SY0-701 Practice Exam 68 — 20 Questions

Question 1

Based on the exhibit, which control would best reduce unauthorized follow-on entry into the records room?

Accepted Answer

Install a mantrap so only one person can pass through at a time.. A mantrap is a physical security control consisting of a small space with two interlocking doors, designed to allow only one person to pass at a time. This prevents tailgating and piggybacking, which are common methods of unauthorized follow-on entry into a restricted area like a records room.

Answer

Add more network firewall rules around the records room door.

Answer

Increase the screen lock timeout on nearby workstations.

Answer

Replace the UPS batteries to stop unauthorized people from entering.

Question 2

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 3

An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 4

Based on the exhibit, what is the best change to improve accountability without removing emergency access?

Accepted Answer

Require named accounts with role-based elevation through a privileged access workflow.. Option B is correct because implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.

Answer

Keep the shared account and add more logging of the shared password.

Answer

Remove all command logging to protect administrator privacy.

Answer

Use a single shared account with a longer password and monthly rotation.

Question 5

Based on the exhibit, which missing control best improves oversight of the supplier?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause is the missing control that best improves oversight of the supplier because it grants the organization contractual authority to examine the supplier's security controls, processes, and compliance evidence. Without this clause, the organization has no formal mechanism to verify that the supplier is adhering to agreed-upon security requirements, leaving oversight entirely dependent on trust.

Answer

Allow the supplier to choose any encryption algorithm it wants.

Answer

Disable all contract reviews after signature.

Answer

Require the vendor to use employee badges for all facilities.

Question 6

An HR manager wants to share employee data with a benefits analytics vendor. The dataset includes names, employee IDs, home addresses, and medical leave codes. Security wants to reduce privacy exposure while still allowing the vendor to complete the analysis. What is the best first step?

Accepted Answer

Provide only the minimum necessary fields and replace direct identifiers with project IDs. Option B is correct because it implements data minimization, a core privacy principle, by providing only the minimum necessary fields and replacing direct identifiers (names, employee IDs) with project-specific pseudonyms. This reduces exposure of personally identifiable information (PII) while preserving the vendor's ability to perform analytics on the medical leave codes and other non-identifying data. It aligns with the CompTIA SY0-701 objective of applying privacy-enhancing techniques like anonymization and data masking.

Answer

Send the full file as-is if the vendor agrees not to disclose it

Answer

Keep the names but mark the spreadsheet confidential before sending it

Answer

Upload the file to a public cloud folder and restrict the link to the vendor

Question 7

An HR analyst needs to send a payroll reconciliation file to an external auditor. The file contains employee names, SSNs, bank account numbers, and salary details, but the auditor only needs employee IDs, payment totals, and a control total. What should the analyst do first?

Accepted Answer

Redact or remove unnecessary sensitive fields before sharing the minimum required data.. Option B is correct because the principle of data minimization requires that only the necessary data (employee IDs, payment totals, control total) be shared with the external auditor. Redacting or removing unnecessary sensitive fields (SSNs, bank account numbers, salary details) reduces the risk of exposure and complies with privacy regulations. This step should occur before any encryption or transmission to ensure the auditor never receives data they do not need.

Answer

Encrypt the full spreadsheet and send it without changing the contents.

Answer

Compress the file into a password-protected archive and email the password separately.

Answer

Copy the file to a personal cloud storage account to make sharing easier.

Question 8

During morning SIEM review, an analyst sees 37 failed SSH logins followed by a successful login to a Linux server from a jump host. The account belongs to a configuration-management service account, and the activity occurred inside the normal maintenance window. What should the analyst do next to determine whether the alert is a true positive or a false positive?

Accepted Answer

Correlate the event with the approved maintenance ticket and automation job logs.. Option B is correct because the analyst should correlate the failed SSH logins with the approved maintenance ticket and automation job logs to verify if the activity is expected. The failed logins followed by a successful login from a jump host during a maintenance window are consistent with a configuration-management tool (e.g., Ansible, Puppet) retrying authentication. This correlation confirms whether the alert is a true positive (unauthorized access) or a false positive (routine automation).

Answer

Immediately isolate the Linux server from the network and begin recovery.

Answer

Reset the service account password before reviewing any additional evidence.

Answer

Disable SSH on the server until the next patch cycle is complete.

Question 9

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

Accepted Answer

Scan the image and rebuild it from an approved base image.. Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Answer

Run the container as root so startup problems are less likely.

Answer

Open the container port on the host firewall so the image can be reached faster.

Answer

Add more CPU and memory to the cluster to improve image security.

Question 10

A privileged cloud administrator account shows two suspicious events: an API key was created from an unfamiliar IP address, and a mailbox forwarding rule was added five minutes later. The account is still active and may be in attacker control. Which two actions should the analyst take first to preserve evidence while limiting additional abuse? Select two.

Accepted Answer

Export the relevant identity and audit logs before making changes, so the original event trail is preserved.. Option A is correct because exporting identity and audit logs before any changes preserves the original event trail, which is critical for forensic analysis and chain of custody. If logs are altered or rotated after the fact, evidence of the attacker's actions (e.g., API key creation from an unfamiliar IP) could be lost or overwritten, hindering the investigation.

Answer

Delete the mailbox forwarding rule and empty the trash folder, so the attacker cannot read old messages.

Answer

Reimage the admin workstation immediately, because the issue must have started on the endpoint.

Answer

Disable all company email for every user until the account investigation is finished.

Question 11

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

Accepted Answer

Capture a full memory dump of the server. The order of volatility dictates that the most volatile data (memory) must be captured first because it contains critical evidence like running processes, network connections, and encryption keys that will be lost when the system is powered off. A full memory dump preserves this volatile data before any other actions that could alter the system state.

Answer

Shut down the server to prevent further damage

Answer

Create a forensic disk image of the hard drive

Answer

Run a full antivirus scan on the system

Question 12

An external auditor asks for proof that emergency firewall changes were reviewed and approved before implementation last quarter. Which two artifacts are the best evidence? Select two.

Accepted Answer

An approved change ticket that shows the reviewer, approver, and timestamps.. An approved change ticket with reviewer, approver, and timestamps directly documents the required pre-approval workflow for emergency firewall changes. This artifact provides an auditable trail showing that the change was reviewed and approved before implementation, which is the exact evidence the auditor is requesting.

Answer

A screenshot of the firewall's current rule base after the change.

Answer

A technician's memory of getting permission over the phone.

Answer

The organization's general information security policy.

Question 13

A weekly risk review lists several findings. Which two should be addressed first based on likelihood of exploitation and business impact? Select two.

Accepted Answer

An internet-facing VPN appliance with a known exploit and no vendor patch available yet.. Option A is correct because an internet-facing VPN appliance with a known exploit presents a high likelihood of exploitation — attackers actively scan for such vulnerabilities — and the lack of a vendor patch means no immediate mitigation is available, leaving the business exposed to potential data breaches or network compromise. The combination of high exploitability (public-facing, known exploit) and high business impact (VPN access often leads to internal network access) makes this a critical risk that must be addressed first.

Answer

An internal lab system with an outdated browser component, isolated from production and not customer-facing.

Answer

A training virtual machine used offline once per month in a disconnected lab.

Answer

A documentation site with a spelling error in its banner text.

Question 14

A SOC analyst reviews a suspicious email about an overdue invoice. The display name matches a known supplier, but the envelope sender is from a free webmail domain, and the Reply-To address uses a look-alike domain with one swapped letter. The message also includes a company logo and a PDF attachment. Which two findings are the strongest indicators of a phishing attempt? Select two.

Accepted Answer

The display name matches the supplier, but the envelope sender is from a free webmail provider.. Option A is correct because the envelope sender (the actual origin address in the SMTP MAIL FROM command) being from a free webmail domain while the display name matches a known supplier is a classic phishing red flag. Legitimate business invoices are almost never sent from free webmail providers like Gmail or Yahoo, as organizations use their own domains for official correspondence. This mismatch between the visible display name and the actual sender address indicates spoofing.

Answer

The message was transmitted over TLS to the recipient's mail gateway.

Answer

The email contains a PDF invoice attachment with a normal business filename.

Answer

The message includes the supplier's logo and a standard-looking signature block.

Question 15

An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?

Accepted Answer

The alert is likely a false positive because the activity matches approved patch-management behavior. The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.

Answer

The workstation is definitely compromised because PowerShell is always malicious

Answer

The endpoint should be immediately wiped because the script wrote to a log file

Answer

The software distribution server should be blocked from the network permanently

Question 16

Based on the exhibit, which action should the security team prioritize next?

Accepted Answer

Deploy role-based phishing training, recurring simulations, and a simple reporting workflow.. Option D is correct because the exhibit (not shown here, but implied by the question) likely shows that a phishing simulation has been completed and that the organization needs to move from a one-size-fits-all awareness approach to a sustainable, role-based security training program. Deploying role-based phishing training, recurring simulations, and a simple reporting workflow addresses the root cause of user susceptibility by tailoring content to specific job functions, reinforcing learning through repetition, and enabling users to report suspicious emails easily, which aligns with NIST SP 800-50 and the continuous improvement cycle of security awareness programs.

Answer

Send a company-wide reminder to never click links in email, regardless of sender.

Answer

Focus only on punitive action for users who failed the simulation.

Answer

Run the same broad awareness module again for all employees at the same time.

Question 17

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration?

Exhibit:
Device group: Sales-Laptops
Baseline check:
- Approved browser: installed
- Approved EDR: installed
- Unapproved remote admin tool: detected on 14 endpoints
- Local administrator rights: granted to all users in group
- Patch compliance: 68%

Management wants to prevent unauthorized software from running and keep future builds consistent.

Accepted Answer

Deploy application allowlisting through centralized endpoint management and remove local administrator rights.. Option A is correct because application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Answer

Keep users as local admins but require stronger email passwords for better overall security.

Answer

Disable the EDR agent during software installs to avoid false alerts from approved apps.

Answer

Store approved installers on a shared drive and let users choose what to install.

Question 18

A records manager finds a folder of payroll reports on a shared drive. The business says the reports are no longer active, but legal retention rules require keeping them for another two years. What is the best action?

Accepted Answer

Move the reports to an approved archive and retain them for the required period. Option B is correct because the reports are subject to a legal retention policy requiring two more years of storage. Moving them to an approved archive ensures they remain accessible for compliance purposes while removing them from the active shared drive, which reduces the risk of accidental modification or deletion. This aligns with data lifecycle management and legal hold procedures.

Answer

Delete the reports immediately because the business no longer uses them

Answer

Email the reports to each manager so they can keep their own copy

Answer

Rename the folder so users do not notice it on the shared drive

Question 19

A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?

Accepted Answer

Quarantine the workstation from the network using EDR or switch port containment. Option B is correct because quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.

Answer

Power the workstation off immediately and leave it in place

Answer

Run a full antivirus scan while the workstation remains connected

Answer

Wipe and reimage the workstation from a standard build image

Question 20

A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?

Accepted Answer

Move the server to a restricted network segment and allow SMB access only from required hosts.. Option A is correct because network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.

Answer

Turn off endpoint logging to reduce performance impact until the vendor releases a patch.

Answer

Increase the password length requirement for all users and keep the server on the same network.

Answer

Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.