SY0-701 Practice Test 8 — 10 Questions

Question 1

A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the workstation from the network. The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.

Answer

Run a full antivirus scan on the workstation

Answer

Notify the user that their workstation may be compromised

Answer

Check the firewall logs to confirm the destination IP

Question 2

EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?

Accepted Answer

Isolate the endpoint from the network while keeping it powered on.. Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.

Answer

Delete the suspicious PowerShell process from the console and close the alert.

Answer

Reimage the workstation immediately to return it to a clean state.

Answer

Power the workstation off and disconnect the SSD to preserve data.

Question 3

Based on the exhibit, which awareness action should the security manager prioritize next?

Accepted Answer

Launch role-based phishing training and reporting reinforcement for the highest-risk groups.. The exhibit shows that the highest-risk groups (e.g., finance, executives) have the highest phishing click rates. Option B is correct because role-based phishing training targets these specific users with simulated phishing campaigns and reporting reinforcement, which directly reduces the likelihood of successful social engineering attacks. This aligns with the principle of prioritizing remediation based on risk assessment data rather than blanket training.

Answer

Send the same annual awareness slide deck to everyone again without changing the content.

Answer

Block all external email so users cannot click suspicious messages.

Answer

Take no action because IT already reports suspicious messages well.

Question 4

A security analyst receives reports that several employees are being redirected to a fraudulent login page after typing the correct URL for a company application into their browser. Further investigation reveals that the company's internal DNS server has been compromised. Which type of attack best describes this scenario?

Accepted Answer

Pharming. Pharming is correct because the attack redirects users from a legitimate website to a fraudulent one without their knowledge or interaction, typically by compromising the DNS resolution process. In this scenario, the internal DNS server has been compromised, so when employees type the correct URL, the DNS server returns the IP address of a fake login page instead of the real one. This is a classic example of DNS poisoning, a form of pharming.

Answer

Phishing

Answer

Spear phishing

Answer

Vishing

Question 5

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

Accepted Answer

Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.. The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Answer

Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

Answer

Disable SSID broadcast for the guest network to make it less discoverable.

Answer

Require guests to accept a captive portal agreement before gaining internet access.

Question 6

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Accepted Answer

Build and deploy a secure baseline or gold image for the laptops.. A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Answer

Allow each user to customize local security settings for productivity.

Answer

Skip validation after patching because the baseline will always remain correct.

Question 7

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time

Question 8

Based on the exhibit, users report that the new payment portal opens only after they bypass a browser warning. Which remediation best restores secure access without weakening certificate validation?

Accepted Answer

Reissue the server certificate so the subject or SAN matches pay.example.net and chain it to the trusted CA.. The browser warning indicates a hostname mismatch or untrusted CA. Reissuing the server certificate with the correct subject or SAN (Subject Alternative Name) matching pay.example.net and chaining it to a trusted CA resolves the warning while maintaining full certificate validation. This ensures the browser can verify both the identity and trustworthiness of the server without weakening security.

Answer

Install the same certificate on every client so the browser warning is suppressed.

Answer

Disable certificate name checking in the browser until the certificate expires.

Answer

Replace TLS with a shared symmetric key configured on the web server and all users.

Question 9

A security analyst receives an alert about a user account attempting to access multiple network shares in rapid succession within a short time frame. The analyst reviews the logs and sees that the IP address originates from the internal network, but the user is currently on leave. Which type of attack is most likely occurring?

Accepted Answer

Internal reconnaissance. The behavior—an internal IP address rapidly querying multiple network shares—is characteristic of internal reconnaissance, where an attacker who has already gained a foothold maps out available resources. The user being on leave indicates the account is compromised, and the rapid succession of share access attempts is a classic sign of automated enumeration (e.g., using `net view` or SMB queries) rather than a direct credential attack.

Answer

Pass-the-hash attack

Answer

Brute-force attack

Answer

Credential stuffing attack

Question 10

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

Accepted Answer

Check the server's running processes for unknown executables.. Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Answer

Run a full antivirus scan on the server.

Answer

Block all outbound traffic from the server at the firewall.

Answer

Review the server's event logs for failed login attempts.