SY0-701 Practice Exam 70 — 20 Questions

Question 1

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. Option A is correct because the request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 2

A vendor says a patch for a critical flaw in a public-facing application will not be available for 30 days, but the service must stay online. What is the best short-term risk treatment?

Accepted Answer

Implement compensating controls, such as tighter filtering and temporary restrictions, until the patch is released.. Option D is correct because when a critical patch is unavailable, the best short-term risk treatment is to implement compensating controls that reduce the likelihood or impact of exploitation. For a public-facing application, this could include deploying a web application firewall (WAF) with tighter rule sets, rate limiting, IP allowlisting, or temporarily disabling non-essential functionality. These controls provide a defense-in-depth layer until the vendor releases the patch, keeping the service online while reducing risk.

Answer

Accept the risk without making any changes because the patch is not available yet.

Answer

Avoid the risk by permanently shutting down the application.

Answer

Transfer the risk to an insurance policy and wait for the patch.

Question 3

After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?

Accepted Answer

The percentage of users who report suspicious messages before clicking links.. Option B is correct because the percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.

Answer

The total number of phishing simulation emails sent to employees.

Answer

The number of new usernames created in the email system.

Answer

The average screen resolution used by employees during the campaign.

Question 4

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

Accepted Answer

Move the console to a separate management network and restrict access to admin hosts only.. The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Answer

Increase the number of shared passwords so administrators can log in faster.

Answer

Leave the console exposed but shorten the password expiration period.

Answer

Disable logging so failed attempts do not generate noise.

Question 5

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

Accepted Answer

Risk tolerance, because it sets a specific measurable threshold for acceptable impact.. Option B is correct because risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Answer

Risk appetite, because it describes the organization’s overall willingness to take risk.

Answer

Risk transfer, because the business is moving the outage risk to another party.

Answer

Risk avoidance, because the organization is eliminating the portal risk completely.

Question 6

A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address during off-hours. The analyst reviews the firewall logs and confirms the connection was established. Which of the following should the analyst perform NEXT to contain the threat?

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (Option B) is the immediate containment step because it stops the active communication with the known malicious IP address, preventing further data exfiltration, lateral movement, or command-and-control (C2) activity. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the threat before investigation or remediation. Disabling the user account (A) does not stop the network-level communication if the malware is running as a service or using cached credentials, and running a scan (C) or notifying management (D) are post-containment actions.

Answer

Disable the user's account immediately.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify the user's manager of the policy violation.

Question 7

Based on the exhibit, what is the best governance action before the sales team uses the legacy portal without MFA?

Accepted Answer

Create a formal time-bound exception with compensating controls, approval, and an expiration date.. Option B is correct because governance requires that any exception to a security policy (such as bypassing MFA) must be formally documented, approved by management, time-bound, and include compensating controls to mitigate risk. In this scenario, the legacy portal lacks MFA support, so a formal exception with an expiration date ensures the risk is tracked and re-evaluated, rather than permanently weakening security posture.

Answer

Update the policy immediately to allow password-only access for all legacy systems.

Answer

Have the help desk approve the request informally in the ticket and proceed without further documentation.

Answer

Ignore the MFA requirement because the portal is owned by a trusted partner.

Question 8

A company laptop is collected as evidence in a suspected theft case. Which action best supports chain of custody?

Accepted Answer

Record each transfer with date, time, handler name, and signatures.. Option B is correct because chain of custody requires documenting every transfer of evidence with date, time, handler name, and signatures to maintain a verifiable record of who had possession of the laptop at all times. This ensures the evidence is admissible in court by proving it has not been tampered with or altered since collection. Without this documentation, the defense could argue the evidence was compromised, undermining the entire case.

Answer

Place the laptop on a desk until the investigator is available.

Answer

Reset the laptop so the legal team can access it more easily.

Answer

Remove the hard drive and connect it to a personal workstation.

Question 9

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Accepted Answer

Deploy multiple application servers behind a load balancer across separate availability zones.. Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Answer

Use a single high-end server with RAID 10 and a larger power supply.

Answer

Keep only nightly backups and restore manually after an outage.

Answer

Store the database on a local disk array attached to the primary server.

Question 10

A hybrid cloud portal first checks device health at the identity provider, then requires MFA, then enforces a per-application authorization decision before each sensitive action. Network access is also limited by a gateway, and a WAF sits in front of the app. Which two principles are best demonstrated? Select two.

Accepted Answer

Zero trust, because access is continuously verified instead of assumed after one login.. Option A is correct because the scenario describes continuous verification of device health, MFA, and per-application authorization before each sensitive action, which aligns with the Zero Trust principle of 'never trust, always verify.' Unlike traditional perimeter-based security, Zero Trust assumes no implicit trust after initial authentication and requires ongoing validation at every access attempt.

Answer

Least privilege, because users are granted no access at all until the app is offline.

Answer

Separation of duties, because administrators and users must approve each other's actions.

Answer

Need-to-know, because the system hides all information until the user requests it.

Question 11

A platform team runs production, staging, and developer containers on the same Kubernetes cluster. After a staging compromise, the team wants to reduce the chance of access to production secrets or lateral movement to other namespaces. Which two architecture changes are most effective? Select two.

Accepted Answer

Move production workloads into a separate cluster or dedicated node pool with stricter tenancy boundaries.. Option A is correct because moving production workloads to a separate cluster or dedicated node pool enforces stronger tenancy boundaries, preventing a compromise in staging from directly accessing production secrets or pods. Kubernetes namespaces alone do not provide strong isolation, as a single cluster shares the same control plane and node resources, making lateral movement possible. This architectural change reduces the attack surface by physically or logically separating production from staging and development environments.

Answer

Run all namespaces on the same privileged worker nodes so scaling is easier.

Answer

Store secrets as plain environment variables because container images are already isolated.

Answer

Grant every service account cluster-admin so deployments fail less often.

Question 12

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

Accepted Answer

Whaling. This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Answer

Spear phishing

Answer

Vishing

Answer

Pharming

Question 13

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Accepted Answer

Place the web server in a DMZ that is reachable from the internet.. Option A is correct because placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Answer

Put the database on the same subnet as the web server for faster communication.

Answer

Allow every tier to communicate freely to simplify troubleshooting.

Answer

Use one flat VLAN for all three servers and rely on strong passwords.

Question 14

A threat report says an attacker changes domains daily and rehosts infrastructure in cloud VPS environments, but the phishing email wording, login-page flow, and PowerShell download behavior remain the same. What type of information is most useful for a durable detection rule?

Accepted Answer

The attacker’s behavioral pattern and technique sequence. Option B is correct because the attacker's behavioral pattern and technique sequence remain consistent even as infrastructure changes. A durable detection rule should focus on the invariant TTPs (Tactics, Techniques, and Procedures) such as the phishing email wording, login-page flow, and PowerShell download behavior, which are stable indicators of compromise (IOCs) that persist across domain and IP changes. This aligns with the MITRE ATT&CK framework's emphasis on detecting adversary behaviors rather than ephemeral artifacts like hashes or IP addresses.

Answer

Only the current malware hash from the latest sample

Answer

The names of the victim company’s departments

Answer

A screenshot of the phishing email subject line only

Question 15

Based on the exhibit, what should the security team recommend before sharing the report?

Accepted Answer

Remove unnecessary personal fields and share only the minimum data needed for the analysis.. Option B is correct because the principle of data minimization requires that only the minimum necessary data be shared to fulfill the analysis purpose. Removing unnecessary personal fields reduces the risk of exposing PII and aligns with privacy regulations such as GDPR and HIPAA, even when a nondisclosure agreement (NDA) is in place.

Answer

Share the report exactly as requested, because the vendor signed a nondisclosure agreement.

Answer

Keep all fields and encrypt the file before sending it to the vendor.

Answer

Store the report in a shared folder so the vendor can access it later if needed.

Question 16

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

Accepted Answer

Sandboxing, because it detonates the file and observes malicious behavior safely.. Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Answer

DLP, because it prevents any document from leaving the organization.

Answer

NAC, because it can block the supplier's laptop from the network.

Answer

A SIEM, because it can block the attachment and quarantine the message.

Question 17

Based on the exhibit, what vulnerability is the application most likely suffering from?

Accepted Answer

Stored cross-site scripting, because attacker-controlled script is saved and later rendered to other users.. The application stores user-supplied input in a review field and later renders it to other users without proper sanitization. The exhibit shows a script tag attempting to exfiltrate cookies to a remote host, which is a classic stored cross-site scripting (XSS) payload. Because the malicious script is persisted on the server and executed in the browsers of subsequent visitors, the vulnerability is stored XSS.

Answer

Command injection, because the script attempts to send cookies to a remote host.

Answer

Session fixation, because users saw the same review page after posting.

Answer

Insecure deserialization, because the payload is embedded in a review field.

Question 18

Based on the exhibit, which change best reduces the risk of lateral movement if a user workstation is compromised?

Accepted Answer

Require administrative access through a hardened bastion host and restrict direct management from user devices.. Requiring administrative access through a hardened bastion host enforces a jump-box architecture, which eliminates direct RDP, SSH, or WinRM from user workstations to servers. This segmentation prevents an attacker who compromises a user workstation from using stolen credentials or tools to laterally move to sensitive servers, as all management traffic must pass through a controlled, monitored, and often multi-factor-authenticated bastion host.

Answer

Add more workstations to VLAN 10 so authentication requests are faster.

Answer

Disable logging on the servers so attackers leave fewer traces if they connect.

Answer

Move all servers into the same VLAN as the workstations for easier access control.

Question 19

Based on the exhibit, which control would most effectively reduce the remaining successful attacks?

Phishing awareness results:
Team A: click rate 8%, report rate 6%, median report time 52 min
Team B: click rate 7%, report rate 18%, median report time 14 min
Team C: click rate 12%, report rate 21%, median report time 10 min

Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

Accepted Answer

Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.. Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Answer

Continue generic awareness posters without changing technical controls.

Answer

Disable MFA on mobile devices so users can log in faster.

Answer

Allow employees to approve prompts from any device to reduce help desk calls.

Question 20

Based on the exhibit, which hardening change best prevents a laptop from booting unapproved tools from external media?

Exhibit:
UEFI Setup
- Secure Boot: Disabled
- Boot order: USB, External NIC, Internal SSD
- Firmware admin password: Not configured
- BitLocker status: Enabled

Incident note:
A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.

Accepted Answer

Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.. Enabling Secure Boot ensures that only signed, trusted firmware and bootloaders can execute, preventing unauthorized tools like USB recovery sticks from loading. Changing the boot order to prioritize the internal SSD over USB media stops the system from even attempting to boot from external devices, directly addressing the incident where the laptop bypassed corporate login via a USB stick.

Answer

Extend the Windows login timeout so users have more time to notice suspicious activity.

Answer

Turn off BitLocker so recovery tools can boot without errors.

Answer

Install a host firewall rule to block USB storage devices from the network.