SY0-701 Mock Exam 71 — 25 Questions

Question 1

Based on the exhibit, which improvement best aligns the current backup design with the stated recovery targets?

Accepted Answer

Switch to frequent incremental or snapshot backups stored in a separate, immutable location with routine restore tests.. Option B is correct because the current backup design lacks off-site, immutable storage and routine restore testing, which are critical to meet recovery point and time objectives (RPO/RTO). Frequent incremental or snapshot backups in a separate, immutable location protect against ransomware and ensure data integrity, while routine restore tests verify that backups are actually recoverable when needed.

Answer

Keep the same design but extend backup retention from 30 days to 90 days.

Answer

Share the backup administrator password in a team chat so any engineer can restore data during an outage.

Answer

Remove backup encryption so restores run faster during an emergency.

Question 2

Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

Accepted Answer

The malware file hash, because it remains consistent across incidents.. Option B is correct because the malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.

Answer

The daily domain names, because they are the easiest indicator to find.

Answer

The color of the phishing email, because visual style is unique to the attacker.

Answer

The user's browser homepage, because attackers often change it after infection.

Question 3

Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.

Accepted Answer

enable DHCP snooping so trusted IP-to-MAC bindings can be validated. Option A is correct because DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.

Answer

change the default gateway IP address on the subnet

Answer

disable spanning tree protocol to reduce switching delays

Answer

replace private addressing with NAT on every endpoint

Question 4

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

Accepted Answer

The percentage of users who report simulated phishing emails to security.. The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Answer

The number of training emails sent to employees each month.

Answer

The number of spam emails blocked by the mail gateway.

Answer

The number of help desk tickets closed within the month.

Question 5

Employees use one corporate login to sign in to email, the ticketing portal, and the HR application. After signing in once, the other apps accept the same identity without separate passwords. What capability is this?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials. In this scenario, the corporate login provides a token (e.g., Kerberos ticket or SAML assertion) that is accepted by the email, ticketing portal, and HR application, eliminating the need for separate passwords. This is the core capability of SSO.

Answer

Federation

Answer

Multi-factor authentication (MFA)

Answer

Session timeout

Question 6

A workstation is suspected of malware infection, and it is still powered on and connected to the network. Which action best preserves volatile evidence before the system is shut down?

Accepted Answer

Capture memory and note running processes before taking further action.. Option B is correct because volatile evidence, such as the contents of RAM (running processes, network connections, open files), is lost when the system is powered off. Capturing a memory dump and recording running processes preserves this critical data for forensic analysis, allowing investigators to identify malware artifacts (e.g., injected code, hidden processes) that exist only in memory. This aligns with the NIST SP 800-86 forensic procedure of prioritizing volatile data collection before system shutdown.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Run a full antivirus scan before documenting anything.

Answer

Delete temporary files to reduce the chance of reinfection.

Question 7

Based on the exhibit, what is the BEST immediate containment action?

The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.

Accepted Answer

Immediately isolate the endpoint from the network using EDR containment or switch quarantine.. Option A is correct because the immediate priority is to stop the active malicious activity (file renaming, system slowdown) by severing the workstation's network connectivity. EDR containment or switch quarantine isolates the endpoint at Layer 2, preventing the attacker from exfiltrating data, communicating with command-and-control servers, or spreading laterally, while preserving volatile memory for forensic analysis. This is faster and more controlled than powering off, which destroys evidence and may trigger destructive payloads.

Answer

Power off the workstation immediately to prevent any further file changes.

Answer

Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.

Answer

Block the destination IP address at the firewall and wait for the user to log off.

Question 8

Security receives a company laptop used in an insider theft investigation. A manager wants the device moved to another office for review by legal staff. Which action best supports chain of custody?

Accepted Answer

Place it in a labeled evidence bag, record the collector, time, location, and condition, and require signatures for each transfer.. Option B is correct because it follows the formal chain of custody process required for evidence handling. Placing the laptop in a labeled evidence bag with documented collector, time, location, and condition, along with requiring signatures for each transfer, ensures the integrity and admissibility of evidence by creating an unbroken audit trail. This aligns with NIST SP 800-86 and forensic best practices for maintaining custody of digital evidence.

Answer

Power on the laptop to confirm the user profile and recent activity before transport.

Answer

Remove the drive and clone it without documenting the collection process.

Answer

Email a photo of the laptop to legal and leave the original on a desk.

Question 9

Based on the exhibit, what is the best data-handling action before sharing the file with the third party?

Accepted Answer

Redact the unnecessary sensitive fields and provide only the minimum necessary extract after approval.. Option B is correct because data minimization and the principle of least privilege require that only the minimum necessary sensitive data be shared with a third party. Redacting unnecessary sensitive fields and obtaining approval ensures compliance with data protection policies and reduces the risk of unauthorized exposure, even if the recipient has signed an NDA.

Answer

Send the full spreadsheet encrypted and let the vendor filter out the extra columns.

Answer

Mark the spreadsheet as internal and share it through the benefits contractor's cloud portal.

Answer

Send the file unchanged because the contractor signed a nondisclosure agreement.

Question 10

Based on the exhibit, which additional control best reduces the risk of tailgating at the entrance while preserving normal employee flow?

Accepted Answer

Install a mantrap or anti-passback turnstile that admits one person per badge authorization.. A mantrap or anti-passback turnstile enforces one-person-per-badge authorization, physically preventing tailgating by only allowing a single individual to pass per valid credential. This preserves normal employee flow because authorized users can enter quickly without manual intervention, unlike guards or awareness campaigns that rely on human compliance.

Answer

Post a security guard at the entrance during business hours.

Answer

Add more CCTV cameras in the lobby and at the parking lot entrance.

Answer

Send quarterly emails reminding employees not to hold doors open.

Question 11

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 12

Based on the exhibit, which attack is most likely being attempted against the application?

Accepted Answer

Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.. The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Answer

Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

Answer

Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

Answer

SQL injection, because the attacker is manipulating a query parameter to expose backend data.

Question 13

Based on the exhibit, what should the security team add before approving the vendor's requested change?

Accepted Answer

A contract clause requiring prior written approval for new subprocessors and flow-down security obligations.. The exhibit shows the vendor requesting a change to use a new subprocessor for data storage. The security team must ensure that the vendor's contract includes a clause requiring prior written approval for new subprocessors and that security obligations flow down to them. This directly addresses the risk of unauthorized data handling by third parties, which is a key concern in vendor risk management.

Answer

A broader employee awareness training requirement for the vendor's staff.

Answer

A larger cyber insurance policy to cover possible losses if the vendor is breached.

Answer

A request for the vendor to send monthly screenshots of its backup jobs.

Question 14

After a phishing simulation, many users still nearly entered credentials on the fake page. Security wants the fastest improvement without scheduling long training sessions. What is the best response?

Accepted Answer

Send a short targeted awareness message with examples, warning signs, and reporting steps.. Option C is correct because a short targeted awareness message directly addresses the observed risky behavior with minimal time investment, providing immediate reinforcement of warning signs and reporting procedures. This approach leverages just-in-time training, which is proven to improve retention and behavior change more effectively than lengthy sessions, aligning with the goal of fastest improvement without disrupting operations.

Answer

Require a full-day classroom course for every employee immediately.

Answer

Ignore the results because no actual breach occurred.

Answer

Reset every employee password as the main way to prevent future clicks.

Question 15

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Spear phishing, because the email is tailored to a specific employee and business context.. Option B is correct because spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Answer

Phishing, because the message is a broad email that tries to trick the recipient.

Answer

Vishing, because the attacker is using a phone call to pressure the victim.

Answer

Baiting, because the attacker is offering a document that the user wants to open.

Question 16

Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.

Accepted Answer

Single sign-on (SSO).. Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.

Answer

Network address translation (NAT).

Answer

Port address translation (PAT).

Answer

A hardened BIOS password on each workstation.

Question 17

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

Accepted Answer

Smishing. This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Answer

Pretexting

Answer

Tailgating

Answer

Spoofing

Question 18

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

Accepted Answer

Disconnect the workstation from the network.. The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Answer

Run a full antivirus scan on the workstation.

Answer

Review firewall logs to see if the traffic is being blocked.

Answer

Inform the user to shut down the workstation.

Question 19

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

Accepted Answer

Nonrepudiation. Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 20

A development team signs branch-router firmware before deployment. The same code-signing private key is stored on two build servers, and a compromise of either server would let an attacker sign malicious updates that look legitimate. Which two changes best reduce the cryptographic risk while preserving the ability to sign trusted releases? Select two.

Accepted Answer

Move the signing private key into a non-exportable hardware security module or managed key service.. Option A is correct because moving the private key into a non-exportable hardware security module (HSM) or managed key service ensures the key material never resides on the build servers in a form that can be extracted. Even if a build server is compromised, the attacker cannot steal the private key to sign malicious firmware. This directly addresses the risk of key exposure from server compromise while preserving the ability to sign trusted releases through secure API calls to the HSM.

Answer

Encrypt the build server disks with full-disk encryption so the private key stays protected.

Answer

Store the private key in a read-only artifact repository so all build agents can access it.

Answer

Replace the signing process with file hashes and checksums to verify release integrity.

SY0-701 Mock Exam 71 — 25 Questions

Exhibit

SY0-701 Mock Exam 71 — 25 Questions

Exhibit