SY0-701 Practice Exam 65 — 20 Questions

Question 1

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the request using a known supplier contact method before taking action. The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 2

Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?

Accepted Answer

Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.. It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.

Answer

Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.

Answer

Use a shared administrator password so the technician can finish the ticket without changing group memberships.

Answer

Ask the user's manager to perform the reset manually so the help desk does not need additional access.

Question 3

A security team wants every company laptop to have the same screen-lock timeout, disk encryption setting, and local firewall configuration. Which type of document should define these mandatory settings?

Accepted Answer

A standard, because it specifies mandatory technical requirements.. A standard is the correct document type because it defines mandatory technical requirements that must be uniformly enforced across all company laptops. In this scenario, the screen-lock timeout, disk encryption setting (e.g., BitLocker or FileVault), and local firewall configuration (e.g., Windows Defender Firewall with Advanced Security) are non-negotiable controls that must be applied identically to every device to meet security policy. Standards are binding and often reference specific configuration baselines, such as CIS Benchmarks or NIST SP 800-53, ensuring consistent implementation.

Answer

A guideline, because employees can decide whether to follow it.

Answer

A risk register, because it tracks all security vulnerabilities on laptops.

Answer

A business impact analysis, because it identifies the most important laptop functions.

Question 4

Based on the exhibit, what is the best risk treatment recommendation for the security manager?

Accepted Answer

Mitigate the risk with compensating controls until the migration is complete.. The exhibit shows a legacy portal with known vulnerabilities that is scheduled for migration to a modern platform. Since backups alone do not address the active security weaknesses, the best recommendation is to mitigate the risk with compensating controls (e.g., web application firewall rules, network segmentation, or strict access controls) to reduce the likelihood or impact of exploitation until the migration is complete. This aligns with the risk treatment strategy of mitigation, as it actively reduces the risk without prematurely retiring the service or relying solely on insurance.

Answer

Accept the risk because backups are already enabled.

Answer

Avoid the risk by immediately retiring the portal.

Answer

Transfer the risk by purchasing cyber insurance only.

Question 5

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

Accepted Answer

Implement federated single sign-on through a central identity provider with MFA and conditional access policies.. Federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Use shared accounts for each department and keep one password vault for the team.

Answer

Require all users to connect through a VPN before any SaaS login and remove identity federation.

Question 6

A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?

Accepted Answer

Review the server's process list and logs to identify the source.. The first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.

Answer

Disconnect the server from the network immediately.

Answer

Block the IP address at the perimeter firewall.

Answer

Escalate the incident to the incident response team.

Question 7

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Accepted Answer

Connect through a VPN to a bastion host, then use SSH to the switches.. It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Answer

Telnet to the switches over a router port-forward rule.

Answer

SSH directly to the switches from the internet using password-only authentication.

Answer

Use SNMPv2c with restricted source IP addresses.

Question 8

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

Accepted Answer

Record each transfer with date, time, handler name, and signatures.. Chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Answer

Place the laptop on a desk until the investigator is available.

Answer

Reset the laptop so the legal team can access it more easily.

Answer

Remove the hard drive and connect it to a personal workstation.

Question 9

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

Accepted Answer

Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.. Federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Answer

Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

Answer

Create a shared emergency administrator account so access can be revoked by changing one password.

Answer

Require users to clear browser cookies after termination so the SaaS session expires sooner.

Question 10

A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?

Accepted Answer

Use parameterized queries or prepared statements for the search filters.. Parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.

Answer

Escape apostrophes in the input before building the SQL statement.

Answer

Disable database error messages so attackers cannot see query details.

Answer

Place the application behind a VPN so only internal users can run searches.

Question 11

A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?

Accepted Answer

Disconnect the workstation from the network. According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.

Answer

Perform a forensic analysis of the workstation

Answer

Reimage the workstation

Answer

Alert the system administrator

Question 12

The legal team wants to confirm that customer records are being deleted on schedule after the retention period expires. Which two artifacts best demonstrate compliance? Select two.

Accepted Answer

An approved retention schedule or retention policy that defines the deletion period.. An approved retention schedule or policy is the authoritative document that defines the required deletion period for customer records. It serves as the legal mandate against which compliance is measured. Option C is correct because system or audit logs provide verifiable evidence that the deletion job executed successfully, confirming that the policy was actually followed. Together, these two artifacts demonstrate both the requirement (policy) and the execution (logs) needed to prove compliance.

Answer

A folder of employee social media posts about data cleanup.

Answer

A list of all printers in the office environment.

Answer

A draft policy from last year that was never approved.

Question 13

Based on the exhibit, what should the security team recommend before sharing the report?

Accepted Answer

Remove unnecessary personal fields and share only the minimum data needed for the analysis.. The principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Answer

Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

Answer

Keep all fields and encrypt the file before sending it to the vendor.

Answer

Store the report in a shared folder so the vendor can access it later if needed.

Question 14

Match each PKI term to what it does.

Accepted Answer

CA: Issues and manages digital certificates. CA issues certificates, RA verifies identities, CRL lists revoked certificates, public key encrypts, private key decrypts, digital signature provides integrity and non-repudiation.

Answer

CA: Verifies identity of certificate requestors

Answer

RA: Issues and manages digital certificates

Answer

CRL: Issues and manages digital certificates

Question 15

An engineering tool runs on an unsupported operating system, but the tool is used only occasionally and can be replaced by a supported cloud service with little workflow impact. Which risk treatment is best?

Accepted Answer

Avoid the risk by retiring the unsupported system and replacing it with the supported service. The best risk treatment for an unsupported operating system that is only used occasionally and can be replaced with minimal workflow impact is to avoid the risk entirely. By retiring the unsupported system and migrating to the supported cloud service, the organization eliminates the security vulnerabilities and compliance issues associated with the outdated OS. This aligns with the risk avoidance strategy, which is preferred when the cost of mitigation is low and the risk is high.

Answer

Accept the risk because the tool is old and still functions

Answer

Transfer the risk to the cloud provider without making changes

Answer

Compensate for the risk by adding more user passwords

Question 16

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

Accepted Answer

Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.. Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Answer

Assume the provider's default settings are sufficient because encryption at rest is already enabled.

Answer

Move the documents to a public bucket so users can access them without friction.

Answer

Disable encryption at rest so administrators can troubleshoot access problems more easily.

Question 17

A customer portal team must keep an unsupported Linux appliance online for 60 days while a replacement is built. The appliance processes payment tokens and cannot be patched until the vendor certifies the new image. Which two actions best reduce the residual risk during the 60-day window? Select two.

Accepted Answer

Restrict network paths to only the required upstream and downstream systems through firewall allow-lists.. Restricting network paths to only required upstream and downstream systems via firewall allow-lists reduces the attack surface by limiting the appliance's exposure to unnecessary network traffic. This is a classic network segmentation compensating control that mitigates the risk of lateral movement from an unpatched, vulnerable system. By enforcing strict ingress/egress rules, the team can prevent unauthorized access and contain potential exploits during the 60-day window.

Answer

Move the appliance onto the flat user VLAN so the team can monitor it with standard workstation tools.

Answer

Declare the risk fully accepted and make no configuration changes until the replacement is ready.

Answer

Disable logging because the appliance is already at capacity and logs can slow it down.

Question 18

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

Accepted Answer

Use client-side encryption before upload and keep the keys in an external HSM or key service.. Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Answer

Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

Answer

Place the storage account in a private subnet and block all Internet access.

Answer

Rely on immutable snapshots and versioning to prevent unauthorized access.

Question 19

A help desk technician reports that a user's account was locked out three times overnight. The security team reviews the authentication logs and discovers that the lockouts resulted from failed login attempts originating from a single external IP address, each attempt using a slightly different variation of the user's password. Which of the following should the security analyst do FIRST?

Accepted Answer

Investigate the user's recent activity for signs of compromise.. The pattern of failed login attempts from a single external IP using password variations suggests a brute-force or password-spraying attack. The security analyst must first investigate the user's recent activity to determine if the account was successfully compromised or if the attacker gained access via a successful login attempt before the lockouts occurred. This aligns with the incident response process, where identification and analysis precede containment actions like blocking IPs or resetting passwords.

Answer

Block the external IP address at the perimeter firewall.

Answer

Disable the user account and require a password reset.

Answer

Increase the account lockout threshold to prevent future lockouts.

Question 20

A vulnerability scan produces these results:
- Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls
- Finding 2: Critical severity, internal development workstation, requires authenticated local access
- Finding 3: Medium severity, test server, no public exploit and not reachable from outside
Which finding should be remediated first?

Accepted Answer

Finding 1. Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Answer

Finding 2

Answer

Finding 3

Answer

All findings are equal because the severity rating alone determines priority