SY0-701 General Security Concepts Practice Test 5 — 15 Questions

Question 1

An employee receives an email that appears to be from the CEO and asks for an urgent wire transfer. The sender address is slightly different from the real company address. What is the best first action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the request using a separate trusted method. The email exhibits classic signs of a business email compromise (BEC) attack, where the sender address is spoofed or slightly altered. Verifying the request through a separate, trusted method—such as calling the CEO directly or using a known internal communication channel—bypasses any compromised email system and confirms the legitimacy of the request. This aligns with the principle of out-of-band verification, which is a key defense against phishing and social engineering.

Answer

Complete the transfer because it came from an executive

Answer

Reply to the email asking if it is real

Answer

Forward it to the whole department for awareness

Question 2

After an employee successfully signs in to a file-sharing portal, the portal checks whether the employee can upload files to a specific project folder. Which AAA concept is being used?

Accepted Answer

Authorization, because the system is deciding what the signed-in user is allowed to do.. After the user successfully signs in (authentication), the portal checks permissions to determine if they can upload files to a specific project folder. This is the definition of authorization: verifying what an authenticated user is allowed to do. The system is enforcing access control based on the user's identity and the folder's permissions.

Answer

Authentication, because the user proved their identity with credentials.

Answer

Accounting, because the portal is recording the folder permissions for later review.

Answer

Nonrepudiation, because the portal proves the user cannot deny uploading a file.

Question 3

A payroll application allows the same user to create a vendor and approve a payment. The security team wants to reduce fraud without adding unnecessary complexity. Which principle should they apply?

Accepted Answer

Separation of duties, so no single person can complete the entire high-risk workflow.. Separation of duties (option A) is the correct principle because it prevents a single user from both creating a vendor and approving a payment, which would allow that user to commit fraud by setting up a fake vendor and authorizing a payment to it. By splitting these high-risk tasks between two or more people, the organization enforces a dual-control mechanism that reduces the risk of internal fraud without adding complex technical controls. This aligns with the security team's goal of reducing fraud while avoiding unnecessary complexity.

Answer

Job rotation, so employees periodically switch responsibilities to learn each other’s tasks.

Answer

Defense in depth, so multiple technical tools inspect every payment form.

Answer

Least privilege, so the payroll user can create and approve only this one vendor payment.

Question 4

Based on the exhibit, which control would most effectively reduce the remaining successful attacks?

Phishing awareness results:
Team A: click rate 8%, report rate 6%, median report time 52 min
Team B: click rate 7%, report rate 18%, median report time 14 min
Team C: click rate 12%, report rate 21%, median report time 10 min

Incident summary: Team C had one mailbox takeover after a user approved an MFA push while traveling.

Accepted Answer

Replace push-based MFA with phishing-resistant MFA and reinforce verification for unusual login prompts.. Team C's successful attack was a mailbox takeover resulting from a user approving an MFA push notification while traveling. This indicates that push-based MFA is vulnerable to MFA fatigue attacks, where an attacker bombards the user with prompts until they approve. Replacing push-based MFA with phishing-resistant MFA (e.g., FIDO2/WebAuthn or hardware tokens) eliminates the possibility of approving a prompt from an untrusted device, and reinforcing verification for unusual login prompts adds a critical user behavior layer to detect anomalies.

Answer

Continue generic awareness posters without changing technical controls.

Answer

Disable MFA on mobile devices so users can log in faster.

Answer

Allow employees to approve prompts from any device to reduce help desk calls.

Question 5

Based on the exhibit, what is the best improvement to reduce the impact if one backup server is compromised?

Accepted Answer

Store encryption keys in a centralized KMS or HSM and use distinct keys with rotation.. Using a centralized Key Management System (KMS) or Hardware Security Module (HSM) with distinct, rotated keys ensures that compromising one backup server does not expose the encryption keys for all backups. This isolates the impact to only the data encrypted with that specific key, and key rotation further limits the window of exposure. In contrast, sharing a single key file across servers creates a single point of failure, as compromising one server reveals the key for all backups.

Answer

Keep the same key file but rename it so attackers cannot find it easily.

Answer

Replace AES with SHA-256 so the backups are harder to read.

Answer

Email the key file to backup operators so they can restore data quickly.

Question 6

A company wants to reduce the chance that a stolen password can be used to access employee email. Which control is the best fit?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires at least two different authentication factors (e.g., something you know like a password and something you have like a time-based one-time password from an authenticator app). Even if an attacker steals the password, they cannot access the email without the second factor, directly reducing the risk of credential theft leading to account compromise.

Answer

Password complexity requirements only

Answer

Daily backup verification

Answer

Security awareness posters

Question 7

An employee receives a phone call from someone claiming to be IT and asking for a one-time verification code to "fix" the employee's account. What is the best response?

Accepted Answer

Refuse to share the code and report the call through the company's security process.. It follows the principle of never sharing authentication factors, especially one-time verification codes, with anyone over the phone. This scenario is a classic social engineering attack (vishing) where the attacker attempts to bypass multi-factor authentication (MFA) by tricking the employee into revealing a time-based one-time password (TOTP) or similar code. Reporting the call through the company's security process allows the incident to be investigated and mitigates further risk.

Answer

Provide the code quickly so the support call can be completed without delay.

Answer

Reply to the caller by email with the code and ask them to confirm receipt.

Answer

Change the password immediately and then tell the caller the new password.

Question 8

A company wants to detect unauthorized changes to production server configurations before users notice an outage. Which two controls best fit this goal? Select two.

Accepted Answer

File integrity monitoring on critical system files. File integrity monitoring (FIM) on critical system files is correct because it detects unauthorized changes by comparing current file hashes against a known-good baseline. When a change occurs, FIM generates an alert, enabling the security team to investigate before users notice an outage. This directly addresses the goal of detecting configuration tampering proactively.

Answer

Full-disk encryption on the server volumes

Answer

Multifactor authentication for remote administrators

Answer

Network segmentation between user VLANs and server VLANs

Question 9

An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?

Accepted Answer

Role-based access control, because permissions are assigned by job function and tied to named users.. Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.

Answer

Mandatory access control, because a central authority labels each expense report by sensitivity.

Answer

Discretionary access control, because individual employees decide who can approve expenses.

Answer

Rule-based access control, because approval rights are determined only by the time of day.

Question 10

A security manager wants to require that all company laptops use at least a 14-character password and lock after 10 minutes of inactivity. Which document should define these mandatory settings?

Accepted Answer

Standard, because it defines specific required technical values the company must follow.. A standard is the document type that defines mandatory, specific technical requirements, such as a minimum 14-character password length and a 10-minute inactivity lock. Policies are high-level statements of intent, while standards provide the enforceable, measurable parameters that implement that intent. In this scenario, the security manager needs a binding baseline, which is precisely the role of a standard.

Answer

Policy, because it is the broad statement of security intent only.

Answer

Guideline, because it gives optional recommendations for device security.

Answer

Memo, because it is the normal formal document for security baselines.

Question 11

Based on the exhibit, what additional control is the best fit?

Current controls on the finance share:
- SMB signing enabled
- Weekly access review
- Nightly backups to immutable storage
- Antivirus scans at 02:00

Incident: a valid VPN account was used to access 40,000 files in 8 minutes and copy them to a local drive.
Goal: detect unauthorized bulk access quickly before exfiltration completes.

Accepted Answer

Add file access auditing with alert thresholds forwarded to the SIEM.. File access auditing with alert thresholds forwarded to the SIEM directly addresses the goal of detecting unauthorized bulk access quickly. By monitoring for abnormal file access patterns—such as 40,000 files in 8 minutes—the SIEM can trigger an alert before exfiltration completes, enabling rapid response. This control complements the existing weekly access review by providing real-time detection.

Answer

Increase the backup schedule from nightly to hourly.

Answer

Rename the share to a less obvious name.

Answer

Disable SMB signing so the file transfer runs faster.

Question 12

Based on the exhibit, what is the best change to improve accountability without removing emergency access?

Accepted Answer

Require named accounts with role-based elevation through a privileged access workflow.. Implementing named accounts with role-based elevation through a privileged access workflow (PAW) ensures each administrator has a unique identity for auditing, while still allowing temporary privilege escalation for emergency tasks. This directly improves accountability by tying actions to specific users, unlike shared accounts which obscure individual responsibility. The workflow maintains emergency access by granting time-limited elevated permissions through an approval process, avoiding permanent standing privileges.

Answer

Keep the shared account and add more logging of the shared password.

Answer

Remove all command logging to protect administrator privacy.

Answer

Use a single shared account with a longer password and monthly rotation.

Question 13

An administrator needs to send sensitive configuration details to a remote branch office so only the branch manager can read them. Which cryptographic method is most appropriate?

Accepted Answer

Encrypting the file so only the intended recipient can decrypt it. Encrypting the file with the branch manager's public key ensures that only the manager, possessing the corresponding private key, can decrypt and read the sensitive configuration details. This asymmetric encryption method directly addresses the requirement of confidentiality and targeted recipient access, unlike hashing or simple labeling.

Answer

Hashing the file before sending it

Answer

Using a checksum printed in the email subject line

Answer

Appending the word confidential to the file name

Question 14

Match each control type to the example that best fits it.

Accepted Answer

Preventive: A firewall that blocks unauthorized traffic. Preventive controls block incidents, detective controls identify them, corrective controls restore after incidents, deterrent controls discourage attacks, compensating controls provide alternative measures, and directive controls mandate behaviors.

Answer

Preventive: A warning sign that deters intruders

Answer

Corrective: An IDS that detects an intrusion

Question 15

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.