SY0-701 General Security Concepts Practice Test 2 — 15 Questions

Question 1

A developer installed an unknown root CA on a laptop. The browser now accepts a proxy certificate for intranet.apps.example without warnings. Which two controls most directly reduce the chance that this endpoint trusts a malicious interception certificate? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce certificate pinning in the application for the expected server certificate.. Certificate pinning (A) hard-codes the expected server certificate or public key into the application, so even if a malicious root CA is trusted by the OS, the application will reject any proxy certificate that does not match the pinned certificate. This directly prevents the browser from accepting the proxy certificate without warnings. Additionally, endpoint policy that prevents local administrators from modifying the trusted root store (C) reduces the chance that an unauthorized or unknown root CA is added in the first place, thereby reducing the risk of trusting a malicious interception certificate. Together, these two controls address both the application-level trust decision and the OS-level trust store integrity.

Answer

Allow employees to add any root CA as long as the certificate is password-protected.

Answer

Rely on HTTPS alone because any certificate over TLS is safe.

Answer

Disable DNS because certificate trust does not depend on hostnames.

Question 2

A microservices team stores service private keys inside container images and renews certificates manually once a year. Security wants to reduce damage if a node is compromised and keep certificate trust manageable at scale. Which two changes are the best fit? Select two.

Accepted Answer

Store private keys in an HSM-backed secrets manager or equivalent key vault.. Storing private keys in an HSM-backed secrets manager (e.g., AWS KMS, Azure Key Vault, or HashiCorp Vault with an HSM module) ensures that keys never leave the secure boundary of the HSM. This prevents an attacker who compromises a container or node from extracting the private key material, as the key is used for cryptographic operations via API calls rather than being stored in the filesystem. This directly reduces the blast radius of a node compromise. Additionally, using an internal CA with automated short-lived certificate renewal limits the validity window of compromised certificates and reduces the operational burden of manual renewals, keeping certificate trust manageable at scale.

Answer

Embed private keys in the container image so redeployments are simpler.

Answer

Replace the CA with a self-signed certificate on every node.

Answer

Convert the key file to base64 before storing it in the image.

Question 3

A network team wants no single person to both approve and deploy a production firewall rule, and they also want the approval path to be defensible during an investigation. Which two control concepts best address the stated risk? Select two.

Accepted Answer

Separation of duties between the person requesting the change and the person implementing it.. Separation of duties (A) ensures that the person who approves a change cannot be the same person who implements it, directly preventing a single individual from both approving and deploying the firewall rule. Dual control (B) requires a second person to independently approve the rule, so no two steps are controlled by one person alone. Together, these controls create an auditable approval path that can be defended during an investigation.

Answer

Least privilege for the production change account.

Answer

Job rotation for every engineer each quarter.

Answer

Risk transference to the firewall vendor.

Question 4

An internal audit found that a procurement team uses the shared account procure-approve to approve emergency purchases. The log only shows the shared account name, and managers say they cannot prove which person approved each request. Which two changes best improve accountability and nonrepudiation? Select two.

Accepted Answer

Replace the shared account with named user accounts and unique credentials.. Replacing the shared account with named user accounts and unique credentials ensures that each approval action is tied to a specific individual, directly addressing accountability and nonrepudiation. Additionally, writing approvals to an append-only, tamper-evident log with timestamps provides a verifiable, immutable record of who did what and when, which is essential for nonrepudiation and auditing. Together, these two controls establish both individual attribution and a trusted audit trail.

Answer

Require a longer password on the shared account.

Answer

Store screenshots of approval screens in a shared folder.

Answer

Encrypt the approval database at rest.

Question 5

A security architect is designing a defense-in-depth strategy for a corporate network. Which of the following are fundamental principles or concepts that should be incorporated into this strategy? (Choose four.)

Accepted Answer

The principle of least privilege to limit user and system access to only what is necessary. Defense-in-depth is a strategy that employs multiple layers of security controls to protect assets, ensuring redundancy and preventing a single point of failure. It also incorporates principles such as zero-trust (never trust, always verify), least privilege (granting only necessary access), and separation of duties (dividing responsibilities to reduce risk of abuse). Disabling logging and monitoring would reduce visibility and compromise security, while relying on a single comprehensive solution contradicts the layered approach.

Answer

Using a single, comprehensive security solution to minimize complexity and management overhead

Answer

Disabling all logging and monitoring to reduce system resource consumption

Question 6

An organization is updating its security policies to align with modern threats and compliance requirements. Which of the following are key security concepts that should be explicitly addressed in these updated policies? (Choose four.)

Accepted Answer

Change management processes to control modifications to systems and configurations. Data classification and handling procedures are correct because they define how sensitive information is identified, labeled, and protected throughout its lifecycle, which is essential for compliance with regulations like GDPR or HIPAA. Incident response procedures are correct because they provide a structured, repeatable process (e.g., NIST SP 800-61) to detect, contain, eradicate, and recover from security events, minimizing damage. Change management processes are correct because they ensure that all system and configuration changes are reviewed, approved, and documented, reducing the risk of unauthorized or misconfigured changes that could introduce vulnerabilities. Password complexity and rotation requirements are correct because they enforce strong authentication practices, mitigating brute-force and credential-stuffing attacks, though modern guidance (NIST SP 800-63B) emphasizes length and complexity over arbitrary rotation.

Answer

Allowing unrestricted personal device usage on the corporate network without controls

Answer

Requiring all employees to use the same shared administrative account for efficiency

Question 7

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

Accepted Answer

Integrity. The script computes SHA-256 hashes of configuration files and compares them nightly to detect any unauthorized or accidental changes. This directly protects the integrity of the files by ensuring they have not been modified, which is the core security goal of integrity. Confidentiality and availability are not addressed by hash comparison.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 8

A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?

Accepted Answer

Separation of duties. Requiring two different system administrators to approve and execute changes to the core transaction processing database enforces separation of duties. This principle ensures that no single individual has the authority to perform both the approval and execution steps, reducing the risk of fraud, error, or unauthorized modifications. In a financial institution, this is critical for maintaining the integrity of transaction data and complying with regulatory standards like SOX or PCI DSS.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 9

A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?

Accepted Answer

Defense in depth. The architect is implementing defense in depth by layering multiple independent security controls—a next-generation firewall (NGFW) at the perimeter, an intrusion prevention system (IPS) on the internal network, mandatory multi-factor authentication (MFA) for remote access, and quarterly security awareness training. The key phrase 'independent of each other so that a failure in any single control does not leave the entire network unprotected' directly describes the principle of layered defenses, where no single point of failure compromises overall security. This approach ensures that if an attacker bypasses the NGFW, the IPS or MFA may still prevent or detect the breach.

Answer

Least privilege

Answer

Zero trust

Answer

Separation of duties

Question 10

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this case, nursing staff only need read and write access to records of currently assigned patients, but membership in the 'Administrators' group grants full read/write access to all patient records and the ability to modify system configuration settings, which far exceeds their job requirements. This directly violates least privilege by providing excessive, unnecessary privileges that increase the risk of unauthorized access or accidental misconfiguration.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Availability

Question 11

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 12

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

Accepted Answer

Integrity. Restoring the altered customer account balance records from a verified read-only backup directly addresses the integrity security goal. Integrity ensures that data is accurate and has not been modified by unauthorized parties. By reverting the records to their pre-attack state, the analyst is correcting the unauthorized modifications, thereby restoring the trustworthiness of the data.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 13

A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?

Accepted Answer

Digital signature. A digital signature provides both authentication (proving the update originated from the vendor) and integrity (detecting any modification in transit). The vendor signs the file with their private key, and customers verify the signature using the vendor's public key, ensuring the file has not been altered since signing.

Answer

Cryptographic hash

Answer

Antivirus scan report

Answer

TLS certificate

Question 14

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

Accepted Answer

Non-repudiation. The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Answer

Authorization

Answer

Authentication

Answer

Availability

Question 15

A security auditor is reviewing the access controls for a payroll application. The auditor discovers that a single user, the payroll manager, has permissions to both create new employee records and then approve and process salary payments for those records. The company's security policy requires that no single individual should be able to execute both the creation and the approval of a payment for the same employee. Which of the following security principles is the company's policy attempting to enforce?

Accepted Answer

Separation of duties. The company's policy prohibits a single user from both creating employee records and approving payments for them, which is a classic application of separation of duties. This principle ensures that no single individual has the authority to execute two conflicting or sensitive tasks that could lead to fraud or error, such as creating a fictitious employee and then approving a salary payment to that employee. In the context of a payroll application, separation of duties requires distinct roles or users for record creation and payment approval to enforce checks and balances.

Answer

Least privilege

Answer

Defense in depth

Answer

Mandatory access control