SY0-701 Practice Exam 67 — 20 Questions

Question 1

An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.

Accepted Answer

Isolate the endpoint through the EDR tool or quarantine its network access.. Option A is correct because isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.

Answer

Power off the laptop immediately to stop the activity as fast as possible.

Answer

Wait until the user returns the laptop to the office for physical inspection.

Answer

Remove the EDR agent so the attacker cannot detect the investigation.

Question 2

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Accepted Answer

Build and deploy a secure baseline or gold image for the laptops.. A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Answer

Allow each user to customize local security settings for productivity.

Answer

Skip validation after patching because the baseline will always remain correct.

Question 3

After a ransomware incident, management sees that last night's backups completed successfully and wants proof they can actually be used before production is declared recovered. Which three actions best validate recoverability? Select three.

Accepted Answer

Restore a representative backup into an isolated test environment.. Option A is correct because restoring a representative backup into an isolated test environment directly validates that the backup data is readable, the restore process works, and the system can be brought online without impacting production. This is the only way to confirm the backup is not corrupt or incomplete, as backup software success logs alone are insufficient.

Answer

Increase the retention period without performing any restore.

Answer

Close the incident because the backup software reported a successful job completion.

Question 4

After collecting a suspect laptop, the responder makes a bit-for-bit image of the drive. Which two actions best support chain of custody? Select two.

Accepted Answer

Calculate and record a cryptographic hash of the image.. Option A is correct because calculating and recording a cryptographic hash (e.g., SHA-256) of the bit-for-bit image creates a digital fingerprint that can later be used to verify the image has not been altered. This ensures data integrity, a core requirement for maintaining chain of custody in digital forensics.

Answer

Browse the original drive on a normal office laptop.

Answer

Rename files to make them easier for later review.

Answer

Store the image on a shared folder without access controls.

Question 5

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

Accepted Answer

A fileless attack that relies on trusted tools already on the system. This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Answer

A worm that spreads by exploiting a network service

Answer

A logic bomb that waits for a specific date or event

Answer

A rootkit that changes kernel behavior to hide processes

Question 6

After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?

Accepted Answer

Enforce a hardened baseline with configuration management and compliance checks.. Option B is correct because configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.

Answer

Rely on users to follow the build sheet during setup and avoid future changes.

Answer

Increase antivirus scan frequency so policy settings do not change.

Answer

Apply full disk encryption only, since it covers all endpoint hardening needs.

Question 7

After a ransomware incident, management learns the attacker's stolen domain admin credentials were used to delete recent online backups from the same backup network. Which backup strategy would have most reduced the chance of permanent backup loss?

Accepted Answer

Immutable backups stored in a separate repository or offline location.. Immutable backups stored in a separate repository or offline location prevent deletion or modification by an attacker, even with domain admin credentials. This is because immutability enforces a write-once-read-many (WORM) policy, often implemented via object lock (e.g., S3 Object Lock) or a physical air gap, ensuring that backups cannot be altered or deleted before their retention period expires. In this scenario, the attacker's ability to delete online backups from the same network is mitigated because the immutable repository is isolated and resistant to credential-based tampering.

Answer

Nightly incremental backups stored on the same file server as production data.

Answer

Hypervisor snapshots only, because they are always safer than backups.

Answer

Longer retention on the same backup share to keep more versions available.

Question 8

After hours, EDR alerts show a finance laptop encrypting local files and trying SMB connections to nearby workstations. The user is still logged in, and management wants the fastest step that limits spread while preserving evidence. What should the SOC do first?

Accepted Answer

Use EDR to isolate the laptop from the network.. Option B is correct because EDR isolation immediately blocks all network communication (including SMB) while preserving the endpoint's state for forensic analysis. This stops lateral movement and further encryption without losing volatile data like memory or running processes, which a shutdown would destroy.

Answer

Shut down the laptop immediately to stop any further activity.

Answer

Run a full antivirus scan before making any network changes.

Answer

Reimage the laptop right away from a standard corporate image.

Question 9

After restoring a virtualized file server from backup, users can log in but the accounting application returns database consistency errors. What should you do next?

Accepted Answer

Verify the restore in an isolated environment and confirm application-level integrity and permissions.. Option B is correct because the restore process must be validated beyond basic boot and login functionality. Database consistency errors indicate that the application-level data integrity was compromised during the restore, likely due to missing or inconsistent database files, permissions, or transaction logs. Verifying the restore in an isolated environment allows you to test application-specific integrity checks (e.g., DBCC CHECKDB for SQL Server) and confirm that file permissions and security descriptors are intact before returning the server to production.

Answer

Declare the restore successful because the virtual machine boots and users can sign in.

Answer

Increase the backup retention period and wait for the next scheduled full backup.

Answer

Delete the backup set to prevent confusion with the restored data.

Question 10

An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?

Accepted Answer

Role-based access control, because permissions are assigned by job function and tied to named users.. Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.

Answer

Mandatory access control, because a central authority labels each expense report by sensitivity.

Answer

Discretionary access control, because individual employees decide who can approve expenses.

Answer

Rule-based access control, because approval rights are determined only by the time of day.

Question 11

After restoring a virtual file server from backup, users can open shares, but the accounting application shows the previous day's transactions are missing. Which two steps should the administrator take next? Select two.

Accepted Answer

Verify whether the backup included application-consistent data and transaction logs. Option A is correct because the accounting application's missing transactions indicate the backup may not have captured application-consistent data, such as open transaction logs or database writes. Without application consistency (e.g., using Volume Shadow Copy Service or a database-aware backup agent), the restore point may reflect a crash-consistent state where recent transactions were lost. Verifying the backup type ensures the administrator understands whether the data is recoverable from transaction logs or requires a separate application-level restore.

Answer

Leave the server as is because file shares are accessible

Answer

Delete the current backup set to avoid restoring the wrong version again

Answer

Reimage the server immediately without checking the restore point

Question 12

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

Accepted Answer

Create a demilitarized zone (DMZ) for the public web server.. A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Answer

Place the web server on the internal user subnet so it can reach the database directly.

Answer

Use a VPN concentrator so the website can be accessed securely from outside.

Answer

Use network address translation (NAT) on the web server to hide its IP address.

Question 13

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Accepted Answer

Tokenize primary account numbers before they reach analytics, reporting, or test systems.. Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Answer

Store backups on the same production storage array to simplify restore operations.

Answer

Use simple masking only in spreadsheets while leaving the source database unchanged.

Question 14

An employee receives a text message from an unknown number pretending to be IT. It includes a shortened URL for "urgent MFA re-enrollment" and says the account will be locked in 15 minutes. What is the best response?

Accepted Answer

Report the message through the official security channel and verify the request using known IT contact information.. Option B is correct because it follows the principle of verifying unsolicited requests through trusted channels, which is a key defense against social engineering and phishing attacks. The message exhibits classic phishing indicators: an unknown sender, a shortened URL (which can mask the true destination), a false sense of urgency, and a request for MFA re-enrollment—a common pretext to harvest credentials or MFA tokens. Reporting through the official security channel ensures the incident is logged and investigated, while verifying with known IT contact information prevents falling for a spoofed or compromised source.

Answer

Open the link and enter the requested information if the page looks legitimate.

Answer

Forward the text to coworkers so they can check whether they received the same message.

Answer

Reply to the text asking for a company badge number before proceeding.

Question 15

An office is replacing WPA2-PSK. The new design must ensure only company-managed laptops can join the wireless network, and any device that falls out of compliance must be blocked or quarantined until remediated. Which two controls best meet the requirement? Select two.

Accepted Answer

Deploy 802.1X with EAP-TLS so devices prove possession of a unique certificate.. 802.1X with EAP-TLS is correct because it requires each device to present a unique client certificate issued by the company's PKI. This ensures only company-managed laptops (which have the certificate) can authenticate, and it ties directly into the requirement for device-specific identity rather than a shared secret.

Answer

Use a single WPA3-Personal passphrase printed in the lobby for all managed devices.

Answer

Rely on MAC address allow lists because they cannot be forged easily.

Answer

Hide the SSID and disable client isolation to reduce discovery by attackers.

Question 16

An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?

Accepted Answer

Encrypting the file so only the intended recipient can decrypt it. Option B is correct because encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.

Answer

Hashing the file before sending it

Answer

Using a checksum printed in the email subject line

Answer

Appending the word confidential to the file name

Question 17

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

Accepted Answer

Role-based access control. Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Answer

Shared local administrator accounts

Answer

Open access for all employees

Answer

Biometric authentication

Question 18

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

Accepted Answer

Risk mitigation. The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transference

Question 19

An online retailer is moving its public web app, internal API, and database into separate zones. Public users must reach only the web tier. The web tier must contact the app tier, and only the app tier may query the database. Admins should manage all servers from a hardened jump host. Which design best meets these goals and minimizes lateral movement?

Accepted Answer

Create separate DMZ, application, and database zones with default-deny east-west rules and use a jump host for administration.. Option B is correct because it implements a multi-tier network architecture with separate DMZ, application, and database zones, enforcing default-deny east-west traffic rules. This ensures that public users can only reach the web tier, the web tier can only communicate with the app tier, and only the app tier can query the database, while all administrative access is funneled through a hardened jump host, which minimizes lateral movement by restricting inter-zone traffic to only what is explicitly required.

Answer

Place all servers in one VLAN and rely on host-based firewalls to block unwanted traffic.

Answer

Put the database in the DMZ so the web tier can connect to it without extra firewall rules.

Answer

Expose the application tier to the Internet and use NAT to hide the database subnet.

Question 20

An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.

Accepted Answer

Isolate the workstation from the network using EDR or NAC containment.. Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.

Answer

Immediately wipe and reimage the workstation before collecting anything else.

Answer

Power the workstation off immediately to stop the malware process.

Answer

Disable every user account in the finance department to prevent further compromise.