SY0-701 Hard Questions — 25 Difficult Questions

Question 1

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 2

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Accepted Answer

Replace shell command concatenation with a parameterized API or safe library call.. Replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Answer

HTML-encode the report name before inserting it into the shell command.

Answer

Switch the feature from POST to GET so the values are easier to inspect.

Answer

Hide the server error messages so attackers cannot see the failure details.

Question 3

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 4

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties

Question 5

A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.

Accepted Answer

Smishing is used because the first lure arrives by text message.. The initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.

Answer

Email phishing is used because the attacker is requesting a login action.

Answer

Baiting is used because the attacker offers a free reward or device.

Answer

Tailgating is used because the attacker follows someone into a restricted area.

Question 6

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Accepted Answer

The attacker is likely performing a brute-force password attack against a single account.. A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Answer

The pattern is most consistent with password spraying across many accounts.

Answer

The events primarily indicate a volumetric denial-of-service attack.

Answer

Token creation proves the account password was never exposed.

Question 7

After a server rebuild, a Linux database host still has several unnecessary services enabled, including a graphical desktop, Telnet, and a printer service. The operations team wants a secure baseline that prevents the same drift from happening again after future maintenance. Which two actions best address the issue? Select two.

Accepted Answer

Remove the unused packages and disable the unnecessary services and ports.. Removing unused packages and disabling unnecessary services directly reduces the attack surface by eliminating potential entry points like Telnet (which transmits credentials in cleartext) and unused printer services. This aligns with the principle of least functionality, ensuring only required services run on the Linux database host. However, a one-time cleanup is not enough to prevent future drift. Documenting the approved build and enforcing it with configuration management or drift detection ensures that the secure baseline is maintained after future maintenance, so the host does not regress to having unnecessary services enabled again.

Answer

Allow administrators to enable any service they need without approval during maintenance windows.

Answer

Keep the default installation profile so vendor updates are easier to apply.

Answer

Open the firewall broadly and rely only on strong passwords.

Question 8

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Accepted Answer

A process injects into explorer.exe and monitors keyboard and clipboard activity.. Process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Answer

User files are renamed with a new extension and a ransom note appears.

Answer

CPU usage spikes only during a scheduled operating system update.

Answer

The browser certificate store was refreshed after applying a patch.

Question 9

Based on the exhibit, which principle should the organization enforce to reduce fraud risk while keeping the business process functional?

Accepted Answer

Separation of duties, because no single user should be able to complete every high-risk finance step alone.. Separation of duties (SoD) is the correct principle because it prevents any single employee from completing all steps in a high-risk financial transaction alone. By requiring at least two people to authorize and execute critical actions—such as initiating a payment and approving it—the organization reduces the risk of internal fraud without blocking the business workflow. This directly addresses the scenario where a single user could otherwise create, approve, and release a fraudulent payment.

Answer

Least privilege, because each employee should only have the fewest permissions needed for the shared account.

Answer

Need-to-know, because only employees with confidential financial data should see the workflow details.

Answer

Defense in depth, because the organization should add more security layers around the finance process.

Question 10

Based on the exhibit, which key management improvement best preserves recoverability if the primary backup server is lost?

Accepted Answer

Keep the private key in an HSM or secure escrow with tested recovery procedures.. Storing the private key in a Hardware Security Module (HSM) or secure escrow ensures it remains available even if the primary backup server is lost. HSMs provide tamper-resistant key storage and support tested recovery procedures, which is critical for decrypting backups and maintaining recoverability. This approach separates the key from the backup data, preventing a single point of failure.

Answer

Store the private key on the same backup server so recovery is faster.

Answer

Replace AES with hashing so the archive no longer needs a key.

Answer

Send the private key to backup operators by email so they can restore data quickly.

Question 11

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

Accepted Answer

Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.. The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Answer

SQL injection, because the attacker is changing a field to access a different page.

Answer

Cross-site request forgery, because the browser is sending a forged request to the application.

Answer

Cross-site scripting, because the modified object exposes an internal admin page.

Question 12

Based on the exhibit, what is the best conclusion about the signed document?

Accepted Answer

The invoice was not changed after signing and the signer’s certificate chain validated correctly.. A valid digital signature provides both integrity (the document was not altered after signing) and authentication (the signer's certificate chain validates to a trusted root). The exhibit shows a successful signature validation, which cryptographically proves that the invoice has not been modified since signing and that the signing certificate is trusted.

Answer

The invoice is confidential because the signature encrypts the document contents.

Answer

The invoice can be edited if the timestamp is still within business hours.

Answer

The sender’s private key is now public because the certificate verified successfully.

Question 13

During testing of a shopping portal, a POST request to /api/address/update succeeds even when the anti-CSRF token is removed. In a separate test, changing customerId=1842 to customerId=1843 in a GET request returns another user's invoice data. Which two vulnerabilities are present? Select two.

Accepted Answer

Cross-site request forgery is present because the state-changing request works without a valid anti-CSRF token.. The POST request to /api/address/update succeeds without the anti-CSRF token, which means the application does not validate the origin of the request. This allows an attacker to forge a cross-site request that changes the victim's address without their knowledge, a classic CSRF vulnerability. Separately, the GET request with a manipulated customerId returns another user's invoice, indicating the application fails to enforce access control on the object (IDOR/broken object level authorization).

Answer

SQL injection is present because the customerId value changes in the URL.

Answer

Cross-site scripting is present because the invoice data is returned in the browser.

Answer

Insecure deserialization is present because the request uses JSON-like parameters.

Question 14

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A is prioritized first because it represents the highest overall risk when considering exploitability, potential impact, and asset criticality. While CVSS scores are a factor, remediation decisions should weigh the likelihood of exploitation and the severity of consequences; Finding A poses an immediate and severe threat that could lead to significant compromise, thereby requiring urgent action.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 15

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

Accepted Answer

Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.. The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Answer

Reflected cross-site scripting, because the tester's input is being echoed back into the response.

Answer

Command injection, because the application is pausing while executing system-level sleep commands.

Answer

Session fixation, because the tester is manipulating how the application handles user input over time.

Question 16

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Accepted Answer

Implement microsegmentation with host-based or distributed firewall rules between workloads. Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Answer

Move the servers into a single larger subnet so internal routing is simplified

Answer

Place the servers behind a network address translation device to hide their IP addresses

Answer

Rely on password rotation and MFA for administrative logins only

Question 17

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 18

A payment application must keep running if one application server fails, and the business can tolerate no more than 5 minutes of lost transactions and 30 minutes of downtime during a site outage. Which two controls best match the availability requirements? Select two.

Accepted Answer

Deploy at least two active application nodes behind a load balancer so one server failure does not interrupt service.. Deploying at least two active application nodes behind a load balancer ensures that if one server fails, traffic is automatically redirected to the remaining healthy node(s), achieving zero downtime for the application itself. This directly meets the requirement that the payment application must keep running if one application server fails. For the 5-minute RPO and 30-minute RTO during a site outage, near-real-time or synchronous database replication to a standby preserves recent transactions and allows fast failover, meeting the recovery objectives. Nightly backups or weekly snapshots cannot meet a 5-minute RPO because they introduce up to a day or week of lost data.

Answer

Use a cold site that is powered off until a disaster is declared.

Answer

Take nightly backups to meet the 5-minute recovery point objective.

Answer

Rely on weekly VM snapshots because they are faster than replication.

Question 19

Based on the exhibit, what best describes the additional measures applied to the legacy system?

Accepted Answer

Compensating controls, because they reduce risk when the preferred security controls are not possible.. The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.

Answer

Preventive controls, because they stop every possible compromise completely.

Answer

Corrective controls, because they repair the controller after an incident occurs.

Answer

Deterrent controls, because they mainly scare attackers away from trying.

Question 20

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time