SY0-701 General Security Concepts — 50 Questions

Question 1

A company wants one document that tells employees what they are required to do when handling company systems and data. Which document type is the best fit?

Accepted Answer

Policy, because it states the required rules and expectations for everyone.. A policy is the correct document type because it defines mandatory rules and expectations for all employees regarding the handling of company systems and data. Policies are the highest-level directives that set required behavior, while procedures provide step-by-step instructions, standards are detailed mandatory requirements, and guidelines offer optional recommendations. Therefore, a policy is the best fit for a single document that tells employees what they must do.

Answer

Procedure, because it always defines the highest-level mandatory rules.

Answer

Guideline, because it provides optional suggestions for best behavior.

Answer

Standard, because it contains only optional advice about security.

Question 2

Which two practices help protect encryption keys? Select two.

Accepted Answer

Store keys in a hardware security module. A hardware security module (HSM) is a dedicated, tamper-resistant hardware device designed to securely generate, store, and manage cryptographic keys. By keeping keys inside the HSM, they never exist in plaintext in system memory or on disk, and operations like signing or decryption occur within the HSM's secure boundary, preventing extraction even if the host is compromised. Additionally, rotating keys on a defined schedule limits the amount of data exposed if a key is compromised, reducing the impact of a potential breach and ensuring that long-term compromise is less likely. Both practices are essential for protecting encryption keys.

Answer

Put keys in an unencrypted text file on a server

Answer

Reuse the same key across many systems forever

Answer

Send keys through a public chat room

Question 3

A development team signs branch-router firmware before deployment. The same code-signing private key is stored on two build servers, and a compromise of either server would let an attacker sign malicious updates that look legitimate. Which two changes best reduce the cryptographic risk while preserving the ability to sign trusted releases? Select two.

Accepted Answer

Move the signing private key into a non-exportable hardware security module or managed key service.. Moving the private key into a non-exportable HSM or managed key service ensures the key material never resides on the build servers in a form that can be extracted. Even if a build server is compromised, the attacker cannot steal the private key to sign malicious firmware. This directly addresses the risk of key exposure from server compromise while preserving the ability to sign trusted releases through secure API calls to the HSM. Additionally, using separate signing keys for each product line or release environment limits the blast radius: a compromise of one key does not allow an attacker to sign malicious updates for all products, only the affected product line. This also preserves the ability to sign trusted releases because each product can continue to sign with its own dedicated key.

Answer

Encrypt the build server disks with full-disk encryption so the private key stays protected.

Answer

Store the private key in a read-only artifact repository so all build agents can access it.

Answer

Replace the signing process with file hashes and checksums to verify release integrity.

Question 4

Which two are common warning signs of phishing messages? Select two.

Accepted Answer

Urgent threat that the account will be locked in 15 minutes. Phishing messages often create a false sense of urgency, such as claiming an account will be locked in 15 minutes, to pressure the recipient into acting without verifying the source. Additionally, unexpected attachments from unknown senders are a common warning sign because they may contain malware or trick the recipient into revealing credentials. Both tactics exploit human tendencies—urgency and curiosity—bypassing rational checks like inspecting the sender's address or hovering over links.

Answer

Message sent from a trusted internal help desk portal

Answer

Correct spelling and matching domain name

Answer

Email signed with a known employee's regular signature block

Question 5

Which two are detective controls? Select two.

Accepted Answer

Security camera monitoring an entrance. Security cameras and SIEM log review are both detective controls. A security camera is detective because it records events for after-the-fact review, while log review in a SIEM is detective because it identifies suspicious activity by analyzing collected logs after events occur, rather than preventing them. Neither control prevents an incident but both detect and document it.

Answer

Locked server rack

Answer

Employee security awareness training

Answer

Disk encryption on a laptop

Question 6

A company wants controls that rely on people and documented direction rather than technology. Which two are administrative controls? Select two.

Accepted Answer

Security awareness training program. Security awareness training program (A) is an administrative control because it relies on people following documented procedures and policies rather than technology. It educates employees on security risks and expected behaviors, such as recognizing phishing attempts, which is a directive-based measure without hardware or software enforcement. Password policy requiring minimum length (C) is also an administrative control because it is a documented policy that directs user behavior, even if enforcement may be technical; the control itself is administrative as it relies on human compliance with the policy. Options B, D, and E are physical or technical controls.

Answer

Badge reader at the server room door

Answer

Host-based firewall on laptops

Answer

Encryption of data on the hard drive

Question 7

Which two uses are appropriate for encryption in transit? Select two.

Accepted Answer

Protecting web login traffic with TLS. TLS (Transport Layer Security) encrypts web login traffic between a client and server, protecting credentials and session data from eavesdropping or tampering during transmission. This is a classic use of encryption in transit, as TLS operates at the transport layer to secure data moving across a network. Similarly, SSH (Secure Shell) encrypts remote administration sessions, protecting commands, credentials, and data transmitted between an administrator and a remote system. Both TLS and SSH are protocols that provide encryption in transit, unlike hashing for password storage (at rest) or checksums for integrity (not encryption).

Answer

Storing a password as a hash

Answer

Comparing file integrity with a checksum

Answer

Sharing a symmetric key by email

Question 8

A legacy payroll server has a critical patch available, but the business cannot reboot it for 45 days. The team isolates the server to only the payroll application subnet and requires written approval before any temporary firewall exception is made. Which two control types are present? Select two.

Accepted Answer

Compensating control, because the temporary network restriction offsets the delayed patch.. Isolating the server to the payroll subnet is a compensating control that reduces risk by restricting network access, offsetting the inability to apply the critical patch immediately. This temporary measure provides an alternative security layer until the patch can be installed and the server rebooted. Requiring written approval before any temporary firewall exception is made is a directive control, as it documents a policy or procedure that guides administrators' actions and enforces a specific approval process before changes are allowed.

Answer

Detective control, because a rule set later identifies malicious traffic.

Answer

Corrective control, because the control repairs the vulnerable software itself.

Answer

Deterrent control, because a warning banner discourages misuse of the server.

Question 9

A company is proposing a new access model for its finance application. Under this model, access requests are evaluated in real time based on device posture, user identity, and risk signals, even when users are connected via VPN. Which security principle is the proposed access model most aligned with?

Accepted Answer

Zero trust, because access is continuously evaluated instead of trusted just because the device is on the VPN.. The proposed access model aligns with Zero Trust because it continuously evaluates access based on real-time conditions (e.g., device posture, user identity) rather than implicitly trusting the VPN connection. In Zero Trust, network location alone is insufficient for granting access; every request is authenticated and authorized regardless of the source. This contrasts with traditional perimeter-based models where VPN access implies trust.

Answer

Least privilege, because users are being limited to only the finance application they need.

Answer

Defense in depth, because the company is adding multiple security layers around the finance app.

Answer

Need-to-know, because users should only see the finance data required for their jobs.

Question 10

A cloud backup service uses envelope encryption. The key-encryption key is nearing the end of its approved lifetime, but the business cannot decrypt and re-encrypt every backup object this week. Which two statements best describe the correct rotation approach? Select two.

Accepted Answer

Generate a new key-encryption key and use it for future backups.. Envelope encryption decouples data-encryption keys (DEKs) from the key-encryption key (KEK). When rotating a KEK, generate a new KEK and use it for all future backups (option A). For existing backup objects, rewrap each existing DEK with the new KEK—decrypt the DEK using the old KEK and re-encrypt it with the new KEK—without touching the underlying data (option B). This avoids decrypting and re-encrypting every backup object. The old KEK should be destroyed only after rewrapping is complete, and hashing algorithms are unrelated to key rotation.

Answer

Decrypt and re-encrypt every backup object immediately with a new data key.

Answer

Destroy the old key before the rewrapping process finishes.

Answer

Replace the hashing algorithm used for file integrity checks.

Question 11

A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.

Accepted Answer

Least privilege, because the contractor receives only the access needed for one investigation.. Least privilege is applied because the contractor's access is strictly limited to what is necessary for the single investigation: read-only access to one log source via a jump host, with the account expiring automatically at shift end. Need-to-know is applied because the contractor is granted access only to the log source required for the job and cannot see user payroll records, so the contractor sees only the data necessary to complete the investigation.

Answer

Separation of duties, because one person cannot both request and approve the access.

Answer

Defense in depth, because multiple layers of security tools are deployed around the server.

Answer

Zero trust, because every request is automatically denied until proven safe.

Question 12

A company stores application passwords in a database that could be stolen during a breach. The team wants to prevent attackers from using precomputed tables and also make identical passwords produce different stored values. Which two changes should be implemented? Select two.

Accepted Answer

Use a unique random salt for every password before hashing.. A unique random salt ensures that even if two users have the same password, their stored hashes differ because the salt is combined with the password before hashing. This prevents attackers from using precomputed rainbow tables, as each salt forces a separate table to be generated. Additionally, using a slow one-way hash such as Argon2, bcrypt, or scrypt increases the computational cost of each guess, making brute-force and precomputed attacks impractical. These algorithms also incorporate a random salt, so they ensure unique stored values even for identical passwords. Together, salting and slow hashing provide strong, industry-standard password protection.

Answer

Encrypt each password with a single symmetric key and store the key in the database.

Answer

Add a digital signature to each stored password so users can verify it.

Answer

Hash all passwords with the same unsalted SHA-256 value.

Question 13

Before installing a vendor patch package on hundreds of endpoints, the security team wants to confirm the file was published by the vendor and was not altered during download. Which two verification steps should the team perform? Select two.

Accepted Answer

Verify the package signature with the vendor's public key.. Verifying the package signature with the vendor's public key confirms the package was cryptographically signed by the vendor, proving its authenticity and integrity. This process uses asymmetric cryptography where the vendor signs the package with their private key, and the security team uses the corresponding public key to validate that signature. Additionally, comparing the downloaded package hash to the hash provided in the signed manifest ensures that the file content exactly matches what the vendor published, detecting any alteration during download. These two steps together provide strong assurance that the package is genuine and unchanged.

Answer

Decrypt the package with the vendor's private key before installation.

Answer

Rotate the organization's internal encryption key before downloading.

Answer

Check only the file timestamp and size on disk.

Question 14

Match each scenario from a security design review to the principle it best demonstrates.

Accepted Answer

Implementing full disk encryption on laptops: Defense in depth. The correct matches are: full disk encryption demonstrates defense in depth (multiple layers of protection); network segmentation demonstrates separation of duties (dividing responsibilities); and deploying both IDS and firewall demonstrates layered security (overlapping controls). Multi-factor authentication is actually a form of defense in depth or layered security, not accountability; comprehensive logging and monitoring is the key to accountability, not least privilege; and disabling unnecessary services is a classic example of least privilege.

Answer

Requiring multi-factor authentication for system administration: Accountability

Answer

Enabling comprehensive logging and monitoring: Least privilege

Answer

Disabling unnecessary services and ports: Least privilege

Question 15

A contractor is assigned to a single merger project. The manager approves access to only the project share and the project chat space, even though the contractor technically could use other collaboration tools. Which principle is most directly reflected?

Accepted Answer

Least privilege. Least privilege is the principle of granting users only the access rights and permissions necessary to perform their job functions. The contractor is given access only to the project share and project chat space, while being denied access to other collaboration tools they technically could use. This directly reflects least privilege, as the manager is limiting the contractor's system and resource access to the minimum required for the merger project.

Answer

Need-to-know

Answer

Integrity

Answer

Zero trust

Question 16

A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.

Accepted Answer

Enforce certificate pinning in the application for the expected server certificate.. Certificate pinning (A) hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings. Additionally, endpoint policy that prevents local administrators from modifying the trusted root store (C) reduces the chance that an unauthorized or unknown root CA is added in the first place, thereby reducing the risk of trusting a malicious interception certificate. Together, these two controls address both the application-level trust decision and the OS-level trust store integrity.

Answer

Allow employees to add any root CA as long as the certificate is password-protected.

Answer

Rely on HTTPS alone because any certificate over TLS is safe.

Answer

Disable DNS because certificate trust does not depend on hostnames.

Question 17

A microservices team stores service private keys inside container images and renews certificates manually once a year. Security wants to reduce damage if a node is compromised and keep certificate trust manageable at scale. Which two changes are the best fit? Select two.

Accepted Answer

Store private keys in an HSM-backed secrets manager or equivalent key vault.. Storing private keys in an HSM-backed secrets manager (e.g., AWS KMS, Azure Key Vault, or HashiCorp Vault with an HSM module) ensures that keys never leave the secure boundary of the HSM. This prevents an attacker who compromises a container or node from extracting the private key material, as the key is used for cryptographic operations via API calls rather than being stored in the filesystem. This directly reduces the blast radius of a node compromise. Additionally, using an internal CA with automated short-lived certificate renewal limits the validity window of compromised certificates and reduces the operational burden of manual renewals, keeping certificate trust manageable at scale.

Answer

Embed private keys in the container image so redeployments are simpler.

Answer

Replace the CA with a self-signed certificate on every node.

Answer

Convert the key file to base64 before storing it in the image.

Question 18

A network team wants no single person to both approve and deploy a production firewall rule, and they also want the approval path to be defensible during an investigation. Which two control concepts best address the stated risk? Select two.

Accepted Answer

Separation of duties between the person requesting the change and the person implementing it.. Separation of duties (A) ensures that the person who approves a change cannot be the same person who implements it, directly preventing a single individual from both approving and deploying the firewall rule. Dual control (B) requires a second person to independently approve the rule, so no two steps are controlled by one person alone. Together, these controls create an auditable approval path that can be defended during an investigation.

Answer

Least privilege for the production change account.

Answer

Job rotation for every engineer each quarter.

Answer

Risk transference to the firewall vendor.

Question 19

An internal audit found that a procurement team uses the shared account procure-approve to approve emergency purchases. The log only shows the shared account name, and managers say they cannot prove which person approved each request. Which two changes best improve accountability and nonrepudiation? Select two.

Accepted Answer

Replace the shared account with named user accounts and unique credentials.. Replacing the shared account with named user accounts and unique credentials ensures that each approval action is tied to a specific individual, directly addressing accountability and nonrepudiation. Additionally, writing approvals to an append-only, tamper-evident log with timestamps provides a verifiable, immutable record of who did what and when, which is essential for nonrepudiation and auditing. Together, these two controls establish both individual attribution and a trusted audit trail.

Answer

Require a longer password on the shared account.

Answer

Store screenshots of approval screens in a shared folder.

Answer

Encrypt the approval database at rest.

Question 20

A security architect is designing a defense-in-depth strategy for a corporate network. Which of the following are fundamental principles or concepts that should be incorporated into this strategy? (Choose four.)

Accepted Answer

Defining a separation of duties to prevent any single individual from having excessive control. Defense-in-depth is a strategy that employs multiple layers of security controls to protect assets, ensuring redundancy and preventing a single point of failure. It also incorporates principles such as zero-trust (never trust, always verify), least privilege (granting only necessary access), and separation of duties (dividing responsibilities to reduce risk of abuse). Disabling logging and monitoring would reduce visibility and compromise security, while relying on a single comprehensive solution contradicts the layered approach.

Answer

Using a single, comprehensive security solution to minimize complexity and management overhead

Answer

Disabling all logging and monitoring to reduce system resource consumption