SY0-701 General Security Concepts Practice Test 6 — 15 Questions

Question 1

After several unauthorized edits to firewall objects caused a production outage, a security team wants one control that will flag future configuration drift and another that will automatically restore the approved baseline before the next maintenance window. Which two controls best meet that goal? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File integrity monitoring on firewall configuration files and rule exports.. File integrity monitoring (FIM) on firewall configuration files and rule exports (Option A) detects unauthorized changes by computing cryptographic hashes of baseline files and alerting on any deviation. This directly flags configuration drift, meeting the first requirement. Automated configuration management (Option B) can reapply the approved baseline from a version-controlled repository, restoring the correct state before the next maintenance window, satisfying the second requirement.

Answer

A login banner warning administrators that unauthorized changes are monitored.

Answer

Mandatory annual security awareness training for all IT staff.

Answer

Quarterly business impact reviews of the firewall change log.

Question 2

Match each control type to the most fitting example in a branch office.

Accepted Answer

Preventive: Requiring keycard access to the server room. Preventive controls block incidents; detective controls identify them; corrective controls restore operations; deterrent controls discourage attacks; compensating controls provide alternative protection; physical controls secure physical access.

Answer

Detective: Requiring keycard access to the server room

Answer

Corrective: Placing visible security cameras in the lobby

Question 3

Based on the exhibit, what change would best protect the password database against precomputed attacks and make identical passwords less obvious?

Accepted Answer

Add a unique salt to each password before hashing it.. Adding a unique salt to each password before hashing ensures that even if two users have the same password, their hashes will differ. This defeats precomputed attacks like rainbow tables because the attacker would need to compute a separate table for each salt value, which is computationally infeasible. Salting is a standard defense recommended by NIST SP 800-63B and implemented in modern systems like bcrypt, scrypt, and PBKDF2.

Answer

Encrypt each password with the same server key before storing it in the database.

Answer

Use a digital signature on each password record so the database can verify authenticity.

Answer

Store the password hashes in uppercase so attackers cannot compare them easily.

Question 4

Based on the exhibit, what control type is the file integrity monitor providing?

Accepted Answer

Detective control, because the tool identifies the unauthorized change and alerts the SOC.. A file integrity monitor (FIM) operates by comparing current file hashes against a known good baseline. When it detects a hash mismatch, it generates an alert to the Security Operations Center (SOC). This is a detective control because it identifies and reports the unauthorized change after it has occurred, rather than preventing or automatically correcting it.

Answer

Preventive control, because the file monitor stopped the change from occurring.

Answer

Corrective control, because the monitor automatically fixed the configuration after the change.

Answer

Directive control, because the alert tells administrators what they should review next.

Question 5

An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 6

A security team stores employee passwords in a database. Which method best protects the passwords if the database is stolen?

Accepted Answer

Hash the passwords with a unique salt for each account.. Hashing with a unique salt per account ensures that even if two users have the same password, their hashes will differ, and precomputed rainbow table attacks are rendered ineffective. The salt is stored alongside the hash, but the one-way nature of the hash function means an attacker cannot reverse the hash to recover the original password without performing an expensive brute-force search for each salted hash individually.

Answer

Store the passwords in plain text so users can recover them easily.

Answer

Encrypt the passwords and keep the decryption key in the same database.

Answer

Compress the passwords before storing them to make them smaller.

Question 7

A user downloads a company software update and wants to verify it really came from the vendor and was not changed in transit. Which cryptographic feature should they check?

Accepted Answer

A digital signature from the vendor. A digital signature from the vendor provides cryptographic proof of both authenticity (the file originated from the claimed vendor) and integrity (the file has not been altered in transit). The vendor signs the file with their private key, and the user verifies the signature using the vendor's public key; if the signature is valid, the file is genuine and unchanged.

Answer

A longer filename with the vendor name in it

Answer

A larger file size than the previous update

Answer

A password protected ZIP file

Question 8

To reduce fraud, a finance system requires one user to create a payment batch, a different user to approve it, and a third role to release it to the bank. An audit recommends adding a "super-user" who can perform all three steps to speed month-end close. Which principle would that recommendation most directly weaken?

Accepted Answer

Separation of duties. The recommendation to create a super-user who can create, approve, and release payment batches directly violates the separation of duties principle. This principle requires that critical tasks be divided among multiple individuals to prevent any single person from having the ability to commit fraud without collusion. By allowing one user to perform all three steps, the system loses the fraud-prevention control that requires independent actors for each stage of the payment lifecycle.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 9

Match each security principle to the best workplace example.

Accepted Answer

Least privilege: A user is given access only to files needed for their job.. Each workplace example illustrates a security principle: least privilege grants minimal access, separation of duties divides tasks, defense in depth uses multiple controls, fail safe defaults to safe state, need to know restricts data access, and accountability tracks user actions.

Answer

Least privilege: Two employees must approve a payment.

Answer

Defense in depth: A user is given access only to files needed for their job.

Question 10

In the finance workflow, one employee can create a payment batch but cannot approve it, and the same person also cannot view employee records that are unrelated to the task. Which two principles are being enforced? Select two.

Accepted Answer

Separation of duties, because creation and approval are split between different roles.. Separation of duties is enforced by splitting the payment creation and approval functions between different roles, preventing a single employee from committing fraud by creating and approving a payment without oversight. This principle reduces the risk of unauthorized or malicious actions by requiring collusion for abuse.

Answer

Least privilege, because every user should have no more than one permission overall.

Answer

Defense in depth, because multiple security technologies are layered around the finance system.

Answer

Zero trust, because the employee must always be treated as untrusted by the network.

Question 11

Based on the exhibit, which control type best describes the jump host requirement?

Accepted Answer

Compensating control, because the jump host provides an alternate safeguard when the application cannot enforce MFA directly.. The jump host is implemented as a compensating control because the payroll server's application cannot natively enforce multi-factor authentication (MFA). Instead of leaving the server unprotected, the jump host provides an alternative security layer by requiring MFA at the jump host level, thereby compensating for the application's limitation. This aligns with the NIST definition of compensating controls as alternative safeguards that mitigate risks when primary controls are infeasible.

Answer

Preventive control, because the jump host blocks unauthorized access before it reaches the payroll server.

Answer

Detective control, because session recording helps the team discover misuse after the fact.

Answer

Directive control, because the administrators are being instructed to use a specific access path.

Question 12

A vendor distributes a Linux package through multiple mirrors. Security wants to verify that the package really came from the vendor and was not altered after publication, even if a mirror or CDN is compromised. Which cryptographic mechanism should be checked?

Accepted Answer

A digital signature created with the vendor's private key. A digital signature created with the vendor's private key provides both authentication (proving the package came from the vendor) and integrity (detecting any alteration after signing). Even if a mirror or CDN is compromised, the signature verification will fail if the package has been tampered with, because only the vendor's corresponding public key can validate the signature. This is the standard mechanism used by package managers like APT (with signed Release files) and RPM (with GPG signatures).

Answer

A hash value published on the mirror site alone

Answer

Symmetric encryption of the package with a shared secret

Answer

Key stretching with a slow password algorithm

Question 13

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

Accepted Answer

Digital signature, because only the vendor's private key can produce the verified signature.. A digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Answer

Hashing, because matching SHA-256 values alone prove the file came from the vendor.

Answer

Symmetric encryption, because only the vendor and the customer share the secret key.

Answer

Salting, because adding random data makes the update file easier to trust.

Question 14

Match each security control type to the best example in a small office environment.

Accepted Answer

Administrative: Security awareness training policy. These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.

Answer

Administrative: Firewall

Answer

Physical: Security awareness training policy

Question 15

Match each cryptographic action to the most appropriate use case.

Accepted Answer

Encryption: Ensuring confidentiality. Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Answer

Key Exchange: Ensuring integrity

Answer

Random Number Generation: Providing authentication