SY0-701 General Security Concepts Practice Test 3 — 15 Questions

Question 1

A company suspects the master encryption key used by a cloud storage service may have been exposed. The data must remain protected if someone later obtains a copy of the old key. What is the best next step?

Accepted Answer

Rotate the key and re-encrypt or rewrap the protected data under the new key.. Key rotation is the correct response because it invalidates the old master encryption key by generating a new one and re-encrypting or rewrapping the protected data under the new key. This ensures that even if an attacker later obtains a copy of the old key, the data remains protected because it is no longer encrypted with that key. In cloud storage services like AWS KMS or Azure Key Vault, this process is typically automated and does not require re-uploading the data.

Answer

Delete the stored files so the exposed key can no longer be used.

Answer

Change every user's password because that will also invalidate the exposed encryption key.

Answer

Increase file compression so the data becomes harder to read.

Question 2

During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?

Accepted Answer

Use just-in-time privileged access through a privileged access management workflow.. Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.

Answer

Add the administrator to a permanent domain admin group so access is always available.

Answer

Create a shared administrator account for the incident team and change the password afterward.

Answer

Grant access by sending the administrator a VPN profile with broader network reach.

Question 3

Based on the exhibit, which document type should be updated to make the approval and retention requirements mandatory across the organization?

Accepted Answer

Policy, because it sets mandatory rules that apply organization-wide.. A policy document is the correct choice because it establishes mandatory rules that apply organization-wide, making approval and retention requirements enforceable across all departments. Unlike guidelines or procedures, policies are authoritative and require compliance, which is essential for standardizing security controls like data retention periods.

Answer

Guideline, because it provides flexible advice without requiring enforcement.

Answer

Procedure, because it lists the exact steps the help desk follows.

Answer

Architecture diagram, because it shows where documents are stored.

Question 4

Based on the exhibit, which improvement best addresses the biggest cryptographic risk?

TLS inventory:
- edge-vpn01 and edge-vpn02 present the same certificate and private key
- private key file stored in a shared SMB folder
- admins copy the key manually during maintenance
- compromise of either gateway would expose the file path to the same share

Accepted Answer

Place the private key in an HSM or cloud key vault and issue unique keys or certificates per gateway.. Option A is correct because the biggest cryptographic risk is the shared private key stored in an SMB share, which violates the principle of least privilege and creates a single point of compromise. Using a Hardware Security Module (HSM) or cloud key vault ensures the private key is never exposed in plaintext, and issuing unique keys per gateway eliminates the risk that compromising one gateway exposes the key for all others. This directly addresses the core issue of key confidentiality and isolation.

Answer

Increase the certificate expiration to five years to reduce renewal work.

Answer

Keep copying the same key everywhere so failover is easier to manage.

Answer

Disable certificate validation to avoid user-facing outages.

Question 5

Based on the exhibit, what is the best fix so role changes take effect promptly without waiting for token expiration?

Accepted Answer

Perform authorization checks against current directory data on each privileged request.. Option B is correct because performing authorization checks against current directory data (e.g., via LDAP or a policy decision point) on each privileged request ensures that role changes are enforced immediately, regardless of JWT token lifetime. This decouples authentication (token validity) from authorization (current role membership), allowing dynamic updates without waiting for token expiration or reauthentication.

Answer

Increase the token lifetime so users reauthenticate less often during the workday.

Answer

Store the JWT in a browser cookie so it refreshes automatically when roles change.

Answer

Disable MFA and rely only on the role claim inside the token.

Question 6

Which two actions are examples of accounting in AAA? Select two.

Accepted Answer

Recording successful logons in a security log. Option A is correct because accounting in AAA involves recording user activities, such as successful logons, in a security log. This provides an audit trail for monitoring and compliance. Option C is correct because tracking which files a user opened during a session is a form of accounting that logs resource access for accountability and usage analysis.

Answer

Checking a username and password before access

Answer

Granting access to the finance folder

Answer

Requiring a fingerprint and a password

Question 7

Which action is the best example of accounting in AAA?

Accepted Answer

The system records the username, timestamp, and files opened during the session.. Accounting in AAA (Authentication, Authorization, and Accounting) focuses on tracking user activities and resource usage. Option B correctly describes this by specifying the recording of username, timestamp, and files accessed, which are typical audit log entries used for monitoring and compliance.

Answer

The system checks a password and a one-time code before allowing access.

Answer

The system grants access to the finance folder after the user is approved.

Answer

The system forces the user to change their password after 90 days.

Question 8

A development team needs a centralized service to store, rotate, and control access to encryption keys for applications. Which solution best fits?

Accepted Answer

Key management service, because it centralizes key storage and rotation controls.. A key management service (KMS) centralizes the lifecycle of cryptographic keys, including secure storage, automated rotation, and fine-grained access control via IAM policies. This directly meets the requirement for a centralized service to store, rotate, and control access to encryption keys for applications, as KMS is purpose-built for these tasks.

Answer

Port forwarding rule, because it allows applications to reach the encryption system.

Answer

Load balancer, because it distributes encryption requests across servers.

Answer

Web application firewall, because it protects the keys from injection attacks.

Question 9

A security team configures the SIEM to alert when a user account has several failed logins followed by a successful login from a new location. What type of control is this?

Accepted Answer

Detective control, because it identifies suspicious activity after the event has started.. This is a detective control because the SIEM is configured to monitor and analyze log data after events have occurred, specifically identifying a pattern of several failed logins followed by a successful login from a new location. The alert does not prevent or block the login; it only notifies the security team of potentially suspicious activity that has already taken place, allowing them to investigate further.

Answer

Preventive control, because it blocks the login attempt before it occurs.

Answer

Corrective control, because it automatically fixes the account after the login succeeds.

Answer

Deterrent control, because it discourages attackers from trying to sign in.

Question 10

A manager wants files on a stolen laptop to remain unreadable even if the drive is removed and connected to another computer. Which control should be implemented?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all user data. When the drive is removed and connected to another computer, the encrypted data remains inaccessible without the correct decryption key or passphrase, ensuring files stay unreadable. This directly addresses the manager's requirement for data confidentiality even after physical theft.

Answer

File compression

Answer

Packet filtering

Answer

Digital signing

Question 11

Which two documents are typically mandatory and organization-wide rather than optional guidance? Select two.

Accepted Answer

Security policy. Security policies are mandatory, high-level documents that define management's intent and direction for security, establishing rules that all employees must follow. They are organization-wide and enforceable, unlike guidelines which are optional. Standards are also mandatory and specify uniform technical controls or configurations (e.g., requiring AES-256 encryption) that must be implemented across the organization to comply with the security policy.

Answer

Guideline

Answer

Personal preference note

Answer

Architecture diagram

Question 12

Based on the exhibit, which additional control best reduces the risk of tailgating at the entrance while preserving normal employee flow?

Accepted Answer

Install a mantrap or anti-passback turnstile that admits one person per badge authorization.. A mantrap or anti-passback turnstile enforces one-person-per-badge authorization, physically preventing tailgating by only allowing a single individual to pass per valid credential. This preserves normal employee flow because authorized users can enter quickly without manual intervention, unlike guards or awareness campaigns that rely on human compliance.

Answer

Post a security guard at the entrance during business hours.

Answer

Add more CCTV cameras in the lobby and at the parking lot entrance.

Answer

Send quarterly emails reminding employees not to hold doors open.

Question 13

Based on the exhibit, which awareness control best addresses the observed failure pattern?

Accepted Answer

Run targeted vishing exercises and teach a callback verification procedure.. The exhibit shows a pattern where users are falling for phone-based social engineering (vishing), not email or general phishing. Option B directly addresses this by running targeted vishing exercises to simulate the real threat and teaching a callback verification procedure, which is a specific technical control to verify the identity of callers before taking action. This is the most effective awareness control because it trains users to recognize and respond to the exact attack vector observed.

Answer

Replace the phone-call simulation with longer monthly policy newsletters.

Answer

Disable MFA so users are not asked for one-time codes.

Answer

Tell users to ignore all requests from anyone outside the company.

Question 14

The help desk needs a document that describes the exact steps for verifying a caller and resetting a password. What type of document should they use?

Accepted Answer

Procedure. A procedure provides the exact, step-by-step instructions needed for a specific task, such as verifying a caller's identity and resetting a password. This is distinct from a policy, which states high-level rules, or a standard, which defines mandatory technical requirements. The help desk needs a documented sequence of actions, which is the definition of a procedure.

Answer

Policy

Answer

Standard

Answer

Guideline

Question 15

An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?

Accepted Answer

Verify the request using a separate trusted method. Option C is correct because the email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.

Answer

Complete the transfer because it came from an executive

Answer

Reply to the email asking if it is real

Answer

Forward it to the whole department for awareness