SY0-701 General Security Concepts Practice Test 10 — 15 Questions

Question 1

Based on the exhibit, which security principle does the organization appear to be using most clearly?

Accepted Answer

Defense in depth, because several different controls stop or limit the attack at different stages.. The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.

Answer

Zero trust, because all access is denied until a user proves identity again.

Answer

Least privilege, because the attachment was blocked from having administrator rights.

Answer

Need-to-know, because only the security team should be aware of the incident.

Question 2

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

Accepted Answer

Nonrepudiation, because the organization needs proof that a specific person performed the approval.. Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Answer

Confidentiality, because the approval records should be hidden from everyone except finance staff.

Answer

Availability, because the approval system must remain online during business hours.

Answer

Integrity, because the record must never be changed after it is saved.

Question 3

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

Accepted Answer

The root CA certificate for the new PKI to trusted endpoint stores.. The root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Answer

The portal's private key so users can validate the certificate locally.

Answer

A new certificate signing request on each endpoint.

Answer

A self-signed certificate on the portal to avoid future CA problems.

Question 4

A company requires MFA, endpoint protection, and network filtering so that if one control misses a threat, another control still helps stop it. Which security principle is this?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (e.g., MFA, endpoint protection, network filtering) are deployed so that if one layer fails, another still provides protection. This ensures no single point of failure can compromise the entire system, directly matching the scenario where overlapping controls compensate for each other's gaps.

Answer

Single sign-on

Answer

Nonrepudiation

Answer

Data masking

Question 5

Your company is syncing design files to a cloud object store. The security team wants to reduce risk if the storage account is stolen and also protect the files while they travel across the internet. Which approach is the best fit?

Accepted Answer

Encrypt data in transit with TLS and enable encryption at rest with managed keys.. It addresses both risks: TLS (Transport Layer Security) encrypts data in transit, preventing interception or tampering during upload, while managed keys for encryption at rest protect the files if the storage account credentials are compromised. This dual-layer approach aligns with defense-in-depth and is a standard best practice for cloud object stores like Amazon S3 or Azure Blob Storage.

Answer

Password-protect each archive and upload it over plain HTTP.

Answer

Rename the files before upload so attackers cannot identify them.

Answer

Place the storage service on a private IP address and skip encryption.

Question 6

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

Accepted Answer

Require a documented change-management workflow with two approvers before any firewall rule is applied.. A documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Answer

Enable detailed firewall logging so each packet match is written to disk.

Answer

Move the firewall appliance into a locked equipment rack.

Answer

Encrypt the firewall configuration backup with a strong key.

Question 7

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Accepted Answer

Remove local administrator rights from standard user accounts.. Removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Answer

Turn off logging to preserve disk space.

Answer

Allow unrestricted browser extension installs.

Answer

Merge all developer and production systems into one VLAN.

Question 8

A sales manager's laptop is often taken home and may contain customer pricing spreadsheets and contract drafts. Which control best protects the files if the laptop is stolen?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) protects all data on the laptop's storage drive by encrypting the entire volume, including the operating system, applications, and files. If the laptop is stolen, the thief cannot access the customer pricing spreadsheets and contract drafts without the decryption key (e.g., a pre-boot PIN or TPM-based key). This renders the data unreadable even if the drive is removed and attached to another system, directly addressing the risk of physical theft.

Answer

Hashing the files

Answer

Using TLS on the office Wi-Fi

Answer

File compression

Question 9

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Accepted Answer

Shorten token and session lifetimes, and require reauthentication for high-risk actions.. Shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Answer

Increase password complexity but keep session duration unchanged.

Answer

Disable SSO and email one-time passwords for every login.

Answer

Keep long-lived sessions to reduce help desk tickets.

Question 10

A company launches a new HTTPS portal. Users should be able to confirm the site is really the company's portal and not a fake copy. Which control provides that trust?

Accepted Answer

A TLS certificate issued by a trusted certificate authority. A TLS certificate issued by a trusted certificate authority (CA) provides the trust needed because browsers and operating systems maintain a root store of trusted CAs. When a user visits the HTTPS portal, the server presents a certificate signed by that CA, and the browser cryptographically verifies the signature chain back to a trusted root. This ensures the public key belongs to the claimed domain, authenticating the server and preventing impersonation by a fake copy.

Answer

A self-signed certificate installed only on user laptops

Answer

A SHA-256 checksum posted on the login page

Answer

A shared password embedded in the page source

Question 11

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

Accepted Answer

Configure an account expiration date and automatic deprovisioning tied to the approved role.. Configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Answer

Use one shared contractor account and rotate the password when people leave.

Answer

Disable the account after the contract ends but keep all group memberships unchanged.

Answer

Create a local workstation account so the contractor does not need centralized identity services.

Question 12

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

Accepted Answer

Federated single sign-on using the corporate identity provider.. The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Answer

Password synchronization between every application in the suite.

Answer

Shared guest accounts for all employees on the portal.

Answer

Split tunneling through a VPN to speed up application access.

Question 13

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

Accepted Answer

Disable unused services and run the database under a dedicated least-privilege service account.. Disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Answer

Enable every management service so support can connect easily.

Answer

Use the domain admin account to run the database service.

Answer

Share the same account with backup software to simplify troubleshooting.

Question 14

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

Accepted Answer

Nonrepudiation. Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 15

A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.

Accepted Answer

Restrict host firewall rules to required source addresses and ports.. Option A is correct because narrowing the host firewall to only the load balancer's and jump host's source IP addresses on the specific service ports enforces least-privilege network access while preserving the required traffic pattern. Option B is correct because running the web service under a dedicated nonadministrative service account removes the excessive privileges of a domain administrator, limiting the blast radius if the service is compromised. Option C is wrong because leaving SSH open to every subnet and relying on passwords violates least privilege and weakens authentication. Option D is wrong because granting local administrator rights to the service account expands privileges rather than hardening. Option E is wrong because permanently disabling patching leaves known vulnerabilities unaddressed.

Answer

Leave SSH open to every subnet and rely on strong passwords.

Answer

Give the service account local administrator rights so it can restart itself.

Answer

Disable patching during business hours permanently.