SY0-701 General Security Concepts Practice Test 10 — 15 Questions

Question 1

A baseline review found that standard developer accounts are local administrators, unsigned tools can run from user profile folders, and reimaged systems still end up with unauthorized persistence. Which two changes best improve hardening while preserving developer work? Select two.

Accepted Answer

Remove local administrator rights from standard user accounts.. Option A is correct because removing local administrator rights from standard developer accounts enforces the principle of least privilege (PoLP). This prevents developers from making unauthorized system-wide changes, such as installing unsigned tools or creating persistence mechanisms, while still allowing them to perform their work with standard user permissions. This directly addresses the baseline review finding that standard developer accounts are local administrators, which is a common security misconfiguration.

Answer

Turn off logging to preserve disk space.

Answer

Allow unrestricted browser extension installs.

Answer

Merge all developer and production systems into one VLAN.

Question 2

A sales manager's laptop is often taken home and may contain customer pricing spreadsheets and contract drafts. Which control best protects the files if the laptop is stolen?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) protects all data on the laptop's storage drive by encrypting the entire volume, including the operating system, applications, and files. If the laptop is stolen, the thief cannot access the customer pricing spreadsheets and contract drafts without the decryption key (e.g., a pre-boot PIN or TPM-based key). This renders the data unreadable even if the drive is removed and attached to another system, directly addressing the risk of physical theft.

Answer

Hashing the files

Answer

Using TLS on the office Wi-Fi

Answer

File compression

Question 3

A finance app uses the corporate IdP for authentication. A user who moved out of finance can still approve invoices until the browser session expires, and the app caches local roles. Which two changes best make access changes take effect faster without storing app passwords? Select two.

Accepted Answer

Shorten token and session lifetimes, and require reauthentication for high-risk actions.. Option A is correct because shortening token and session lifetimes reduces the window during which stale permissions remain active, and requiring reauthentication for high-risk actions (like approving invoices) ensures that the user's current authorization status is verified before sensitive operations. This directly addresses the problem of cached roles persisting beyond the user's actual group membership changes.

Answer

Increase password complexity but keep session duration unchanged.

Answer

Disable SSO and email one-time passwords for every login.

Answer

Keep long-lived sessions to reduce help desk tickets.

Question 4

A company launches a new HTTPS portal. Users should be able to confirm the site is really the company's portal and not a fake copy. Which control provides that trust?

Accepted Answer

A TLS certificate issued by a trusted certificate authority. A TLS certificate issued by a trusted certificate authority (CA) provides the trust needed because browsers and operating systems maintain a root store of trusted CAs. When a user visits the HTTPS portal, the server presents a certificate signed by that CA, and the browser cryptographically verifies the signature chain back to a trusted root. This ensures the public key belongs to the claimed domain, authenticating the server and preventing impersonation by a fake copy.

Answer

A self-signed certificate installed only on user laptops

Answer

A SHA-256 checksum posted on the login page

Answer

A shared password embedded in the page source

Question 5

An HR department hires contractors for fixed 60-day engagements. Accounts should stop working automatically when the engagement ends, and any rehire should require fresh approval rather than restoring old access. What IAM control is the best fit?

Accepted Answer

Configure an account expiration date and automatic deprovisioning tied to the approved role.. Option B is correct because configuring an account expiration date and automatic deprovisioning tied to the approved role directly enforces the 60-day limit and ensures that when the engagement ends, the account is automatically disabled or removed. This approach also supports the requirement that rehire requires fresh approval, as the old account is deprovisioned and cannot be simply re-enabled without going through the provisioning process again.

Answer

Use one shared contractor account and rotate the password when people leave.

Answer

Disable the account after the contract ends but keep all group memberships unchanged.

Answer

Create a local workstation account so the contractor does not need centralized identity services.

Question 6

Employees authenticate once to a corporate portal and then open the help desk, payroll, and documentation apps without logging in again. The apps rely on tokens from the company's identity provider instead of storing separate passwords. What is being implemented?

Accepted Answer

Federated single sign-on using the corporate identity provider.. The scenario describes single sign-on (SSO) where the corporate identity provider (IdP) issues tokens (e.g., SAML assertions, OIDC ID tokens) after initial authentication. The help desk, payroll, and documentation apps are configured as service providers that trust the IdP, so they accept the token instead of requiring separate credentials. This is federated SSO because the apps rely on a central identity provider rather than sharing password databases or synchronizing passwords.

Answer

Password synchronization between every application in the suite.

Answer

Shared guest accounts for all employees on the portal.

Answer

Split tunneling through a VPN to speed up application access.

Question 7

A sysadmin is preparing a dedicated database server for production. The server will not host web services, print services, or file sharing. Which action best follows least privilege and secure defaults?

Accepted Answer

Disable unused services and run the database under a dedicated least-privilege service account.. Option C is correct because disabling unused services reduces the attack surface, and running the database under a dedicated least-privilege service account ensures the account has only the permissions necessary for the database to function. This aligns with the principles of least privilege and secure defaults, as the server is dedicated to database services and should not have extraneous services or overly permissive accounts.

Answer

Enable every management service so support can connect easily.

Answer

Use the domain admin account to run the database service.

Answer

Share the same account with backup software to simplify troubleshooting.

Question 8

A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.

Accepted Answer

Enforce certificate pinning in the application for the expected server certificate.. Option A is correct because certificate pinning hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings, as the pinning check occurs at the application layer before the TLS handshake completes.

Answer

Allow employees to add any root CA as long as the certificate is password-protected.

Answer

Rely on HTTPS alone because any certificate over TLS is safe.

Answer

Disable DNS because certificate trust does not depend on hostnames.

Question 9

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

Accepted Answer

Nonrepudiation. Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 10

A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.

Accepted Answer

Restrict host firewall rules to required source addresses and ports.. Option A is correct because restricting host firewall rules to only the load balancer and management jump host's source IP addresses and required ports (e.g., HTTP/HTTPS for the load balancer, SSH/RDP for the jump host) enforces the principle of least privilege. This eliminates the risk of exposing unnecessary services to the entire network, which is a common attack vector. The current 'allow all inbound ports' configuration violates basic network segmentation and access control best practices.

Answer

Leave SSH open to every subnet and rely on strong passwords.

Answer

Give the service account local administrator rights so it can restart itself.

Answer

Disable patching during business hours permanently.

Question 11

A microservices team stores service private keys inside container images and renews certificates manually once a year. Security wants to reduce damage if a node is compromised and keep certificate trust manageable at scale. Which two changes are the best fit? Select two.

Accepted Answer

Store private keys in an HSM-backed secrets manager or equivalent key vault.. Option A is correct because storing private keys in an HSM-backed secrets manager (e.g., AWS KMS, Azure Key Vault, or HashiCorp Vault with an HSM module) ensures that keys never leave the secure boundary of the HSM. This prevents an attacker who compromises a container or node from extracting the private key material, as the key is used for cryptographic operations via API calls rather than being stored in the filesystem. This directly reduces the blast radius of a node compromise.

Answer

Embed private keys in the container image so redeployments are simpler.

Answer

Replace the CA with a self-signed certificate on every node.

Answer

Convert the key file to base64 before storing it in the image.

Question 12

After imaging laptops, the security team wants to ensure screen-lock timeouts, local admin restrictions, and USB storage controls remain consistent on every device even after users make changes. What is the best approach?

Accepted Answer

Enforce a hardened baseline with configuration management and compliance checks.. Option B is correct because configuration management tools (e.g., Microsoft Intune, Group Policy, or Ansible) can enforce a hardened baseline by applying settings like screen-lock timeouts, local admin restrictions, and USB storage controls. These tools also perform compliance checks to detect and remediate any drift caused by user changes, ensuring consistency across all devices.

Answer

Rely on users to follow the build sheet during setup and avoid future changes.

Answer

Increase antivirus scan frequency so policy settings do not change.

Answer

Apply full disk encryption only, since it covers all endpoint hardening needs.

Question 13

A network team wants no single person to both approve and deploy a production firewall rule, and they also want the approval path to be defensible during an investigation. Which two control concepts best address the stated risk? Select two.

Accepted Answer

Separation of duties between the person requesting the change and the person implementing it.. Separation of duties ensures that no single person has the authority to both approve and deploy a production firewall rule, directly addressing the risk of unauthorized or fraudulent changes. By requiring different individuals for the request/approval and implementation steps, the organization creates a clear, auditable chain of accountability that can be defended during an investigation.

Answer

Least privilege for the production change account.

Answer

Job rotation for every engineer each quarter.

Answer

Risk transference to the firewall vendor.

Question 14

After employees transfer departments, they keep access to old SaaS applications because app-specific accounts are removed only after a manual cleanup ticket. Which two changes best close the lifecycle gap? Select two.

Accepted Answer

Use automated provisioning and deprovisioning tied to HR events through SCIM or an equivalent interface.. Option A is correct because automating provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ties account lifecycle directly to HR events (e.g., termination, transfer). This eliminates the manual cleanup ticket gap by instantly removing or modifying access when an employee changes departments, ensuring no stale SaaS accounts remain.

Answer

Keep app accounts manually managed so each app owner can decide independently.

Answer

Share a generic help desk password for quick access restoration.

Answer

Require password changes every 30 days for all users.

Question 15

An internal audit found that a procurement team uses the shared account procure-approve to approve emergency purchases. The log only shows the shared account name, and managers say they cannot prove which person approved each request. Which two changes best improve accountability and nonrepudiation? Select two.

Accepted Answer

Replace the shared account with named user accounts and unique credentials.. Option A is correct because replacing the shared account with named user accounts and unique credentials ensures that each approval action is tied to a specific individual. This directly addresses the lack of accountability and nonrepudiation, as each user's unique credentials create a verifiable link between the person and the action, preventing repudiation of the approval.

Answer

Require a longer password on the shared account.

Answer

Store screenshots of approval screens in a shared folder.

Answer

Encrypt the approval database at rest.

SY0-701 General Security Concepts Practice Test 10 — 15 Questions

Exhibit

SY0-701 General Security Concepts Practice Test 10 — 15 Questions

Exhibit