SY0-701 General Security Concepts Practice Test 9 — 15 Questions

Question 1

A systems administrator downloads a patch and a SHA-256 checksum file from the vendor. The administrator hashes the patch locally and the values match. What does the matching hash primarily confirm?

Accepted Answer

The file has not been altered since the vendor published the checksum.. A SHA-256 checksum is a cryptographic hash that acts as a fingerprint for the file. When the locally computed hash matches the vendor-published checksum, it confirms the file's integrity — that the patch has not been modified or corrupted since the vendor generated the checksum. This does not verify confidentiality, authenticity of the signer, or installation success.

Answer

The file remains confidential during transmission.

Answer

The vendor's private key was used to encrypt the patch.

Answer

The patch will definitely install successfully on every system.

Question 2

A contractor is assigned to a single merger project. The manager approves access to only the project share and the project chat space, even though the contractor technically could use other collaboration tools. Which principle is most directly reflected?

Accepted Answer

Need-to-know. The correct answer is A, need-to-know, because the manager restricts the contractor's access to only the project share and project chat space, even though the contractor could technically use other collaboration tools. Need-to-know is a principle that limits access to information or resources strictly required for an individual's job duties, regardless of their clearance or technical capability. In this scenario, the contractor is given access only to the specific resources necessary for the merger project, directly reflecting the need-to-know principle.

Answer

Least privilege

Answer

Integrity

Answer

Zero trust

Question 3

Match each control category to the best example.

Question 4

A legal department needs a contract file that can later prove who signed it and whether the content changed after signing. Which cryptographic mechanism should be used?

Accepted Answer

Digital signature. A digital signature provides non-repudiation, ensuring the signer cannot deny signing the document, and integrity, detecting any changes after signing. It uses asymmetric cryptography where the signer's private key creates the signature, and the public key verifies it, making it the correct choice for proving both identity and content integrity.

Answer

Symmetric encryption

Answer

Hashing

Answer

Tokenization

Question 5

Based on the exhibit, what should the administrator do next?

Accepted Answer

Re-download the update from the trusted source and verify the hash again.. Option B is correct because if the hash of a downloaded file does not match the vendor-published hash, the file is likely corrupted or tampered with. The administrator should delete the corrupted file, re-download it from the trusted source, and recompute the hash to ensure integrity before installation. This follows the principle of verifying file integrity via cryptographic hashing (e.g., SHA-256) before applying updates.

Answer

Install the update because a longer hash means the file is newer.

Answer

Rename the file to match the vendor’s naming convention and retry installation.

Answer

Disable SHA-256 verification because patch files often change after download.

Question 6

Match each control type to the best description.

Question 7

A help desk lead notices that several support technicians have broad administrator access across every department's systems so they can resolve tickets faster. After a phishing incident, management wants to reduce the damage if one technician account is compromised. What is the best security principle to apply when redesigning access?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. By applying least privilege, each technician would receive access only to the specific systems and resources required for their role, rather than broad administrator access across all departments. This containment directly limits the blast radius of a compromised account, preventing an attacker from moving laterally to other departmental systems.

Answer

Defense in depth

Answer

Need-to-know

Answer

Zero trust

Question 8

Match each PKI term to what it does.

Question 9

Based on the exhibit, which security principle does the organization appear to be using most clearly?

Accepted Answer

Defense in depth, because several different controls stop or limit the attack at different stages.. The exhibit shows multiple security controls—an email filter blocking the attachment, a web filter blocking the download link, and an endpoint detection and response (EDR) tool blocking execution—each acting at a different stage of the attack chain. This layered approach, where no single control is relied upon to stop the threat, is the hallmark of defense in depth. The correct answer is B because the scenario clearly demonstrates overlapping controls that provide redundancy and mitigate risk at various points.

Answer

Zero trust, because all access is denied until a user proves identity again.

Answer

Least privilege, because the attachment was blocked from having administrator rights.

Answer

Need-to-know, because only the security team should be aware of the incident.

Question 10

Match each principle to the workplace scenario.

Question 11

A finance application stores approval records for wire transfers. Auditors need to prove which employee approved each transfer, and employees must not be able to deny their approval later. Which security objective is best addressed by binding each approval to an individual identity and preserving immutable logs?

Accepted Answer

Nonrepudiation, because the organization needs proof that a specific person performed the approval.. Nonrepudiation ensures that an action cannot be denied by the person who performed it. By binding each approval to a unique employee identity and preserving immutable logs, the organization can irrefutably prove who approved each wire transfer, preventing employees from later denying their approval. This directly addresses the requirement for accountability and proof of action.

Answer

Confidentiality, because the approval records should be hidden from everyone except finance staff.

Answer

Availability, because the approval system must remain online during business hours.

Answer

Integrity, because the record must never be changed after it is saved.

Question 12

After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?

Accepted Answer

The root CA certificate for the new PKI to trusted endpoint stores.. The correct answer is B because the root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.

Answer

The portal's private key so users can validate the certificate locally.

Answer

A new certificate signing request on each endpoint.

Answer

A self-signed certificate on the portal to avoid future CA problems.

Question 13

A company requires MFA, endpoint protection, and network filtering so that if one control misses a threat, another control still helps stop it. Which security principle is this?

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple, independent controls (e.g., MFA, endpoint protection, network filtering) are deployed so that if one layer fails, another still provides protection. This ensures no single point of failure can compromise the entire system, directly matching the scenario where overlapping controls compensate for each other's gaps.

Answer

Single sign-on

Answer

Nonrepudiation

Answer

Data masking

Question 14

Your company is syncing design files to a cloud object store. The security team wants to reduce risk if the storage account is stolen and also protect the files while they travel across the internet. Which approach is the best fit?

Accepted Answer

Encrypt data in transit with TLS and enable encryption at rest with managed keys.. Option B is correct because it addresses both risks: TLS (Transport Layer Security) encrypts data in transit, preventing interception or tampering during upload, while managed keys for encryption at rest protect the files if the storage account credentials are compromised. This dual-layer approach aligns with defense-in-depth and is a standard best practice for cloud object stores like Amazon S3 or Azure Blob Storage.

Answer

Password-protect each archive and upload it over plain HTTP.

Answer

Rename the files before upload so attackers cannot identify them.

Answer

Place the storage service on a private IP address and skip encryption.

Question 15

An operations manager is worried a single network administrator could quietly push an unauthorized firewall rule. The manager wants every rule change reviewed by a second person and documented before implementation. Which control best addresses this concern?

Accepted Answer

Require a documented change-management workflow with two approvers before any firewall rule is applied.. Option B is correct because a documented change-management workflow with two approvers directly enforces separation of duties, ensuring that no single administrator can implement a firewall rule change without peer review and documented approval. This control addresses the manager's concern about unauthorized changes by requiring a second person to review and approve before the rule is applied, which is a fundamental principle of access control and change management.

Answer

Enable detailed firewall logging so each packet match is written to disk.

Answer

Move the firewall appliance into a locked equipment rack.

Answer

Encrypt the firewall configuration backup with a strong key.