SY0-701 General Security Concepts Practice Test 6 — 15 Questions

Question 1

Based on the exhibit, which cryptographic mechanism provides proof that the update came from the vendor and was not altered?

Accepted Answer

Digital signature, because only the vendor's private key can produce the verified signature.. Option C is correct because a digital signature uses the vendor's private key to sign the update, and the customer verifies it using the vendor's public key. This asymmetric cryptographic mechanism ensures both authenticity (the update came from the vendor) and integrity (the update was not altered), as only the vendor's private key can produce a signature that validates with the corresponding public key.

Answer

Hashing, because matching SHA-256 values alone prove the file came from the vendor.

Answer

Symmetric encryption, because only the vendor and the customer share the secret key.

Answer

Salting, because adding random data makes the update file easier to trust.

Question 2

Match each security control type to the best example in a small office environment.

Question 3

Match each cryptographic action to the most appropriate use case.

Question 4

A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.

Accepted Answer

Least privilege, because the contractor receives only the access needed for one investigation.. Least privilege is applied because the contractor's access is strictly limited to what is necessary for the single investigation: read-only access to one log source via a jump host, with the account expiring automatically at shift end. This ensures the contractor cannot perform any actions beyond the scope of the task, minimizing the attack surface and potential for accidental or malicious changes.

Answer

Separation of duties, because one person cannot both request and approve the access.

Answer

Defense in depth, because multiple layers of security tools are deployed around the server.

Answer

Zero trust, because every request is automatically denied until proven safe.

Question 5

Match each access principle to the best description.

Question 6

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Accepted Answer

Zero trust. The scenario describes a system that continuously verifies trust—checking device health at sign-in and re-evaluating both device and user context before each high-value action—and blocks access even when the password is valid. This is the core of Zero Trust: 'never trust, always verify,' where authentication and authorization are re-assessed at every transaction, not just at session start. The policy enforces access decisions based on real-time posture (e.g., device compliance, user behavior) rather than relying solely on a static credential.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 7

A small company wants all employees to lock their screens after 10 minutes of inactivity, and the rule is included in the formal security policy. What type of control is this?

Accepted Answer

Directive control, because it tells users what behavior is required.. A directive control is designed to guide or mandate user behavior through policies or procedures. In this case, the security policy explicitly requires employees to lock their screens after 10 minutes of inactivity, which is a directive that tells users what they must do. This is a procedural control, not a technical enforcement mechanism, so it falls under directive controls.

Answer

Detective control, because it discovers misuse after it happens.

Answer

Corrective control, because it repairs damage after an incident.

Answer

Compensating control, because it replaces a missing technical safeguard.

Question 8

A company uses an encryption key for a database backup process. The key is being replaced because the old one is near the end of its approved use period. What is this action called?

Accepted Answer

Key rotation, because an older key is replaced with a new one on schedule.. Key rotation is the scheduled replacement of an older encryption key with a new one, typically performed before the end of the key's cryptoperiod to maintain security and compliance. In this scenario, the database backup key is being replaced because it is near the end of its approved use period, which directly matches the definition of key rotation. This practice limits the amount of data encrypted with a single key and reduces the impact of a potential key compromise.

Answer

Key compression, because the key is made smaller before use.

Answer

Key translation, because the key is converted into another language.

Answer

Key formatting, because the key is stored in a different file type.

Question 9

A user database is stolen from a SaaS portal. Investigators discover the password column contains the same value for every user who chose "Summer2026!", and an attacker could use precomputed tables to crack weak passwords quickly. Which change best addresses both the repeated-value issue and rainbow-table risk?

Accepted Answer

Store each password with a unique salt and an adaptive hash such as bcrypt or Argon2. Option C is correct because using a unique salt per password ensures that even if two users choose the same password (e.g., 'Summer2026!'), their stored hashes will differ, eliminating the repeated-value issue. Additionally, adaptive hash functions like bcrypt or Argon2 are computationally expensive, making precomputed rainbow tables infeasible even if the salts were known, as each guess requires re-hashing with the specific salt.

Answer

Encrypt all stored passwords with AES and keep one shared key

Answer

Use SHA-256 without a salt

Answer

Add a digital signature to each password record

Question 10

Based on the exhibit, which security principle is the proposed workflow most directly enforcing?

Accepted Answer

Separation of duties, because no single person can create, approve, and implement the same production change.. The proposed workflow enforces separation of duties by requiring three distinct roles—requester, approver, and implementer—to complete a single firewall change. No single person can both create and approve the change, nor can they implement it without prior approval. This directly prevents any one individual from having end-to-end control over a production change, which is the core of separation of duties.

Answer

Least privilege, because each person gets only the minimum access needed for the task.

Answer

Defense in depth, because multiple layers of security are added around firewall changes.

Answer

Need-to-know, because the ticket is visible only to assigned people.

Question 11

A hybrid cloud portal first checks device health at the identity provider, then requires MFA, then enforces a per-application authorization decision before each sensitive action. Network access is also limited by a gateway, and a WAF sits in front of the app. Which two principles are best demonstrated? Select two.

Accepted Answer

Zero trust, because access is continuously verified instead of assumed after one login.. Option A is correct because the scenario describes continuous verification of device health, MFA, and per-application authorization before each sensitive action, which aligns with the Zero Trust principle of 'never trust, always verify.' Unlike traditional perimeter-based security, Zero Trust assumes no implicit trust after initial authentication and requires ongoing validation at every access attempt.

Answer

Least privilege, because users are granted no access at all until the app is offline.

Answer

Separation of duties, because administrators and users must approve each other's actions.

Answer

Need-to-know, because the system hides all information until the user requests it.

Question 12

A company uses MFA, endpoint protection, firewalls, and network segmentation together to protect a customer portal. Which security principle does this best illustrate?

Accepted Answer

Defense in depth, because multiple layers protect the same asset.. Defense in depth is the correct principle because the company is deploying multiple, overlapping security controls—MFA, endpoint protection, firewalls, and network segmentation—to protect the same customer portal. This layered approach ensures that if one control fails (e.g., a firewall rule is misconfigured), other controls (e.g., endpoint detection or segmentation) still provide protection, reducing the overall risk of a single point of compromise.

Answer

Need-to-know, because users only see the data assigned to them.

Answer

Separation of duties, because no single person performs every security task.

Answer

Zero trust, because the portal is hosted in the cloud.

Question 13

A company stores application passwords in a database that could be stolen during a breach. The team wants to prevent attackers from using precomputed tables and also make identical passwords produce different stored values. Which two changes should be implemented? Select two.

Accepted Answer

Use a unique random salt for every password before hashing.. A unique random salt ensures that even if two users have the same password, their stored hashes differ because the salt is combined with the password before hashing. This prevents attackers from using precomputed rainbow tables, as each salt forces a separate table to be generated. Salting does not slow down the hash itself, but it eliminates the efficiency of precomputed attacks.

Answer

Encrypt each password with a single symmetric key and store the key in the database.

Answer

Add a digital signature to each stored password so users can verify it.

Answer

Hash all passwords with the same unsalted SHA-256 value.

Question 14

A help desk technician needs temporary access to read one shared folder to troubleshoot a printer issue. Which access choice best follows least privilege?

Accepted Answer

Give the technician read-only access to the single shared folder needed for the ticket.. Option B is correct because it grants the technician only the minimum permissions (read-only) to the specific resource (single shared folder) required to troubleshoot the printer issue. This adheres to the principle of least privilege by limiting access scope and duration, reducing the risk of unauthorized changes or data exposure.

Answer

Grant the technician full control of the entire file server for one day.

Answer

Add the technician to the domain admins group until the issue is resolved.

Answer

Allow the technician to use any account in the department for convenience.

Question 15

Based on the exhibit, what control type is the automated reapplication of the baseline?

Accepted Answer

Corrective control, because the MDM agent restores the approved baseline after the unauthorized change is found.. The automatic reapplication of the approved firewall baseline is a corrective control because it fixes a configuration that drifted away from the secure standard. The user was able to make the change, so the control was not preventive. The MDM system then returned the device to its approved state, which is the defining behavior of correction rather than simple detection or deterrence.

Why others are wrong: The user change was already allowed to happen, so the control was not preventive. The log shows an automatic restoration, not just an alert, so it is more than detective. A deterrent would merely discourage changes through warnings or visibility. The key evidence is the platform's automatic rollback to the approved baseline after the deviation was found.

Answer

Preventive control, because the system prevented the user from changing the firewall profile at all.

Answer

Detective control, because the help desk can review the event later.

Answer

Deterrent control, because the policy baseline discourages users from making changes.

SY0-701 General Security Concepts Practice Test 6 — 15 Questions

Exhibit

SY0-701 General Security Concepts Practice Test 6 — 15 Questions

Exhibit