SY0-701 Practice Test 9 — 10 Questions

Question 1

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

Accepted Answer

Use phishing-resistant MFA with number matching or hardware security keys. Option B is correct because phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Answer

Increase password complexity requirements

Answer

Shorten the screen-lock timeout on user devices

Answer

Allow users to approve any MFA prompt sent during business hours

Question 2

A security analyst is reviewing the organization’s security awareness program. Which three of the following are key metrics that demonstrate the effectiveness of the program? (Choose three.)

Accepted Answer

Percentage of employees who complete annual security training. The percentage of employees who complete annual security training is a key metric because it measures participation in the foundational awareness activity. The number of phishing simulation clicks before and after training directly quantifies behavioral change, showing whether training reduces susceptibility to social engineering. The total count of security incidents reported by employees indicates whether the program has successfully fostered a culture of reporting, which is critical for early threat detection.

Answer

Average time to patch critical vulnerabilities in production systems

Answer

Number of firewall rule changes approved per quarter

Answer

Percentage of servers with full disk encryption enabled

Question 3

An organization is migrating its on-premises infrastructure to a hybrid cloud model. Which three of the following considerations are most important for maintaining a secure security architecture? (Choose three.)

Accepted Answer

Establishing a clear shared responsibility model for security between the organization and the cloud provider.. Ensuring consistent identity and access management (IAM) across on-premises and cloud environments is critical because it prevents privilege escalation and unauthorized access. In a hybrid cloud, a unified IAM system (e.g., using Active Directory Federation Services or Azure AD Connect) enforces the same policies, roles, and multi-factor authentication for all resources, eliminating blind spots. Without this, attackers could exploit inconsistent permissions to move laterally between environments.

Answer

Storing encryption keys for cloud data in the same cloud tenant for convenience.

Answer

Disabling all logging in the cloud to reduce storage costs.

Answer

Using a shared secret for all cloud API calls to simplify authentication.

Question 4

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Accepted Answer

Remove local administrator rights from standard user accounts.. Option A is correct because removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Answer

Turn off logging to preserve disk space.

Answer

Allow unrestricted browser extension installs.

Answer

Merge all developer and production systems into one VLAN.

Question 5

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

Accepted Answer

Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.. Option B is correct because segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Answer

Move all devices into one larger subnet and rely on endpoint antivirus for separation.

Answer

Place all devices behind a single proxy server and block all internal east-west traffic.

Answer

Enable port security on the switch and disable all VLAN tagging to reduce complexity.

Question 6

A branch office reports intermittent failures reaching internal sites. DHCP logs show clients receiving leases from an unknown MAC address, and DNS responses for intranet.example resolve to an address owned by the same device. Which two attacks best match the evidence? Select two.

Accepted Answer

A rogue DHCP server is issuing unauthorized lease information.. A rogue DHCP server on the network can issue unauthorized lease information, causing clients to receive IP configurations from an unknown MAC address. This matches the DHCP log evidence and can lead to intermittent connectivity issues as clients receive conflicting or incorrect network settings.

Answer

A SYN flood is exhausting the DHCP service.

Answer

A port scan is enumerating exposed services on the branch subnet.

Answer

Password spraying is attempting many logins with common passwords.

Question 7

A business unit wants to keep using a customer portal even though a low-likelihood, high-impact dependency risk was identified. Leadership does not want to stop the service, but it does want to lower exposure and formally document the remaining risk. Which two actions best fit that approach? Select two.

Accepted Answer

Implement compensating controls to reduce the chance or impact of the event.. Option A is correct because implementing compensating controls is a standard risk mitigation strategy that reduces the likelihood or impact of a dependency risk without stopping the service. For a customer portal, this could include adding web application firewall (WAF) rules, rate limiting, or failover mechanisms to lower exposure while keeping the portal operational.

Answer

Immediately shut down the portal until the dependency risk is completely eliminated.

Answer

Ignore the finding until the next annual audit cycle.

Answer

Transfer the issue to the help desk by opening a routine support ticket.

Question 8

A cloud-hosted invoicing app has a critical vulnerability, but the vendor says a patch will not be available for six weeks. The team adds a web application firewall rule, restricts access to the app subnet, and increases monitoring until the patch arrives. What is this best described as?

Accepted Answer

Compensating control, because temporary safeguards reduce exposure until the patch is available.. Option C is correct because the team deployed temporary security measures—a web application firewall (WAF) rule, subnet access restrictions, and enhanced monitoring—to reduce the risk exposure while waiting for the vendor's patch. These are compensating controls, which are alternative safeguards that mitigate a vulnerability when the primary control (the patch) cannot be implemented immediately. The scenario explicitly states the patch is six weeks away, making these interim measures a textbook compensating control.

Answer

Risk avoidance, because the system is being shut down permanently.

Answer

Risk transfer, because the vendor is responsible for the vulnerability.

Answer

Residual risk acceptance, because the vulnerability is being ignored until next quarter.

Question 9

A critical patch must be applied to a retail point-of-sale server. What is the best way to reduce business disruption?

Accepted Answer

Schedule the patch during an approved maintenance window.. Scheduling the patch during an approved maintenance window is the best practice to minimize business disruption because it allows the organization to plan for downtime during low-activity periods, coordinate with stakeholders, and ensure rollback procedures are in place. For a retail point-of-sale (POS) server, applying a critical patch outside of business hours prevents transaction interruptions and potential revenue loss, aligning with change management policies that prioritize availability and security.

Answer

Apply the patch during the busiest business hours to make the change sooner.

Answer

Skip the patch and rely on hope that the issue will not be exploited.

Answer

Turn off all backups so the patch process runs faster.

Question 10

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

Accepted Answer

Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.. Option B is correct because encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Answer

Store all backups on a shared file server so administrators can restore them quickly.

Answer

Keep only the most recent snapshot to reduce storage cost and simplify recovery.

Answer

Rely on RAID mirroring because it automatically creates a secure archival copy.