SY0-701 Practice Exam 64 — 20 Questions

Question 1

A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?

Accepted Answer

The critical flaw on the public-facing server, because it has higher business risk.. The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.

Answer

The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.

Answer

Both systems can wait until the next quarterly patch cycle.

Answer

The lab system, because internal systems always outrank external systems.

Question 2

During a disaster recovery test, what is the most important thing to confirm about the backup?

Accepted Answer

That the data can be restored and is usable after recovery.. The most important thing to confirm about a backup during a disaster recovery test is that the data can be restored and is usable after recovery. This validates the integrity and completeness of the backup, ensuring that the recovery point objective (RPO) and recovery time objective (RTO) can be met. Simply verifying that backup files exist does not guarantee they are not corrupted or that the restoration process will succeed, which is why a full restore test is critical.

Answer

That the backup files exist in storage.

Answer

That the backup system uses encryption.

Answer

That the backup is stored on tape instead of disk.

Question 3

A security analyst discovers that an organization's web application is vulnerable to SQL injection. The application uses a legacy database driver that does not support parameterized queries. Which of the following is the BEST mitigation to prevent this vulnerability?

Accepted Answer

Update the database driver to a version that supports parameterized queries.. The root cause of the SQL injection vulnerability is the legacy database driver that does not support parameterized queries. Updating the driver to a modern version that supports parameterized queries (also known as prepared statements) allows the application to separate SQL logic from user-supplied data, effectively preventing SQL injection at the database layer. This addresses the fundamental flaw rather than relying on external filtering or encoding.

Answer

Implement a web application firewall (WAF) to filter malicious input.

Answer

Encode all user input using HTML encoding.

Answer

Disable error messages that reveal database schema.

Question 4

Based on the exhibit, which awareness control best addresses the observed failure pattern?

Accepted Answer

Run targeted vishing exercises and teach a callback verification procedure.. The exhibit shows a pattern where users are falling for phone-based social engineering (vishing), not email or general phishing. Option B directly addresses this by running targeted vishing exercises to simulate the real threat and teaching a callback verification procedure, which is a specific technical control to verify the identity of callers before taking action. This is the most effective awareness control because it trains users to recognize and respond to the exact attack vector observed.

Answer

Replace the phone-call simulation with longer monthly policy newsletters.

Answer

Disable MFA so users are not asked for one-time codes.

Answer

Tell users to ignore all requests from anyone outside the company.

Question 5

Based on the exhibit, which change best improves recovery resilience against a repeat ransomware incident?

Accepted Answer

Use an immutable or offline backup copy that production credentials cannot modify.. Ransomware often encrypts or deletes accessible backups. An immutable or offline backup copy (e.g., using S3 Object Lock, Write Once Read Many (WORM) storage, or air-gapped tape) ensures that even if production credentials are compromised, the backup data cannot be modified or deleted by the attacker. This directly preserves a clean recovery point after a ransomware incident.

Answer

Keep the current design and add more NAS storage capacity.

Answer

Move the NAS to the same subnet as the file server for faster backups.

Answer

Shorten the backup retention period to reduce storage use.

Question 6

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

Accepted Answer

The executable hash from the malware sample.. The executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Answer

The daily domain name used for command and control.

Answer

The employee's home city where the alert was observed.

Answer

The brand of the user's keyboard and mouse.

Question 7

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

Accepted Answer

Seal the device in an evidence bag and record each handoff with signatures. Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Answer

Factory reset the laptop so investigators can start from a clean system

Answer

Remove the hard drive and image it without any documentation

Answer

Leave the laptop unlocked so the next analyst can inspect it quickly

Question 8

An EDR console reports possible beaconing from a workstation because it makes outbound HTTPS connections to the same cloud IP every 15 minutes. The workstation belongs to the patch-management team, and the destination resolves to a vendor update service. Which evidence best supports closing the alert as a false positive?

Accepted Answer

Process lineage and signed agent logs show the patch client initiated the traffic on schedule.. It provides verifiable evidence that the outbound HTTPS connections are legitimate: the process lineage and signed agent logs confirm the patch-management client initiated the traffic on its scheduled update cycle. This aligns with the expected behavior of a patch-management tool, which often uses HTTPS to a vendor update service at regular intervals. The EDR's beaconing detection is a false positive because the traffic is not malicious but rather a routine, authorized activity.

Answer

The workstation user says the activity looks normal and no files were encrypted.

Answer

The source IP appears on a blocklist, so the alert must be malicious.

Answer

The workstation has antivirus installed, which means outbound beaconing is impossible.

Question 9

A user reports a suspicious pop-up on a workstation and the SOC suspects malware. Which action should the responder take first to contain the threat?

Accepted Answer

Disconnect the workstation from the network. Disconnecting the workstation from the network immediately isolates the suspected malware, preventing it from communicating with command-and-control (C2) servers, spreading laterally to other hosts, or exfiltrating data. This is the first step in the NIST incident response containment phase, as it stops network-based propagation without destroying forensic evidence.

Answer

Wipe the workstation immediately

Answer

Return the workstation to the user after restarting it

Answer

Wait until the next patch cycle to see if the issue disappears

Question 10

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

Accepted Answer

Verify the request using a known phone number or portal from previous records before taking action.. The email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Answer

Reply to the email asking for confirmation of the new bank details.

Answer

Forward the email to the vendor's entire contact list to warn them immediately.

Answer

Open the attached invoice to check whether the payment information matches past records.

Question 11

A developer finds a critical bug in a customer portal on Friday afternoon. The fix must be released quickly, but the team needs a way to reverse the change if testing reveals a problem and wants the release to follow the normal approval process. Which two practices should be used? Select two.

Accepted Answer

Create a documented rollback plan. A documented rollback plan ensures that if the emergency fix introduces new issues during testing, the team can quickly and safely revert to the previous stable state. This aligns with the principle of change management, which requires a recovery procedure for any emergency change to minimize downtime and risk.

Answer

Deploy the fix directly to production without approval

Answer

Skip testing to meet the deadline

Answer

Rename the release package to reduce risk

Question 12

A SIEM reports a successful sign-in to a SaaS admin portal from a new country, followed three minutes later by multiple configuration changes to mailbox forwarding rules. The account owner says they were in the office and did not approve any changes. What should the analyst check next?

Accepted Answer

The identity provider and MFA logs to confirm whether the session was legitimately authenticated or hijacked.. The SIEM alert shows a successful sign-in from a new country followed by suspicious configuration changes, which is a classic indicator of session hijacking or credential theft. Checking the identity provider (IdP) and MFA logs allows the analyst to verify if the authentication was legitimate (e.g., from a known device/IP) or if the session token was stolen and reused, as MFA can be bypassed via token replay or consent phishing. This step directly addresses the core question of whether the session was authorized or compromised.

Answer

The office printer logs to see whether the user printed the mailbox rules.

Answer

The antivirus signature version on the user’s laptop only.

Answer

The DNS cache on the user’s laptop to find the forwarding rule target.

Question 13

A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?

Accepted Answer

The file has not been altered since the vendor published the checksum.. A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.

Answer

The file remains confidential during transmission.

Answer

The vendor's private key was used to encrypt the patch.

Answer

The patch will definitely install successfully on every system.

Question 14

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 15

A company wants employees to sign in once to access several SaaS applications, but it also wants to require MFA only when users connect from unmanaged devices or outside the corporate network. Which architecture best supports this goal?

Accepted Answer

Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.. Federated identity with single sign-on (SSO) allows users to authenticate once and access multiple SaaS applications, while conditional access policies evaluate device posture (e.g., compliance status, managed vs. unmanaged) and network location (e.g., corporate IP range vs. external) to enforce MFA only when risk conditions are met. This architecture leverages standards like SAML 2.0 or OpenID Connect for SSO and integrates with device management systems (e.g., MDM) to assess device health before granting access.

Answer

Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.

Answer

Use local accounts in each SaaS application and rotate passwords every 30 days.

Answer

Grant all employees the same access role to simplify authentication and reduce support tickets.

Question 16

A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?

Accepted Answer

Implement breached-password screening plus MFA.. The attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.

Answer

Increase password length requirements only.

Answer

Disable account lockouts to avoid user inconvenience.

Answer

Allow unlimited retries so legitimate users are never blocked.

Question 17

A coworker asks for a spreadsheet containing employee home addresses and personal phone numbers so they can build a team contact list. What is the best response?

Accepted Answer

Confirm the requester is authorized and only provide the minimum personal data allowed by policy.. It aligns with the principle of least privilege and data minimization, which are core to security program management. Even internal requests must be verified for authorization, and only the minimum personal data required for the stated purpose should be shared, as per organizational policy and privacy regulations like GDPR or CCPA.

Answer

Share the spreadsheet, because the request is from another employee inside the company.

Answer

Email the full spreadsheet, because internal data is not protected by privacy rules.

Answer

Delete the spreadsheet immediately so the information cannot be misused.

Question 18

A help desk technician needs temporary access to read one shared folder to troubleshoot a printer issue. Which access choice best follows least privilege?

Accepted Answer

Give the technician read-only access to the single shared folder needed for the ticket.. It grants the technician only the minimum permissions (read-only) to the specific resource (single shared folder) required to troubleshoot the printer issue. This adheres to the principle of least privilege by limiting access scope and duration, reducing the risk of unauthorized changes or data exposure.

Answer

Grant the technician full control of the entire file server for one day.

Answer

Add the technician to the domain admins group until the issue is resolved.

Answer

Allow the technician to use any account in the department for convenience.

Question 19

A project lead needs to send a spreadsheet labeled confidential to an external auditor. The file contains employee names, salaries, and performance notes. Which handling step best protects the data while still supporting the business need?

Accepted Answer

Use an approved encrypted file-sharing portal with named recipients and access logging. Using an approved encrypted file-sharing portal with named recipients and access logging ensures data-in-transit and data-at-rest encryption, restricts access to only the intended auditor, and provides an audit trail for compliance. This approach meets the business need of securely sharing confidential employee data while supporting regulatory requirements like GDPR or HIPAA, unlike unencrypted email which exposes data to interception.

Answer

Email the attachment unencrypted if the auditor signed an NDA

Answer

Upload the spreadsheet to a public link so the auditor can access it easily

Answer

Remove the confidential label before sending it to avoid confusion

Question 20

A department finished using paper forms that contain customer information, and the retention period has expired. What is the best next step?

Accepted Answer

Dispose of them using approved secure destruction methods. Once the retention period has expired, the organization must securely destroy the paper forms to prevent unauthorized access to customer information. Approved secure destruction methods for paper records include cross-cut shredding, incineration, or pulping, which render the data irrecoverable and comply with data protection regulations like GDPR or HIPAA.

Answer

Store them indefinitely in a cabinet for future reference

Answer

Send them to another team without checking the retention schedule

Answer

Scan them to personal email so the department can keep a copy