SY0-701 Practice Exam 66 — 20 Questions

Question 1

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.. B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Answer

ARP spoofing, because the attacker is changing the MAC address used on the local network.

Answer

Port scanning, because the attacker is probing internal services for open ports.

Answer

Denial-of-service, because the attacker is overwhelming the portal with traffic.

Question 2

A branch office loses power briefly several times each month. Which control best helps keep network equipment running long enough for an orderly shutdown?

Accepted Answer

A UPS. A UPS (Uninterruptible Power Supply) provides battery backup power to network equipment during a power outage, allowing enough time for an orderly shutdown to prevent data corruption or hardware damage. Unlike surge protectors, a UPS actively supplies clean, regulated power from its batteries when the mains fail, making it the correct control for this scenario.

Answer

A badge reader

Answer

A locked filing cabinet

Answer

A fire extinguisher

Question 3

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

Accepted Answer

Risk register. The risk register is the correct document to update because it formally tracks identified risks, their assessed impact, and the chosen risk response (acceptance). Recording the decision to accept the $50,000 ALE risk and obtaining sign-off ensures auditability and accountability, which is a key requirement in risk management frameworks like NIST SP 800-37.

Answer

Business impact analysis (BIA)

Answer

Security baseline configuration document

Answer

Incident response plan

Question 4

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A is prioritized first because it represents the highest overall risk when considering exploitability, potential impact, and asset criticality. While CVSS scores are a factor, remediation decisions should weigh the likelihood of exploitation and the severity of consequences; Finding A poses an immediate and severe threat that could lead to significant compromise, thereby requiring urgent action.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 5

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 6

A project team needs to use a temporary file-sharing service for two weeks because the approved platform is under maintenance. The security manager wants the exception to be reviewed, time-limited, and documented with the business reason. Which governance document should be created?

Accepted Answer

An exception request, because it records a deviation from the normal security requirement.. An exception request is the formal governance document used to record, review, and time-limit a deviation from the organization's security baseline. In this scenario, the temporary use of an unapproved file-sharing service for two weeks requires documented authorization, including the business reason, to ensure the risk is accepted and tracked until the approved platform returns.

Answer

A guideline, because it provides optional best practices for users to follow.

Answer

A standard, because it defines the mandatory company-wide rule for file sharing.

Answer

A procedure, because it gives step-by-step instructions for employees to follow.

Question 7

A help desk analyst can reset passwords in the ticketing portal but cannot view payroll records, edit user profiles, or access other HR functions. Which security principle is the organization applying?

Accepted Answer

Least privilege. The help desk analyst is granted only the permissions necessary to perform their job function—resetting passwords—while all other HR functions are explicitly denied. This is the core definition of least privilege: each user or system component receives the minimum set of access rights needed to complete their tasks. By restricting the analyst’s account to password reset operations only, the organization reduces the attack surface and limits potential damage from compromised credentials or insider misuse.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 8

A vulnerability scan produces these results:
- Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls
- Finding 2: Critical severity, internal development workstation, requires authenticated local access
- Finding 3: Medium severity, test server, no public exploit and not reachable from outside
Which finding should be remediated first?

Accepted Answer

Finding 1. Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Answer

Finding 2

Answer

Finding 3

Answer

All findings are equal because the severity rating alone determines priority

Question 9

A security analyst is reviewing firewall logs and notices repeated connection attempts from a single external IP address to multiple internal IP addresses on TCP port 22 (SSH). Each attempt uses a different username but the same password: 'Spring2024!'. The attempts occur sporadically over a 12-hour period. Which type of attack is most likely being observed?

Accepted Answer

Password spraying attack. This is a password spraying attack because the attacker uses a single common password ('Spring2024!') against multiple usernames across different internal IP addresses, attempting to avoid account lockout by spreading attempts over time and targets. Unlike brute-force or dictionary attacks that focus many passwords against a single account, password spraying targets many accounts with a few weak passwords, making it harder to detect via failed login thresholds.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Man-in-the-middle attack

Question 10

A security administrator is implementing a new access control system and needs to ensure that users are granted only the permissions required to perform their job functions and nothing more. Which principle should guide the design of the access control system?

Accepted Answer

Least privilege. Least privilege is the principle that users should have only the minimum access rights required to perform their duties. This directly matches the administrator's objective to grant only necessary permissions. Separation of duties, MAC, and DAC are related but do not specifically ensure that permissions are restricted to job functions. Therefore, least privilege is the correct guiding principle.

Answer

Separation of duties

Answer

Discretionary access control

Answer

Mandatory access control

Question 11

A security engineer is designing a Zero Trust architecture for a company that has a mix of on-premises and cloud resources. The engineer needs to implement controls that align with the core principles of Zero Trust. Which of the following are core principles of Zero Trust? (Choose two.)

Accepted Answer

Use least privilege access. Zero Trust is built on principles such as verify explicitly, use least privilege access, and assume breach. These ensure that no entity is trusted by default and that access is continuously evaluated. Trust but verify, perimeter reliance, and SSO are not core principles; they either contradict Zero Trust or are implementation details that may support it but are not foundational requirements.

Answer

Rely on network perimeter defenses

Answer

Trust but verify

Answer

Implement single sign-on (SSO) for all users

Question 12

A security administrator at a financial institution is reviewing the organization's encryption strategy. The company wants to protect data stored on backup tapes that are transported to an off-site facility. Which of the following BEST describes the type of encryption that should be applied to the data on the tapes?

Accepted Answer

Encryption at rest. The data on backup tapes is stored data, not data moving across a network or being processed. The primary threat is physical theft or loss of the tapes during transport or off-site storage. Encryption at rest ensures that the data remains confidential even if the media is compromised. Encryption in transit and in use address different states of data and do not protect stored backup media.

Answer

Tokenization

Answer

Encryption in use

Answer

Encryption in transit

Question 13

A security analyst discovers that a critical internal payroll application has no vendor-supported patch for a recently announced remote code execution vulnerability. The application must remain available for at least six months until a replacement is deployed. Management asks the security team to recommend the most appropriate risk response. Which risk response should the analyst recommend?

Accepted Answer

Risk acceptance. The correct response is risk acceptance because the organization cannot patch the application, must keep it running, and has a planned replacement. Formally accepting the risk with management approval and monitoring is the pragmatic choice. Mitigation, transference, and avoidance are either infeasible or would cause unacceptable business disruption. The key is to recognize that acceptance is a valid strategy when other options are exhausted or impractical.

Answer

Risk transference

Answer

Risk mitigation

Answer

Risk avoidance

Question 14

A financial services firm is designing a new online banking platform. The security team wants to ensure that even if an attacker compromises the web front-end, they cannot access the database directly. The design should enforce least privilege and provide a choke point for monitoring and logging. Which of the following security architecture concepts best meets this requirement?

Accepted Answer

Implement a screened subnet (DMZ) with a reverse proxy and a firewall between the web tier and the database tier.. The correct answer is the screened subnet with a reverse proxy and firewall between tiers. This design enforces network segmentation, least privilege, and provides a central point for monitoring and logging. Other options focus on host-level protection, data-at-rest encryption, or availability, none of which prevent lateral movement from a compromised web front-end to the database.

Answer

Deploy a host-based intrusion prevention system (HIPS) on the web servers.

Answer

Use a load balancer to distribute traffic across multiple web servers.

Answer

Enable full-disk encryption on the database servers.

Question 15

A security analyst is examining a Windows workstation that has been exhibiting unusual outbound traffic to an IP address in a foreign country. The analyst runs `netstat -anob` and sees a process named `svchost.exe` listening on TCP port 4444 and maintaining an established connection to that foreign IP. The analyst knows that `svchost.exe` normally hosts legitimate Windows services. Which of the following is the MOST likely explanation for this finding?

Accepted Answer

The `svchost.exe` process has been trojanized and is being used as a backdoor listener.. A legitimate svchost.exe process hosts Windows services and does not listen on arbitrary high ports or maintain external established connections. The presence of a listener on TCP 4444 with an active session to a foreign IP indicates a backdoor, often achieved by injecting malicious code into svchost.exe or replacing it. This behavior is a classic sign of a remote access trojan or command-and-control channel.

Answer

The `svchost.exe` process is hosting the Windows Time service and synchronizing with an external NTP server.

Answer

A remote administration tool such as Remote Desktop is running on a non-standard port.

Answer

The workstation is participating in a legitimate peer-to-peer Windows Update delivery.

Question 16

A company is implementing a defense-in-depth strategy for its internal network. The security team wants to detect and respond to malicious activities that might bypass perimeter defenses. Which two controls should be implemented to provide continuous monitoring and analysis of network traffic and endpoint activities? (Choose two.)

Accepted Answer

Intrusion detection system (IDS) sensors placed on critical network segments.. The correct answers are IDS sensors and a SIEM system. IDS sensors detect suspicious network traffic, while a SIEM aggregates and correlates logs for comprehensive analysis. Together, they provide continuous monitoring and detection of malicious activities that bypass perimeter defenses. The other options are preventive or availability controls, not detection and analysis tools.

Answer

Host-based firewall on each employee workstation.

Answer

Uninterruptible power supply (UPS) for network devices.

Answer

Data loss prevention (DLP) endpoint agent.

Question 17

A multinational corporation is implementing a secure remote access solution for its employees. The security team requires that all remote sessions be encrypted, that users authenticate with multifactor authentication (MFA), and that the solution supports granular access control based on user identity and device posture. Which of the following technologies best meets these requirements?

Accepted Answer

Software-defined perimeter (SDP) with zero trust network access (ZTNA).. The correct answer is SDP with ZTNA. It uniquely combines encryption, MFA, and granular, context-aware access control based on user identity and device posture. Other options may provide encryption and authentication but lack the dynamic, identity-centric access control that the scenario demands. SDP with ZTNA is designed for zero trust environments, making it the most suitable choice.

Answer

Remote Desktop Protocol (RDP) gateway with Network Level Authentication (NLA).

Answer

SSL VPN with split tunneling and a captive portal.

Answer

IPsec VPN with pre-shared keys and static routing.

Question 18

A security manager is reviewing the organization's incident response plan and notices that it lacks a defined process for handling evidence that may be used in legal proceedings. Which concept should the manager ensure is addressed to maintain the integrity of evidence?

Accepted Answer

Chain of custody. Chain of custody is essential for ensuring that evidence collected during an incident remains admissible in legal proceedings. It documents who handled the evidence, when, and why, preventing tampering or contamination. The other options address different areas: retention schedules, user policies, and business continuity. The incident response plan must include chain of custody procedures to support potential prosecutions or lawsuits.

Answer

Data retention policy

Answer

Business impact analysis

Answer

Acceptable use policy

Question 19

A security engineer is reviewing a web application that uses a database. The application constructs SQL queries by concatenating user input directly into the query string. During a penetration test, an attacker enters `' OR '1'='1` in the username field and successfully logs in without valid credentials. Which of the following BEST describes the vulnerability and the most effective mitigation?

Accepted Answer

SQL injection; mitigate by using parameterized queries (prepared statements).. The payload `' OR '1'='1` is a textbook SQL injection that alters the query's WHERE clause to return true, allowing authentication bypass. The root cause is dynamic SQL construction via string concatenation. Parameterized queries ensure that user input is treated as data, not executable code, effectively neutralizing SQL injection. This is the most robust and recommended mitigation.

Answer

Cross-site scripting (XSS); mitigate by encoding output.

Answer

Cross-site request forgery (CSRF); mitigate by using anti-CSRF tokens.

Answer

Command injection; mitigate by validating input against a whitelist.

Question 20

A security engineer is configuring a new endpoint detection and response (EDR) solution. The organization wants to detect when a user opens a malicious PDF that exploits a vulnerability in Adobe Reader to execute a shell. Which EDR capability should the engineer ensure is enabled to detect this activity?

Accepted Answer

Child process monitoring and process lineage tracking to detect Adobe Reader spawning a command shell.. Detecting a PDF exploiting Adobe Reader to spawn a shell requires monitoring process creation events and analyzing parent-child relationships. EDR solutions with child process monitoring can alert when a document reader spawns a command interpreter, which is highly suspicious. This detection works even if the shell is a legitimate binary, because the behavior is anomalous.

Answer

Network traffic analysis to detect command-and-control (C2) communication from the endpoint.

Answer

File integrity monitoring (FIM) on the Adobe Reader installation directory to detect unauthorized changes.

Answer

Script block logging and AMSI integration to capture PowerShell execution.