SY0-701 General Security Concepts Practice Test 3 — 15 Questions

Question 1

A security architect is designing a defense strategy for a database containing sensitive customer records. The architect implements a network firewall to restrict inbound traffic to only the application server, enforces file-level encryption for the database files, requires multi-factor authentication for all administrative access, and deploys a database activity monitoring system to alert on unusual queries. Which security principle is the architect primarily applying?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in depth. The architect is applying defense in depth by layering multiple independent security controls: a network firewall, file-level encryption, multi-factor authentication, and database activity monitoring. This strategy ensures that if one control fails, others still provide protection, which is the core principle of defense in depth. Each layer addresses a different attack vector, making it significantly harder for an attacker to compromise the database.

Answer

Least privilege

Answer

Separation of duties

Answer

Fail safe

Question 2

A company is enhancing its network security posture. The security team deploys a system that passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts when suspicious patterns are detected. This system does not actively block or modify any traffic. Which type of security control does this system BEST represent?

Accepted Answer

Detective control. This system is a detective control because it passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts without actively blocking or modifying traffic. Detective controls are designed to identify and report security incidents after they occur or as they happen, which aligns with the described behavior of an Intrusion Detection System (IDS). Unlike preventive controls, it does not enforce policy or stop threats in real time.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 3

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

Accepted Answer

Authorization. The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 4

A legal team must send a confidential contract to a partner so only the intended recipient can read it, and the partner also needs assurance the file really came from your company. Which approach best meets both needs?

Accepted Answer

Encrypt the file with the recipient's public key and sign it with the sender's private key.. It uses asymmetric encryption to ensure confidentiality (encrypting with the recipient's public key ensures only the intended recipient can decrypt it with their private key) and digital signing (signing with the sender's private key provides non-repudiation and authenticity, proving the file came from the sender). This combination directly addresses both requirements: only the partner can read the contract, and the partner can verify the sender's identity.

Answer

Hash the contract and email the hash value separately.

Answer

Use a shared symmetric key and send the key in the same email message.

Answer

Compress the file and password-protect the archive with a simple passphrase.

Question 5

Which two statements describe authorization? Select two.

Accepted Answer

It determines what a user can access after sign-in. Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.

Answer

It proves a user is who they claim to be

Answer

It records every packet a device sends

Answer

It replaces the need for authentication

Question 6

A restricted server room opens only with a badge, and an alarm sounds if the door is left open too long. Which control type is the alarm?

Accepted Answer

Detective control. The alarm is a detective control because it detects and alerts when a door is left open too long, indicating a potential security breach. It does not prevent the door from being opened or correct the situation; it simply notifies personnel of an ongoing or past violation.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 7

Based on the exhibit, what should be implemented to reduce the blast radius if a backup server is compromised later?

Backup job configuration:
algorithm=AES-256-GCM
key_file=/opt/backup/key.bin
rotation=disabled
same_key_for_all_sites=true
backup_media copied to an offsite vault each night

Accepted Answer

Use envelope encryption with unique data encryption keys protected by a KMS-managed key encryption key.. Envelope encryption with unique data encryption keys (DEKs) protected by a KMS-managed key encryption key (KEK) ensures that even if the backup server is compromised, the attacker cannot decrypt all backups because each backup uses a different DEK, and the KEK is stored externally in a KMS. This limits the blast radius to only the data encrypted with the compromised DEK, rather than exposing all historical backups encrypted with a single static key.

Answer

Store the same key in a password-protected ZIP archive on the backup server.

Answer

Replace AES with SHA-256 so the files cannot be opened directly.

Answer

Keep one key forever and increase the backup frequency.

Question 8

Based on the exhibit, what is the best fix so role changes are reflected promptly in the application?

Token and directory data:

09:10  Token issued for user jdoe
      groups=[Finance_Approver, Expense_Reviewer]
      auth_time=09:10
      exp=17:10
09:15  HR updated directory: jdoe moved to Sales
11:00  The application still accepts the original token and allows expense approval
11:01  Identity provider logs show no token revocation event

Accepted Answer

Shorten token and session lifetime and revoke active tokens when the directory role changes.. The token's long lifetime (issued at 09:10, expires at 17:10) allows the application to continue accepting the original token even after the user's directory role changes at 09:15. Shortening the token lifetime forces more frequent reauthentication, and revoking active tokens when the directory role changes ensures that the application immediately reflects the updated authorization. This aligns with the principle of dynamic access control and token lifecycle management.

Answer

Increase the token lifetime so users reauthenticate less often.

Answer

Move the application to a different subnet to isolate it from HR systems.

Answer

Disable group-based authorization and let any authenticated user approve expenses.

Question 9

Based on the exhibit, which change best improves accountability while still allowing emergency access?

A finance team uses the following shared account on a jump host:

07:55:12  Account=FIN-ADMIN  Action=ApproveInvoice   Host=JUMP-02  IP=10.30.8.21
07:56:03  Account=FIN-ADMIN  Action=ChangeVendorBank Host=JUMP-02  IP=10.30.8.21
07:57:44  Account=FIN-ADMIN  Action=ExportReport     Host=JUMP-02  IP=10.30.8.21

Note: FIN-ADMIN is used by three finance managers during after-hours support.

Accepted Answer

Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.. Replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.

Answer

Require the shared account password to be changed every 24 hours.

Answer

Enable automatic account lockout after five failed logons.

Answer

Restrict the jump host by MAC address and subnet only.

Question 10

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

Accepted Answer

Implement endpoint device control or DLP rules to restrict removable media use.. Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Answer

Block all internet access on finance laptops except for the accounting website.

Answer

Increase the password complexity requirements for finance users.

Answer

Add more antivirus signatures to the endpoint protection platform.

Question 11

Which document tells all employees what they are allowed and not allowed to do when using company systems?

Accepted Answer

Policy. A policy is a high-level document that defines mandatory rules and expectations for employee behavior when using company systems. It specifies what is allowed and prohibited, such as acceptable use of email, internet browsing, and data handling, and is enforceable with consequences for non-compliance.

Answer

Procedure

Answer

Standard

Answer

Guideline

Question 12

The security team configures the badge system so employees must present both a badge and a PIN before entering the data center. The access logs are reviewed weekly for failed attempts. Which pair of control types best describes these measures?

Accepted Answer

Preventive and detective, because one measure blocks access and the other identifies suspicious activity.. The badge and PIN requirement is a preventive control that blocks unauthorized access to the data center, while the weekly review of access logs is a detective control that identifies suspicious activity after the fact. Preventive controls stop incidents before they occur, and detective controls discover violations that have already happened, making this pair the best fit for the described measures.

Answer

Corrective and recovery, because the logs can restore access after a badge failure.

Answer

Deterrent and compensating, because the PIN discourages attackers and the logs replace the badge reader.

Answer

Administrative and physical, because the weekly review and the badge reader are both physical measures.

Question 13

Based on the exhibit, what is the best governance improvement?

Data handling procedure:
- Managers may approve external sharing exceptions verbally.
- Staff record exceptions in email threads.
- No retention period is defined for exception evidence.

Audit note: multiple exceptions could not be traced to an approver.

Accepted Answer

Replace verbal and email exceptions with a documented approval workflow and retained exception records.. The current procedure lacks a documented approval workflow and retention policy, which directly caused the audit finding that exceptions could not be traced to an approver. Implementing a formal, auditable process ensures non-repudiation and compliance with data handling governance, addressing the root cause rather than relying on informal verbal or email-based approvals.

Answer

Allow each team to decide its own exception format to increase flexibility.

Answer

Remove exception handling entirely so no external sharing can ever occur.

Answer

Keep the procedure unchanged and rely on additional awareness training alone.

Question 14

Based on the exhibit, which document should be created or updated to make these settings mandatory and measurable?

Endpoint baseline draft:
- Full-disk encryption should be enabled on all corporate laptops.
- Screen lock should activate after 15 minutes of inactivity.
- Users should choose strong passwords.

Related documents:
Policy: Acceptable Use Policy
Standard: none
Procedure: Laptop imaging steps
Guideline: Suggested hardening tips

Accepted Answer

Create or update a standard because it defines mandatory, specific minimum requirements.. A standard defines mandatory, specific minimum requirements that must be met, such as 'full-disk encryption enabled' and 'screen lock after 15 minutes.' Unlike policies (high-level intent) or guidelines (suggestions), a standard provides measurable criteria that can be audited and enforced. Creating or updating a standard makes the endpoint baseline settings mandatory and measurable.

Answer

Update the policy because policies are always the most detailed technical documents.

Answer

Update the procedure because procedures are the best place for corporate requirements.

Answer

Update the guideline because guidelines are the strongest way to enforce compliance.

Question 15

A company wants to make sure only approved administrators can view and rotate a shared encryption secret used by several applications. What is the best way to manage that secret?

Accepted Answer

Use a centralized secrets vault or key management system. A centralized secrets vault or key management system (KMS) like HashiCorp Vault or AWS KMS provides role-based access control (RBAC), audit logging, and automatic rotation of secrets. This ensures only approved administrators can view and rotate the shared encryption secret, while applications retrieve it via secure APIs without exposing it in code or files.

Answer

Store it in a shared spreadsheet

Answer

Put it directly in application source code

Answer

Email the secret only to trusted administrators