SY0-701 Practice Exam 66 — 20 Questions

Question 1

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

Accepted Answer

Request a risk exception and document compensating controls until patching is possible. Option B is correct because the vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Answer

Ignore the finding because the scanner produced a false positive

Answer

Disable the vulnerability scanner to prevent repeated alerts

Answer

Immediately retire the server even though the application is still business-critical

Question 2

A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?

Accepted Answer

A critical flaw on an internet-facing VPN appliance with known exploit code. The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.

Answer

A low-severity finding on an internal test server with no network access

Answer

A cosmetic configuration warning on a printer management interface

Answer

A medium-severity issue on a device that is powered off and not in service

Question 3

An email security team receives a macro-enabled spreadsheet from a known supplier. The file must be analyzed before users open it, and if it proves malicious, the organization wants to stop the same attachment from reaching other inboxes. Which two tools are the best fit? Select two.

Accepted Answer

Sandboxing the attachment in an isolated environment.. Sandboxing (A) is correct because it allows the file to be executed in an isolated, controlled environment to observe its behavior (e.g., network connections, file modifications) without risk to the production network. This is the standard method for analyzing suspicious attachments for zero-day or macro-based malware.

Answer

Network access control to verify the supplier's laptop posture.

Answer

Data loss prevention to block outbound customer records.

Answer

Intrusion detection system signatures on the mail server.

Question 4

A Windows laptop is believed to be involved in a credential-theft incident. It is still powered on, connected to Wi-Fi, and the user reports that the screen recently locked by itself. The SOC can reach the device remotely through EDR. Which two actions should be taken before the laptop is shut down? Select two.

Accepted Answer

Capture volatile data such as running processes and active network connections while the system is still live.. Option A is correct because capturing volatile data (e.g., running processes, active network connections, memory contents) is a critical first step in forensic response. This data resides in RAM and is lost when the system is powered off, so it must be collected while the laptop is still live to preserve evidence of the attacker's current activities, such as active credential theft tools or command-and-control connections.

Answer

Run a full antivirus scan immediately, because the scan report will serve as the primary evidence.

Answer

Reboot the laptop into Safe Mode so the attacker’s code will not load.

Answer

Power off the laptop immediately to prevent the incident from spreading further.

Question 5

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time

Question 6

After a ransomware event, management wants proof that backups can actually be used before trusting them. Which two activities best validate recoverability? Select two.

Accepted Answer

Restore a sample file or folder into an isolated test environment.. Restoring a sample file or folder into an isolated test environment (Option A) directly validates that the backup data is readable, the restore process works, and the data can be accessed in a clean environment. This is the most practical way to prove recoverability without risking production systems, as it tests the actual restore workflow end-to-end.

Answer

Trust a backup because the job status shows completed successfully.

Answer

Increase backup retention without testing restore ability.

Answer

Keep backups on production servers for quicker access during incidents.

Question 7

A Windows server is still running after suspected compromise. Before it is powered down, which two volatile data sources should be collected first? Select two.

Accepted Answer

A memory capture or RAM image from the live system.. A memory capture (RAM image) preserves volatile data that is lost on power-down, including running processes, open network connections, encryption keys, and malware that exists only in memory. This is critical for forensic analysis of a live system suspected of compromise, as it captures the system state at the time of collection.

Answer

A full disk image from the powered-off server.

Answer

A hardware inventory report from the asset management database.

Answer

A screenshot of the server’s desktop wallpaper for reference.

Question 8

A web portal builds its database query by directly appending a user's search input. When the user types a single quote, the application returns a database error. Which attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. When a single quote (') is appended, it breaks the SQL string delimiter, causing a syntax error that the database exposes. This is the classic indicator of a SQL injection vulnerability, where an attacker can manipulate the query structure.

Answer

Cross-site scripting

Answer

DNS poisoning

Answer

Privilege escalation

Question 9

A web login form uses unsanitized input in the backend query. When an attacker enters `' OR '1'='1'--` into the username field, the application grants access without a valid password. Which attack pattern is being used?

Accepted Answer

SQL injection, because the input changes the meaning of the database query.. Option B is correct because the attacker's input (`' OR '1'='1'--`) is a classic SQL injection payload that alters the structure of the backend SQL query. By injecting a tautology (`OR '1'='1'`) and commenting out the rest of the query with `--`, the attacker bypasses authentication, causing the database to return a valid row without requiring a correct password.

Answer

Cross-site scripting, because the attacker is trying to run code in the browser.

Answer

Broken session management, because the user is still logged in after leaving the page.

Answer

Insecure deserialization, because the application accepts user input.

Question 10

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

Accepted Answer

Enable SMB signing and remove anonymous access to the share.. Option C is correct because enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Answer

Remove all backup jobs until the scan is cleared.

Answer

Disable the file server and rebuild it from scratch immediately.

Answer

Increase the directory quota so the share cannot overflow.

Question 11

A web team is moving a customer portal behind a new inspection device. They need something that can examine HTTP requests, block malicious patterns like injection attempts, and still allow normal browsing. Which control is most appropriate?

Accepted Answer

WAF, because it understands web requests and can block malicious application-layer traffic.. A WAF (Web Application Firewall) is the correct choice because it operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic. It can parse web requests, identify malicious patterns such as SQL injection or XSS payloads, and block them while allowing legitimate traffic to pass through to the customer portal.

Answer

IDS, because it alerts on suspicious traffic without affecting application delivery.

Answer

DLP, because it can stop sensitive data from being posted to the portal.

Answer

NAC, because it verifies whether devices are allowed onto the network.

Question 12

A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.

Accepted Answer

Place the web server in a DMZ.. Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.

Answer

Place both the web server and the database on the same internet-facing subnet.

Answer

Expose the database port to the internet so administrators can connect faster.

Answer

Use the guest wireless VLAN for both systems.

Question 13

After a phishing simulation, many users still almost submitted credentials to a fake Microsoft login page. Security wants to reduce repeat mistakes quickly without interrupting daily work. Which approach is best?

Accepted Answer

Use short, targeted awareness messages with screenshots of the actual lure and an easy reporting path.. Option C is correct because it uses just-in-time, context-specific training that directly addresses the observed behavior without disrupting workflow. By showing users the exact lure they encountered and providing a simple reporting path, the organization reinforces recognition of the specific phishing technique and encourages immediate reporting, which is more effective than generic warnings or lengthy retraining for reducing repeat mistakes quickly.

Answer

Send one enterprise-wide warning email listing every phishing indicator the users should memorize.

Answer

Require all employees to retake the full annual security course immediately.

Answer

Remove email access for any user who clicked the simulation link.

Question 14

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

Accepted Answer

Rewrite the database access layer to use parameterized queries or prepared statements.. The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Answer

Encode special characters in the browser before submitting the search form.

Answer

Disable detailed error messages so attackers cannot see the database name.

Answer

Increase password complexity requirements for all application users.

Question 15

After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?

Accepted Answer

The percentage of users who click phishing test links. Option D is correct because the percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.

Answer

The number of spam emails received by the mail gateway

Answer

The average length of employee passwords

Answer

The count of antivirus alerts on endpoints

Question 16

After a new MFA policy rollout, the SIEM generates an alert for five failed logins to a SaaS admin portal from one IP, followed by a successful login to the same account from an IP in another country. The account owner says they were in meetings all day. What should the analyst do first?

Accepted Answer

Correlate identity provider, VPN, and endpoint logs to validate whether the activity matches the user's normal pattern.. Option B is correct because the alert shows a successful login after five failures from a different country, which is a classic indicator of a potential account takeover. The analyst must correlate identity provider logs (e.g., Okta, Azure AD) for authentication details, VPN logs for network origination, and endpoint logs for device posture to determine if the successful login matches the user's normal behavior. This step validates whether the activity is legitimate or malicious before taking any irreversible action.

Answer

Disable the account immediately without checking any other logs.

Answer

Delete the alert because MFA was enabled and the login eventually succeeded.

Answer

Reimage the user's laptop to remove any possible malware right away.

Question 17

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

Accepted Answer

Evil twin. The correct answer is B, Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials. This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Answer

Rogue access point

Answer

Bluetooth bluejacking

Answer

NFC relay attack

Question 18

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

Accepted Answer

Apply the approved secure baseline and disable unnecessary services.. Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Answer

Install additional endpoint monitoring agents to compensate for the extra services.

Answer

Increase the disk encryption key size to protect the running services.

Answer

Move the server to a different subnet and leave the configuration unchanged.

Question 19

After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?

Accepted Answer

Compute and document cryptographic hash values for the source and the image.. Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.

Answer

Open the image file and browse folders to confirm the contents look normal.

Answer

Rename the image file with the case number and store it on a desktop.

Answer

Run a full antivirus scan on the image before logging it in.

Question 20

After a file server is restored from backup, users can open the share, but the business wants to be sure the recovery was successful. What should the administrator verify next?

Accepted Answer

That representative files open correctly and the restored data matches the required recovery point.. Option B is correct because verifying that representative files open correctly and match the required recovery point (RPO) confirms data integrity and completeness, not just that the restore process ran without errors. This aligns with the backup validation principle of performing a data integrity check, such as comparing file hashes or checking timestamps, to ensure the restored data is usable and meets the business's recovery objectives.

Answer

Only that the restore completed without any error message.

Answer

That the server has enough free disk space for future growth.

Answer

That the backup software icon appears green on the console.