?

Accepted Answer

Intrusion detection system (IDS) logs from a network-based IDS placed behind the firewall. Option C is correct because a network-based IDS placed behind the firewall can inspect the full packet payload and detect the specific pattern of TCP SYN packets without corresponding SYN-ACK or RST responses, which is characteristic of a SYN scan (a type of reconnaissance scan). The IDS can correlate the consistent 50-millisecond interval and the targeting of TCP port 3389 (RDP) across multiple internal IPs, providing definitive evidence of scanning behavior that firewall logs alone cannot confirm due to lack of session completion.

Answer

DNS query logs from the internal DNS server

Answer

Web proxy logs from the corporate proxy server

Answer

VPN gateway authentication logs

Question 8

A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?

Accepted Answer

Implement breached-password screening plus MFA.. Option B is correct because the attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.

Answer

Increase password length requirements only.

Answer

Disable account lockouts to avoid user inconvenience.

Answer

Allow unlimited retries so legitimate users are never blocked.

Question 9

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

Accepted Answer

Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.. Option B is correct because it implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Answer

Place all three servers in the same server VLAN and use host-based firewalls to separate them.

Answer

Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

Answer

Place the web server on the user VLAN and use NAT to hide the database server from the internet.

Question 10

A user enters `` into a public comment field, and other visitors see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic cross-site scripting (XSS) attack because the user-supplied input containing a script tag is echoed back to other visitors' browsers without proper sanitization or encoding. The script executes in the context of the victim's browser, allowing the attacker to steal cookies, redirect users, or deface the page. XSS exploits the trust a user has for a particular website, unlike SQL injection which targets the database.

Answer

SQL injection

Answer

Broken authentication

Answer

Insecure deserialization

Question 11

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

Accepted Answer

Investigate whether any of the attempted accounts correspond to actual domain users.. Option B is correct because the analyst must first determine if any of the randomly generated account names match existing domain user accounts. If a match is found, it indicates a targeted password-spraying or brute-force attack against valid accounts, requiring immediate account lockdown and credential reset. This investigation step aligns with the incident response process of identification before containment or escalation.

Answer

Immediately block the IP address at the perimeter firewall.

Answer

Run a full antivirus scan on the domain controller.

Answer

Notify the company's legal department for law enforcement involvement.

Question 12

An organization is implementing security controls to mitigate the risk of social engineering attacks. Which three of the following are effective mitigations? (Choose three.)

Accepted Answer

Conducting regular security awareness training for all employees. Security awareness training is a critical mitigation because it educates employees to recognize and resist social engineering tactics such as phishing, pretexting, and baiting. By regularly updating training content to reflect current attack vectors, organizations reduce the likelihood that human error will be exploited. This directly addresses the human factor, which is often the weakest link in security.

Answer

Implementing a strict clean desk policy

Answer

Installing physical barriers at building entrances

Answer

Disabling USB ports on all workstations

Question 13

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

Accepted Answer

Fileless attack, because the malicious activity is operating primarily in memory and using native tools.. The correct answer is A because the attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Answer

Ransomware, because the user opened an email attachment.

Answer

Worm, because PowerShell is a common scripting tool.

Answer

Rootkit, because the attacker is hiding the process from normal tools.

Question 14

A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) is a social engineering attack conducted over the phone, where the attacker impersonates a trusted entity (IT support) to trick the victim into revealing sensitive information such as credentials and MFA codes. The request for the current MFA code is a key indicator, as it would allow the attacker to bypass multi-factor authentication in real time.

Answer

Spear phishing

Answer

Pretexting

Answer

Tailgating

Question 15

Which four of the following are common indicators of a phishing attack? (Choose four.)

Accepted Answer

Urgent or threatening language demanding immediate action. These four options are correct because they represent classic hallmarks of phishing attacks. Urgent or threatening language is a social engineering tactic to bypass rational thought. Spoofed sender addresses exploit trust in familiar domains. Unsolicited attachments or links are the primary delivery mechanism for phishing payloads. Grammatical errors and poor formatting often indicate a lack of professional quality control typical of legitimate organizations.

Answer

Presence of a digital signature from a trusted certificate authority

Answer

A request for sensitive information via a secure web portal

Question 16

Which four of the following are essential elements of an effective business continuity plan (BCP) that a security manager should oversee? (Choose four.)

Accepted Answer

Defined recovery time objectives (RTOs) and recovery point objectives (RPOs). Identification of critical business functions and their dependencies is correct because a BCP must prioritize which systems and processes are essential for survival, ensuring that recovery efforts focus on the most vital operations first. Without this mapping, the plan lacks direction and may waste resources on non-critical assets during a disaster.

Answer

A single, centralized backup location to simplify management

Answer

Automatic failover to a hot site without any human notification

Question 17

An organization is implementing a new Security Information and Event Management (SIEM) system. Which three of the following are primary capabilities that a SIEM provides to support security operations? (Choose three.)

Accepted Answer

Correlation of log data from multiple sources to identify patterns of suspicious activity. A SIEM system's primary capabilities include aggregating and correlating log data from diverse sources (servers, firewalls, endpoints) to detect patterns indicative of security incidents. It provides real-time alerting by applying predefined correlation rules and anomaly detection algorithms to streaming log events. Additionally, SIEM solutions offer long-term log storage and retention, which is essential for compliance audits (e.g., PCI DSS, HIPAA) and post-incident forensic analysis.

Answer

Automated patching of operating system vulnerabilities across the enterprise

Answer

Blocking malicious network traffic at the perimeter firewall

Answer

Performing vulnerability scans on internal hosts and applications

Question 18

Which three of the following are core principles of the CIA triad in information security? (Choose three.)

Accepted Answer

Confidentiality. The CIA triad is the foundational model for information security, consisting of Confidentiality, Integrity, and Availability. Confidentiality ensures data is accessible only to authorized users, often enforced through encryption (e.g., AES-256) and access controls. Integrity guarantees data has not been tampered with, using mechanisms like hashing (SHA-256) or digital signatures. Availability ensures systems and data are accessible when needed, supported by redundancy (RAID, failover clusters) and DDoS mitigation.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 19

A security operations center (SOC) analyst is investigating a potential malware outbreak. Which three of the following indicators of compromise (IOCs) would provide the strongest evidence of malicious activity? (Choose three.)

Accepted Answer

An outbound connection from an internal workstation to a known command-and-control (C2) IP address. An outbound connection to a known C2 IP address is a strong indicator of compromise because it suggests the infected host is communicating with an attacker-controlled server to receive commands or exfiltrate data. This is a direct network-level IOC that is rarely seen in legitimate traffic, especially when the IP is listed in threat intelligence feeds as malicious.

Answer

An increase in legitimate web traffic to a corporate website from a new geographic region

Answer

A user reporting a slow computer that started after installing a software update

Answer

A single failed login attempt on a user account from an internal IP address

Question 20

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

Accepted Answer

Pretexting, because the attacker is inventing a believable support story to gain trust.. The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Answer

Watering hole, because the attacker is targeting a trusted web service used by employees.

Answer

Tailgating, because the attacker is attempting to bypass a physical security barrier.

Answer

Whaling, because the attacker is targeting a high-value executive account directly.