SY0-701 Practice Exam 65 — 20 Questions

Question 1

A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Investigate the user's recent activity for signs of compromise.. The pattern of failed login attempts from a single external IP using password variations suggests a brute-force or password-spraying attack. The security analyst must first investigate the user's recent activity to determine if the account was successfully compromised or if the attacker gained access via a successful login attempt before the lockouts occurred. This aligns with the incident response process, where identification and analysis precede containment actions like blocking IPs or resetting passwords.

Answer

Block the external IP address at the perimeter firewall.

Answer

Disable the user account and require a password reset.

Answer

Increase the account lockout threshold to prevent future lockouts.

Question 2

A security team configures the SIEM to alert when a user account has several failed logins followed by a successful login from a new location. What type of control is this?

Accepted Answer

Detective control, because it identifies suspicious activity after the event has started.. This is a detective control because the SIEM is configured to monitor and analyze log data after events have occurred, specifically identifying a pattern of several failed logins followed by a successful login from a new location. The alert does not prevent or block the login; it only notifies the security team of potentially suspicious activity that has already taken place, allowing them to investigate further.

Answer

Preventive control, because it blocks the login attempt before it occurs.

Answer

Corrective control, because it automatically fixes the account after the login succeeds.

Answer

Deterrent control, because it discourages attackers from trying to sign in.

Question 3

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

Accepted Answer

Federated single sign-on with a central identity provider.. Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Answer

Shared generic accounts for each department.

Answer

A separate username and password database in every SaaS application.

Answer

A site-to-site VPN for every SaaS vendor.

Question 4

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

Accepted Answer

Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.. Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Answer

Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

Answer

Install a VPN app on the tablets and let users choose their own lock-screen settings.

Answer

Use application allowlisting alone and avoid enrolling the tablets in a management platform.

Question 5

Based on the exhibit, which metric best shows that employees are recognizing and escalating phishing attempts more quickly?

Accepted Answer

Median report time, because it shows how quickly users notify security after spotting a phish.. The median report time directly measures the speed at which employees notify the security team after identifying a phishing simulation email. A decreasing median report time indicates that users are recognizing phishing attempts more quickly and escalating them, which is the key behavioral change this metric captures. Unlike click rate, which only measures failure, report time measures the positive action of reporting.

Answer

Click rate, because a lower click rate is the only useful awareness metric.

Answer

Training completion rate, because it proves every employee attended the awareness session.

Answer

Number of simulation emails sent, because a larger campaign is always a better metric.

Question 6

An organization is evaluating a payroll SaaS provider after the procurement team asks for evidence that the vendor's security controls were designed and operating effectively during the past year. Which document should the security team review first?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a period of time (typically 6–12 months), confirming that security controls were not only designed but also operating effectively. This directly meets the procurement team's need for evidence of the vendor's security posture over the past year, as required for evaluating a SaaS provider handling sensitive payroll data.

Answer

Memorandum of understanding

Answer

Software license agreement

Answer

Network diagram of the vendor's data center

Question 7

Based on the exhibit, which governance artifact is being described?

Accepted Answer

Baseline, because it defines the approved minimum configuration that systems must meet.. The exhibit describes a baseline because it specifies the approved minimum configuration settings that systems must meet, such as requiring AES-256 encryption, disabling weak protocols like SSL and TLS 1.0, and enforcing a minimum password length of 14 characters. These are mandatory security thresholds, not broad intent, step-by-step instructions, or optional standards.

Answer

Policy, because it states broad organizational intent without requiring specific settings.

Answer

Standard, because it defines mandatory requirements but does not describe a step-by-step process.

Answer

Procedure, because it explains the exact sequence an administrator should follow to secure the device.

Question 8

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

Accepted Answer

Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.. Encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Answer

Store all backups on a shared file server so administrators can restore them quickly.

Answer

Keep only the most recent snapshot to reduce storage cost and simplify recovery.

Answer

Rely on RAID mirroring because it automatically creates a secure archival copy.

Question 9

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Accepted Answer

Set up MFA, conditional access, and user-role assignments for tenant accounts.. In a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Answer

Patch the SaaS application's source code on the provider's servers.

Answer

Replace the provider's hypervisors with company-owned hardware.

Answer

Maintain the provider's network firewalls and datacenter cooling systems.

Question 10

A finance laptop is powered on, the user is still logged in, and it remains connected to Wi-Fi after a malware alert. What should the responder do first to preserve volatile evidence?

Accepted Answer

Collect volatile data such as memory, running processes, and active network connections.. The laptop is powered on, the user is logged in, and it is connected to the network, meaning volatile data (memory contents, running processes, active network connections) is at immediate risk of being lost if the system is shut down or tampered with. The responder must collect this data first to preserve evidence of the malware's current state, including any malicious processes, network connections, and in-memory artifacts that would disappear on power loss.

Answer

Power the laptop off immediately to stop any further attacker activity.

Answer

Run a full antimalware scan before touching any other data.

Answer

Disconnect the power cable and remove the battery to prevent changes.

Question 11

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Accepted Answer

Secure Boot. Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Answer

DNS forwarding

Answer

Longer screen-lock timeout

Answer

Public DNS resolvers

Question 12

A user reports that a shared department drive is rapidly renaming files and creating ransom notes on a Windows file server. The SOC confirms suspicious activity is still occurring on that server. What should the incident responder do first?

Accepted Answer

Isolate the server from the network while keeping it powered on if possible.. The immediate priority is to contain the ransomware outbreak by isolating the server from the network, which stops the malicious activity from spreading to other systems while preserving volatile evidence (e.g., running processes, memory contents) for forensic analysis. Powering off the server (Option A) would destroy this critical evidence and may not stop the encryption process if it is already in memory. Isolation via network disconnection (e.g., disabling the NIC or unplugging the cable) is the standard first step in incident response for active ransomware.

Answer

Shut down the server immediately to stop all malicious activity.

Answer

Restore the drive from backup before collecting any evidence.

Answer

Inform users to continue working until the forensic team arrives.

Question 13

A security analyst is reviewing authentication logs from a corporate web application. The logs show that over a span of two hours, a single external IP address attempted to log in with 500 different usernames, each using the same password 'Spring2024!'. Only a few of these attempts succeeded. Which type of attack is most likely being observed?

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against many different usernames. This technique avoids account lockout policies that typically trigger after multiple failed attempts on a single account, and the few successful logins indicate valid credentials were found.

Answer

Brute force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 14

A hybrid cloud portal first checks device health at the identity provider, then requires MFA, then enforces a per-application authorization decision before each sensitive action. Network access is also limited by a gateway, and a WAF sits in front of the app. Which two principles are best demonstrated? Select two.

Accepted Answer

Zero trust, because access is continuously verified instead of assumed after one login.. The scenario describes continuous verification of device health, MFA, and per-application authorization before each sensitive action, which aligns with the Zero Trust principle of 'never trust, always verify.' Unlike traditional perimeter-based security, Zero Trust assumes no implicit trust after initial authentication and requires ongoing validation at every access attempt.

Answer

Least privilege, because users are granted no access at all until the app is offline.

Answer

Separation of duties, because administrators and users must approve each other's actions.

Answer

Need-to-know, because the system hides all information until the user requests it.

Question 15

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

Accepted Answer

Isolate the affected systems from the network and preserve evidence.. Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Answer

Pay the ransom immediately to restore access quickly.

Answer

Reimage the server immediately without documenting the event.

Answer

Disable antivirus alerts so staff can work without distractions.

Question 16

Security receives a company-owned laptop connected to an insider theft investigation. Before the device is transported to the evidence locker, what is the BEST action to support chain of custody?

Accepted Answer

Seal the device in an evidence bag and record each handoff with signatures. Sealing the device in an evidence bag and recording each handoff with signatures establishes a documented, unbroken chain of custody. This ensures the integrity of the evidence by preventing tampering and providing a verifiable record of who handled the device and when, which is critical for admissibility in legal proceedings.

Answer

Factory reset the laptop so investigators can start from a clean system

Answer

Remove the hard drive and image it without any documentation

Answer

Leave the laptop unlocked so the next analyst can inspect it quickly

Question 17

A company is considering a new SaaS vendor that will process customer records. What is the best first action before signing the contract?

Accepted Answer

Perform vendor due diligence and review the vendor's security controls. Performing vendor due diligence and reviewing the vendor's security controls is the best first action because it proactively assesses the SaaS vendor's ability to protect customer records before any data is shared. This aligns with the principle of 'trust but verify' and ensures that the vendor's security posture meets the company's compliance requirements (e.g., GDPR, HIPAA) and risk tolerance before signing a legally binding contract.

Answer

Allow the vendor access immediately and monitor for misuse afterward

Answer

Ask the vendor to send a marketing brochure and pricing sheet only

Answer

Wait until a security incident occurs before reviewing the vendor

Question 18

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 19

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

Accepted Answer

Initiate the organization's incident response process for a potential data exfiltration event.. The combination of a massive data download (500 GB vs. a 10 MB baseline) and a session originating from a country with no business presence strongly indicates a potential data exfiltration event. Initiating the incident response process ensures that the organization follows a structured, documented procedure to contain, analyze, and remediate the threat, preserving forensic evidence and coordinating response actions. The CASB log provides the initial indicators, but the incident response plan is the appropriate framework for handling such high-risk anomalies.

Answer

Immediately block the user account and the source IP address at the CASB.

Answer

Contact the user directly by phone to verify whether they initiated the download.

Answer

Disable the SharePoint document library and remove all user permissions to prevent further data loss.

Question 20

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

Accepted Answer

Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.. Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Require users to share one department password for each SaaS platform.

Answer

Store the same password in every application vault and sync it nightly.