SY0-701 Practice Test 8 — 10 Questions

Question 1

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the server's running processes for unknown executables.. Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Answer

Run a full antivirus scan on the server.

Answer

Block all outbound traffic from the server at the firewall.

Answer

Review the server's event logs for failed login attempts.

Question 2

After a switch reboot in a conference room, several laptops obtain valid IP addresses in the correct subnet, but their default gateway changes to 10.20.40.50, which is not the legitimate router. Packet capture shows DHCP offers coming from a MAC address that does not belong to the approved DHCP server, and the rogue device responds faster than the real server. What attack is most likely occurring?

Accepted Answer

Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.. The scenario describes an unauthorized device responding to DHCP discovery messages faster than the legitimate server, assigning valid IPs but a rogue default gateway (10.20.40.50). This is the classic behavior of a rogue DHCP server, which intercepts DHCP traffic to manipulate client network settings, enabling man-in-the-middle attacks. The packet capture confirming DHCP offers from an unknown MAC address directly identifies the attack as a Rogue DHCP service.

Answer

ARP poisoning, because the attacker is changing IP-to-MAC mappings on the local network.

Answer

Replay attack, because the attacker is reusing old DHCP offers.

Answer

DNS poisoning, because the clients are being sent to the wrong network path.

Question 3

A security analyst notices repeated failed login attempts to a critical database server from a single external IP address over the past hour. The analyst reviews the authentication logs and sees that the account name used in each attempt is 'admin'. Which of the following security controls should the analyst recommend to mitigate this type of attack with minimal impact on legitimate users?

Accepted Answer

Implement a temporary block rule on the perimeter firewall for the source IP address.. Implementing a temporary block rule on the perimeter firewall for the source IP address directly stops the attack at the network boundary, preventing further authentication attempts without affecting legitimate users who are not using that IP. This approach is a form of dynamic IP blocking, which is a common mitigation for brute-force attacks targeting a single account from a specific external source.

Answer

Configure an account lockout policy to lock the 'admin' account after three failed attempts.

Answer

Disable the 'admin' account until the source IP can be investigated.

Answer

Require multi-factor authentication on the 'admin' account for all remote logins.

Question 4

An investigator receives a suspect laptop drive that may be used in court. Which approach best supports a forensically sound image while protecting the original media?

Accepted Answer

Use a hardware write blocker and create a bit-by-bit forensic image with hashes.. Forensic best practice requires preserving the original media in an unaltered state. A hardware write blocker physically prevents any write commands from reaching the drive, ensuring the original evidence is not modified. Creating a bit-by-bit forensic image (e.g., with `dd` or FTK Imager) captures the entire drive, including slack space and unallocated sectors, and generating cryptographic hashes (SHA-256 or MD5) before and after imaging verifies the image's integrity for court admissibility.

Answer

Mount the drive read-write so the investigator can browse it quickly.

Answer

Copy only the user profile folders with a file manager to save time.

Answer

Boot the laptop normally and use backup software to duplicate the disk.

Question 5

A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?

Accepted Answer

Fileless attack, because the malicious activity lives in memory and uses built-in tools.. The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.

Answer

Worm, because the host is making outbound connections to a remote system.

Answer

Spyware, because the host is communicating with an external IP address.

Answer

Rootkit, because the system tools are being hidden from the user.

Question 6

A project team identifies a new risk with a high likelihood of minor data exposure during a pilot rollout. The impact is low, but the issue would become harder to address after production launch. The business owner wants the project to proceed. What should the risk owner do NEXT?

Accepted Answer

Document the risk, assign an owner, and escalate for acceptance or treatment before launch.. The risk owner must follow the formal risk management process: document the risk, assign an owner, and escalate it to the business owner for a decision on acceptance or treatment before the pilot launch. Even though the impact is low, the high likelihood and the fact that the issue becomes harder to address post-production mean the risk cannot be ignored or deferred; it requires a documented acceptance or a mitigation plan before proceeding.

Answer

Ignore the issue because the impact is low.

Answer

Wait until after production launch to see whether the issue actually occurs.

Answer

Transfer the risk by moving the pilot to a different business unit.

Question 7

A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?

Accepted Answer

Disconnect the workstation from the network.. The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.

Answer

Run a full antivirus scan on the workstation.

Answer

Review firewall logs to see if the traffic is being blocked.

Answer

Inform the user to shut down the workstation.

Question 8

A project team must share a spreadsheet containing customer names, account numbers, and purchase history with an external auditor. The auditor only needs account numbers and totals. What is the best privacy control?

Accepted Answer

Redact unneeded personal data and transfer only the minimum necessary information through an approved encrypted channel. It applies the principle of data minimization and secure transmission. Redacting unneeded personal data (customer names) ensures only the minimum necessary information (account numbers and totals) is shared, reducing exposure. Transferring via an approved encrypted channel (e.g., SFTP, HTTPS, or encrypted email) protects data in transit from interception, which is required for compliance with regulations like GDPR or PCI DSS.

Answer

Send the full spreadsheet through regular email to avoid delaying the audit

Answer

Upload the spreadsheet to a public file-sharing site and protect it with a password

Answer

Compress the file with a password and reuse the same password for all auditors

Question 9

A security manager wants every corporate laptop to use the same mandatory settings, including disk encryption, a 10-minute screen lock, and removal of local administrator rights. Which document should define these specific requirements?

Accepted Answer

Standard. A standard defines mandatory, specific technical requirements that must be uniformly applied across all systems, such as enforcing AES-256 disk encryption, a 600-second screen lock timeout, and removal of local administrator rights. Unlike a policy, which is high-level and goal-oriented, a standard provides the precise configuration settings that implement the policy's intent. This aligns with the CompTIA SY0-701 domain of Security Program Management and Oversight, where standards bridge the gap between policy and technical implementation.

Answer

Policy

Answer

Guideline

Answer

Procedure

Question 10

An NDR tool shows a production web server sending small, periodic DNS queries to random-looking subdomains under a domain the company does not use. The pattern repeats every 60 seconds, even when normal web traffic is idle. What is the best interpretation and next step?

Accepted Answer

Suspect DNS-based command-and-control, then isolate the server and collect logs and packet data for analysis.. The small, periodic DNS queries to random-looking subdomains under an unused domain are a classic indicator of DNS-based command-and-control (C2) communication. Attackers often use DNS tunneling to exfiltrate data or send commands, as DNS traffic is typically allowed through firewalls. The fact that the pattern persists even during idle web traffic confirms it is not related to normal server operations, making isolation and forensic collection the appropriate next step.

Answer

This is normal DNS behavior, so no action is needed unless users report an outage.

Answer

Rotate the DNS server’s administrator password and leave the web server online.

Answer

Assume the web server is performing routine certificate renewal checks and ignore the alert.