SY0-701 Practice Test 8 — 10 Questions

Question 1

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

Accepted Answer

Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.. Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Answer

Require a screen lock after five minutes of inactivity.

Answer

Encrypt only the most sensitive folders with file-level encryption.

Answer

Rely on remote wipe because the device will usually connect to the internet again.

Question 2

To discourage unauthorized entry into a records room, facilities installs a large warning sign, a visible camera over the door, and a turnstile staffed by a guard during business hours. Which control category is the warning sign intended to support most directly?

Accepted Answer

Deterrent. The warning sign is a physical security control designed to discourage unauthorized entry by making potential intruders aware of the risks and consequences. This directly supports the deterrent control category, which aims to reduce the likelihood of a security incident by influencing behavior through fear of detection or punishment. Unlike detective controls that identify incidents after they occur, or preventive controls that physically block access, the sign's primary function is psychological deterrence.

Answer

Detective

Answer

Preventive

Answer

Corrective

Question 3

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

Accepted Answer

ARP spoofing. The correct answer is B, ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Answer

Replay attack

Answer

DNS amplification

Answer

Man-in-the-middle via TLS downgrade

Question 4

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

Accepted Answer

Use selective wipe through a mobile device management platform.. Option B is correct because Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Answer

Perform a full factory reset remotely as soon as any device is reported lost.

Answer

Disable password complexity so the user can regain access more easily after replacement.

Answer

Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

Question 5

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 6

The exhibit shows a weekly risk register for a small enterprise. Which three findings should be remediated first based on likelihood of exploitation and business impact? Select three.

Accepted Answer

Finding 1, because the customer portal is internet-facing and protects a high-value administrative path.. Finding 1 is correct because the customer portal is internet-facing and protects a high-value administrative path. An unpatched or misconfigured portal could allow an attacker to bypass authentication and directly access administrative functions, leading to a full system compromise. The combination of external exposure and high business impact makes this the highest priority for remediation.

Answer

Finding 2, because any default setting should always outrank all other issues automatically.

Answer

Finding 5, because any outdated software should be fixed before higher-impact business systems.

Question 7

Threat intelligence reports a campaign that rotates domains daily and repacks the malware for each delivery. Analysts also observe the same TLS certificate fingerprint, the same mutex name, and the same JA3 client fingerprint across multiple samples. Which three indicators are most useful to prioritize for hunting or blocking? Select three.

Accepted Answer

The TLS certificate fingerprint reused by multiple samples.. The TLS certificate fingerprint is a reliable indicator because it is derived from the certificate's public key and metadata, which remain static even when the malware's domain or IP address changes. Since the threat intelligence report states the same fingerprint is reused across multiple samples, this provides a stable, immutable identifier that can be used to detect or block malicious TLS handshakes regardless of domain rotation.

Answer

The current domain name used by the command-and-control server.

Answer

The public IP address currently hosting the malware sample.

Question 8

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Accepted Answer

Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.. Option A is correct because placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Answer

Give each container a public IP and restrict access by source IP allowlist.

Answer

Bake database passwords into the container image so deployment is simpler.

Answer

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Question 9

A network engineer needs to change an ACL on a production firewall so a new SaaS integration works. The business cannot tolerate an extended outage, and the change must be reversible if testing fails. Which practice best fits?

Accepted Answer

Follow formal change management with approval, testing, and rollback planning. Formal change management ensures the ACL modification is documented, tested in a staging environment, and includes a rollback plan (e.g., reverting to a saved configuration or applying a 'no' command for the specific ACL entry). This minimizes downtime by allowing controlled implementation and immediate reversal if the SaaS integration fails, aligning with the business's zero-tolerance for extended outages.

Answer

Make the change directly during business hours without documentation

Answer

Disable logging temporarily so the firewall change applies faster

Answer

Ask the vendor to modify the firewall remotely without internal review

Question 10

A workstation is suspected of running malware and contacting an unknown host. Which two actions belong in the containment phase? Select two.

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (A) immediately stops the malware's ability to communicate with the command-and-control (C2) server, preventing data exfiltration and further propagation. Blocking the malicious IP or domain at the firewall or proxy (B) is a containment action that prevents any system on the network from reaching the known malicious host, even if other hosts are already compromised. Both actions align with the NIST SP 800-61 containment strategy of stopping the spread and impact of an incident.

Answer

Reimage the workstation immediately before collecting evidence.

Answer

Tell the user to keep working until tomorrow.

Answer

Delete recent logs to reduce noise.