SY0-701 Matching — 10 Questions

Question 1

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 2

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties

Question 3

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Accepted Answer

Isolation: Preventing the spread of the incident to other systems.. Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Answer

Isolation: Removing malicious files from the system.

Answer

Volatile Data Capture: Creating a forensic copy of the hard drive.

Question 4

Match each principle to the workplace scenario.

Accepted Answer

Least privilege: A user is granted only the permissions required for their job duties.. Least privilege restricts access to necessary functions; separation of duties prevents fraud; defense in depth layers security; need to know limits data access; accountability ties actions to individuals; fail safe maintains security during failures.

Answer

Separation of duties: A user is granted only the permissions required for their job duties.

Answer

Defense in depth: A security system that automatically fails open to allow egress.

Question 5

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Accepted Answer

VLAN: Separates broadcast domains logically. VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Answer

ACL: Divides IP networks into smaller segments

Answer

NAT: Provides secure remote access over public internet

Question 6

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Accepted Answer

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.. Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Answer

Pen test report: Independent evidence that a SaaS provider's controls operated effectively during the last year.

Answer

BCP: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

Question 7

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 8

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 9

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 10

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.