SY0-701 General Security Concepts — Timed 30 Questions

Question 1

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

Accepted Answer

Integrity. The script computes SHA-256 hashes of configuration files and compares them nightly to detect any unauthorized or accidental changes. This directly protects the integrity of the files by ensuring they have not been modified, which is the core security goal of integrity. Confidentiality and availability are not addressed by hash comparison.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 2

A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?

Accepted Answer

Separation of duties. Requiring two different system administrators to approve and execute changes to the core transaction processing database enforces separation of duties. This principle ensures that no single individual has the authority to perform both the approval and execution steps, reducing the risk of fraud, error, or unauthorized modifications. In a financial institution, this is critical for maintaining the integrity of transaction data and complying with regulatory standards like SOX or PCI DSS.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 3

A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?

Accepted Answer

Defense in depth. The architect is implementing defense in depth by layering multiple independent security controls—a next-generation firewall (NGFW) at the perimeter, an intrusion prevention system (IPS) on the internal network, mandatory multi-factor authentication (MFA) for remote access, and quarterly security awareness training. The key phrase 'independent of each other so that a failure in any single control does not leave the entire network unprotected' directly describes the principle of layered defenses, where no single point of failure compromises overall security. This approach ensures that if an attacker bypasses the NGFW, the IPS or MFA may still prevent or detect the breach.

Answer

Least privilege

Answer

Zero trust

Answer

Separation of duties

Question 4

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this case, nursing staff only need read and write access to records of currently assigned patients, but membership in the 'Administrators' group grants full read/write access to all patient records and the ability to modify system configuration settings, which far exceeds their job requirements. This directly violates least privilege by providing excessive, unnecessary privileges that increase the risk of unauthorized access or accidental misconfiguration.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Availability

Question 5

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is the correct choice because it enforces access decisions based on security labels (e.g., classification levels) and user clearances, which are centrally managed and cannot be overridden by users or administrators. In this scenario, the system must strictly enforce that a user's clearance level matches or exceeds the document's classification label, and administrators cannot modify these rules or elevate their own access—a core property of MAC systems like SELinux or those implementing Bell-LaPadula.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 6

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

Accepted Answer

Integrity. Restoring the altered customer account balance records from a verified read-only backup directly addresses the integrity security goal. Integrity ensures that data is accurate and has not been modified by unauthorized parties. By reverting the records to their pre-attack state, the analyst is correcting the unauthorized modifications, thereby restoring the trustworthiness of the data.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 7

A software vendor distributes critical security updates for its application through a public download website. The vendor wants to allow customers to verify that each update originated from the vendor and has not been modified in transit. Which of the following cryptographic techniques should the vendor apply to the update files before posting them for download?

Accepted Answer

Digital signature. A digital signature provides both authentication (proving the update originated from the vendor) and integrity (detecting any modification in transit). The vendor signs the file with their private key, and customers verify the signature using the vendor's public key, ensuring the file has not been altered since signing.

Answer

Cryptographic hash

Answer

Antivirus scan report

Answer

TLS certificate

Question 8

A financial institution is implementing a new policy for all remote access to its payment processing system. The system will generate a unique digital signature for each administrative action, and all actions will be recorded in a tamper-evident audit log that is replicated to an immutable storage location. The primary objective of this policy is to ensure that administrators who perform sensitive operations cannot later deny having executed them. Which security goal is this policy primarily intended to enforce?

Accepted Answer

Non-repudiation. The policy's use of unique digital signatures for each administrative action, combined with a tamper-evident audit log replicated to immutable storage, directly enforces non-repudiation. Non-repudiation ensures that an administrator cannot deny having performed a specific action because the digital signature cryptographically binds the action to the administrator's identity, and the immutable log prevents any subsequent alteration or deletion of the record. This is the primary security goal when the objective is to prevent denial of responsibility for sensitive operations.

Answer

Authorization

Answer

Authentication

Answer

Availability

Question 9

A security auditor is reviewing the access controls for a payroll application. The auditor discovers that a single user, the payroll manager, has permissions to both create new employee records and then approve and process salary payments for those records. The company's security policy requires that no single individual should be able to execute both the creation and the approval of a payment for the same employee. Which of the following security principles is the company's policy attempting to enforce?

Accepted Answer

Separation of duties. The company's policy prohibits a single user from both creating employee records and approving payments for them, which is a classic application of separation of duties. This principle ensures that no single individual has the authority to execute two conflicting or sensitive tasks that could lead to fraud or error, such as creating a fictitious employee and then approving a salary payment to that employee. In the context of a payroll application, separation of duties requires distinct roles or users for record creation and payment approval to enforce checks and balances.

Answer

Least privilege

Answer

Defense in depth

Answer

Mandatory access control

Question 10

A security architect is designing a defense strategy for a database containing sensitive customer records. The architect implements a network firewall to restrict inbound traffic to only the application server, enforces file-level encryption for the database files, requires multi-factor authentication for all administrative access, and deploys a database activity monitoring system to alert on unusual queries. Which security principle is the architect primarily applying?

Accepted Answer

Defense in depth. The architect is applying defense in depth by layering multiple independent security controls: a network firewall, file-level encryption, multi-factor authentication, and database activity monitoring. This strategy ensures that if one control fails, others still provide protection, which is the core principle of defense in depth. Each layer addresses a different attack vector, making it significantly harder for an attacker to compromise the database.

Answer

Least privilege

Answer

Separation of duties

Answer

Fail safe

Question 11

A company is enhancing its network security posture. The security team deploys a system that passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts when suspicious patterns are detected. This system does not actively block or modify any traffic. Which type of security control does this system BEST represent?

Accepted Answer

Detective control. This system is a detective control because it passively monitors network traffic, analyzes packets for signs of malicious activity, and generates alerts without actively blocking or modifying traffic. Detective controls are designed to identify and report security incidents after they occur or as they happen, which aligns with the described behavior of an Intrusion Detection System (IDS). Unlike preventive controls, it does not enforce policy or stop threats in real time.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 12

A company wants one document that tells employees what they are required to do when handling company systems and data. Which document type is the best fit?

Accepted Answer

Policy, because it states the required rules and expectations for everyone.. A policy is the correct document type because it defines mandatory rules and expectations for all employees regarding the handling of company systems and data. Unlike guidelines or standards, a policy is enforceable and sets the required behavior, making it the best fit for a single document that tells employees what they must do.

Answer

Procedure, because it always defines the highest-level mandatory rules.

Answer

Guideline, because it provides optional suggestions for best behavior.

Answer

Standard, because it contains only optional advice about security.

Question 13

After a user signs in, a file server checks whether they can edit a shared folder. Which AAA concept is being applied?

Accepted Answer

Authorization. The file server is checking whether the authenticated user has the specific permission to edit the shared folder. This is the definition of authorization: determining what an authenticated user is allowed to do. Authentication (A) only verifies identity, not rights; accounting (C) tracks usage; encryption (D) protects data in transit or at rest.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 14

A legal team must send a confidential contract to a partner so only the intended recipient can read it, and the partner also needs assurance the file really came from your company. Which approach best meets both needs?

Accepted Answer

Encrypt the file with the recipient's public key and sign it with the sender's private key.. Option B is correct because it uses asymmetric encryption to ensure confidentiality (encrypting with the recipient's public key ensures only the intended recipient can decrypt it with their private key) and digital signing (signing with the sender's private key provides non-repudiation and authenticity, proving the file came from the sender). This combination directly addresses both requirements: only the partner can read the contract, and the partner can verify the sender's identity.

Answer

Hash the contract and email the hash value separately.

Answer

Use a shared symmetric key and send the key in the same email message.

Answer

Compress the file and password-protect the archive with a simple passphrase.

Question 15

Which two statements describe authorization? Select two.

Accepted Answer

It determines what a user can access after sign-in. Authorization determines the resources and actions a user can access after successful authentication. It enforces access control policies, such as those defined by RBAC or ACLs, ensuring users only interact with permitted data or systems. This aligns with the NIST definition of authorization as the process of granting or denying rights to a user.

Answer

It proves a user is who they claim to be

Answer

It records every packet a device sends

Answer

It replaces the need for authentication

Question 16

A restricted server room opens only with a badge, and an alarm sounds if the door is left open too long. Which control type is the alarm?

Accepted Answer

Detective control. The alarm is a detective control because it detects and alerts when a door is left open too long, indicating a potential security breach. It does not prevent the door from being opened or correct the situation; it simply notifies personnel of an ongoing or past violation.

Answer

Preventive control

Answer

Corrective control

Answer

Deterrent control

Question 17

Based on the exhibit, what should be implemented to reduce the blast radius if a backup server is compromised later?

Backup job configuration:
algorithm=AES-256-GCM
key_file=/opt/backup/key.bin
rotation=disabled
same_key_for_all_sites=true
backup_media copied to an offsite vault each night

Accepted Answer

Use envelope encryption with unique data encryption keys protected by a KMS-managed key encryption key.. Envelope encryption with unique data encryption keys (DEKs) protected by a KMS-managed key encryption key (KEK) ensures that even if the backup server is compromised, the attacker cannot decrypt all backups because each backup uses a different DEK, and the KEK is stored externally in a KMS. This limits the blast radius to only the data encrypted with the compromised DEK, rather than exposing all historical backups encrypted with a single static key.

Answer

Store the same key in a password-protected ZIP archive on the backup server.

Answer

Replace AES with SHA-256 so the files cannot be opened directly.

Answer

Keep one key forever and increase the backup frequency.

Question 18

Based on the exhibit, what is the best fix so role changes are reflected promptly in the application?

Token and directory data:

09:10  Token issued for user jdoe
      groups=[Finance_Approver, Expense_Reviewer]
      auth_time=09:10
      exp=17:10
09:15  HR updated directory: jdoe moved to Sales
11:00  The application still accepts the original token and allows expense approval
11:01  Identity provider logs show no token revocation event

Accepted Answer

Shorten token and session lifetime and revoke active tokens when the directory role changes.. Option B is correct because the token's long lifetime (issued at 09:10, expires at 17:10) allows the application to continue accepting the original token even after the user's directory role changes at 09:15. Shortening the token lifetime forces more frequent reauthentication, and revoking active tokens when the directory role changes ensures that the application immediately reflects the updated authorization. This aligns with the principle of dynamic access control and token lifecycle management.

Answer

Increase the token lifetime so users reauthenticate less often.

Answer

Move the application to a different subnet to isolate it from HR systems.

Answer

Disable group-based authorization and let any authenticated user approve expenses.

Question 19

Based on the exhibit, which change best improves accountability while still allowing emergency access?

A finance team uses the following shared account on a jump host:

07:55:12  Account=FIN-ADMIN  Action=ApproveInvoice   Host=JUMP-02  IP=10.30.8.21
07:56:03  Account=FIN-ADMIN  Action=ChangeVendorBank Host=JUMP-02  IP=10.30.8.21
07:57:44  Account=FIN-ADMIN  Action=ExportReport     Host=JUMP-02  IP=10.30.8.21

Note: FIN-ADMIN is used by three finance managers during after-hours support.

Accepted Answer

Replace the shared account with named user accounts, role-based access, and a separate break-glass account for rare emergencies.. Option B is correct because replacing the shared account with named user accounts ensures individual accountability through unique credentials and audit trails, while a separate break-glass account provides emergency access without compromising security. This aligns with the principle of least privilege and non-repudiation, as each finance manager's actions are logged under their own identity, and the break-glass account can be tightly controlled and monitored for rare use.

Answer

Require the shared account password to be changed every 24 hours.

Answer

Enable automatic account lockout after five failed logons.

Answer

Restrict the jump host by MAC address and subnet only.

Question 20

Based on the exhibit, which additional control is the best fit to prevent employees from copying sensitive reports to removable media?

Accepted Answer

Implement endpoint device control or DLP rules to restrict removable media use.. Endpoint device control or DLP (Data Loss Prevention) rules are specifically designed to monitor, block, or restrict the use of removable media such as USB drives. By implementing such controls, an organization can enforce policies that prevent sensitive data from being copied to unauthorized external storage devices, directly addressing the threat of data exfiltration via removable media.

Answer

Block all internet access on finance laptops except for the accounting website.

Answer

Increase the password complexity requirements for finance users.

Answer

Add more antivirus signatures to the endpoint protection platform.