SY0-701 General Security Concepts Practice Test 5 — 15 Questions

Question 1

A legacy payroll server has a critical patch available, but the business cannot reboot it for 45 days. The team isolates the server to only the payroll application subnet and requires written approval before any temporary firewall exception is made. Which two control types are present? Select two.

Accepted Answer

Compensating control, because the temporary network restriction offsets the delayed patch.. Option A is correct because isolating the server to the payroll subnet is a compensating control that reduces risk by restricting network access, offsetting the inability to apply the critical patch immediately. This temporary measure provides an alternative security layer until the patch can be installed and the server rebooted.

Answer

Detective control, because a rule set later identifies malicious traffic.

Answer

Corrective control, because the control repairs the vulnerable software itself.

Answer

Deterrent control, because a warning banner discourages misuse of the server.

Question 2

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.

Question 3

Match each control type to the most fitting example in a branch office.

Question 4

Based on the exhibit, what change would best protect the password database against precomputed attacks and make identical passwords less obvious?

Accepted Answer

Add a unique salt to each password before hashing it.. Adding a unique salt to each password before hashing ensures that even if two users have the same password, their hashes will differ. This defeats precomputed attacks like rainbow tables because the attacker would need to compute a separate table for each salt value, which is computationally infeasible. Salting is a standard defense recommended by NIST SP 800-63B and implemented in modern systems like bcrypt, scrypt, and PBKDF2.

Answer

Encrypt each password with the same server key before storing it in the database.

Answer

Use a digital signature on each password record so the database can verify authenticity.

Answer

Store the password hashes in uppercase so attackers cannot compare them easily.

Question 5

Based on the exhibit, what control type is the file integrity monitor providing?

Accepted Answer

Detective control, because the tool identifies the unauthorized change and alerts the SOC.. A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.

Answer

Preventive control, because the file monitor stopped the change from occurring.

Answer

Corrective control, because the monitor automatically fixed the configuration after the change.

Answer

Directive control, because the alert tells administrators what they should review next.

Question 6

Based on the exhibit, which security principle is the proposed access model most aligned with?

Accepted Answer

Zero trust, because access is continuously evaluated instead of trusted just because the device is on the VPN.. The proposed access model aligns with Zero Trust because it continuously evaluates access based on real-time conditions (e.g., device posture, user identity) rather than implicitly trusting the VPN connection. In Zero Trust, network location alone is insufficient for granting access; every request is authenticated and authorized regardless of the source. This contrasts with traditional perimeter-based models where VPN access implies trust.

Answer

Least privilege, because users are being limited to only the finance application they need.

Answer

Defense in depth, because the company is adding multiple security layers around the finance app.

Answer

Need-to-know, because users should only see the finance data required for their jobs.

Question 7

An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 8

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

Accepted Answer

Hash the passwords with a unique salt for each account.. Option B is correct because hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Answer

Store the passwords in plain text so users can recover them easily.

Answer

Encrypt the passwords and keep the decryption key in the same database.

Answer

Compress the passwords before storing them to make them smaller.

Question 9

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

Accepted Answer

A digital signature from the vendor. A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Answer

A longer filename with the vendor name in it

Answer

A larger file size than the previous update

Answer

A password protected ZIP file

Question 10

To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

Accepted Answer

Separation of duties. The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 11

Match each security principle to the best workplace example.

Question 12

A cloud backup service uses envelope encryption. The key-encryption key is nearing the end of its approved lifetime, but the business cannot decrypt and re-encrypt every backup object this week. Which two statements best describe the correct rotation approach? Select two.

Accepted Answer

Generate a new key-encryption key and use it for future backups.. Option A is correct because envelope encryption allows the key-encryption key (KEK) to be rotated without touching the underlying data. Generating a new KEK and using it for future backups ensures that new data-encryption keys (DEKs) are wrapped with the fresh KEK, maintaining security without requiring immediate decryption and re-encryption of all existing backup objects.

Answer

Decrypt and re-encrypt every backup object immediately with a new data key.

Answer

Destroy the old key before the rewrapping process finishes.

Answer

Replace the hashing algorithm used for file integrity checks.

Question 13

In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.

Accepted Answer

Separation of duties, because creation and approval are split between different roles.. Option A is correct because separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.

Answer

Least privilege, because every user should have no more than one permission overall.

Answer

Defense in depth, because multiple security technologies are layered around the finance system.

Answer

Zero trust, because the employee must always be treated as untrusted by the network.

Question 14

Based on the exhibit, which control type best describes the jump host requirement?

Accepted Answer

Compensating control, because the jump host provides an alternate safeguard when the application cannot enforce MFA directly.. The jump host is implemented as a compensating control because the payroll server's application cannot natively enforce multi-factor authentication (MFA). Instead of leaving the server unprotected, the jump host provides an alternative security layer by requiring MFA at the jump host level, thereby compensating for the application's limitation. This aligns with the NIST definition of compensating controls as alternative safeguards that mitigate risks when primary controls are infeasible.

Answer

Preventive control, because the jump host blocks unauthorized access before it reaches the payroll server.

Answer

Detective control, because session recording helps the team discover misuse after the fact.

Answer

Directive control, because the administrators are being instructed to use a specific access path.

Question 15

A vendor distributes a Linux package through multiple mirrors. Security wants to verify that the package really came from the vendor and was not altered after publication, even if a mirror or CDN is compromised. Which cryptographic mechanism should be checked?

Accepted Answer

A digital signature created with the vendor's private key. A digital signature created with the vendor's private key provides both authentication (proving the package came from the vendor) and integrity (detecting any alteration after signing). Even if a mirror or CDN is compromised, the signature verification will fail if the package has been tampered with, because only the vendor's corresponding public key can validate the signature. This is the standard mechanism used by package managers like APT (with signed Release files) and RPM (with GPG signatures).

Answer

A hash value published on the mirror site alone

Answer

Symmetric encryption of the package with a shared secret

Answer

Key stretching with a slow password algorithm