SY0-701 Matching — 30 Questions

Question 1

Match each control type to the best description.

Accepted Answer

Administrative: Policies, procedures, and rules. Control types are categorized by nature: administrative involves rules, technical involves technology, physical involves tangible barriers, logical involves software-based access, operational involves processes, and legal/regulatory involves compliance.

Answer

Technical: Physical locks and fences

Answer

Logical: Hardware security modules

Answer

Operational: Software-based authentication

Question 2

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties

Question 3

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Accepted Answer

Isolation: Preventing the spread of the incident to other systems.. Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Answer

Isolation: Removing malicious files from the system.

Answer

Volatile Data Capture: Creating a forensic copy of the hard drive.

Question 4

Match each principle to the workplace scenario.

Accepted Answer

Least privilege: A user is granted only the permissions required for their job duties.. Least privilege restricts access to necessary functions; separation of duties prevents fraud; defense in depth layers security; need to know limits data access; accountability ties actions to individuals; fail safe maintains security during failures.

Answer

Separation of duties: A user is granted only the permissions required for their job duties.

Answer

Defense in depth: A security system that automatically fails open to allow egress.

Question 5

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Accepted Answer

VLAN: Separates broadcast domains logically. VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Answer

ACL: Divides IP networks into smaller segments

Answer

NAT: Provides secure remote access over public internet

Question 6

Match each procurement need to the vendor due diligence artifact or control that best fits.
1. Procurement wants independent evidence that a SaaS provider's controls operated effectively during the last year.
2. The team wants to know what files, libraries, and modules were included in a supplier's software build.
3. The business needs a signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.
4. The procurement team wants answers about MFA, logging, and incident response before onboarding a cloud supplier.

Accepted Answer

SOC 2 Type II: Independent evidence that a SaaS provider's controls operated effectively during the last year.. Each artifact or control directly addresses the procurement need: SOC 2 Type II provides independent audit evidence; SBOM lists software components; DPA is the legal agreement for data handling; security questionnaires gather specific security practices; pen test reports validate controls; BCP ensures continuity.

Answer

Pen test report: Independent evidence that a SaaS provider's controls operated effectively during the last year.

Answer

BCP: A signed agreement that defines how customer data is handled and what the vendor must do if an incident occurs.

Question 7

Match each procurement or oversight need to the best vendor due diligence artifact or clause. Use each item once.

Accepted Answer

Assess security controls: Security questionnaire. These artifacts support vendor due diligence: questionnaires assess controls, SOC 2 reports provide independent assurance, audit clauses enable customer verification, DPAs govern data handling, BCPs ensure resilience, and pen tests validate security.

Answer

Assess security controls: SOC 2 report

Answer

Data protection: Business continuity plan

Question 8

Match each requirement or instruction to the correct governance document type. Use each document type once.

Accepted Answer

Policy: High-level statement of management intent. These matches align with common governance document types in IT security frameworks: policy provides high-level direction, standard sets mandatory rules, procedure gives step-by-step instructions, guideline offers non-mandatory recommendations, baseline defines minimum configurations, and framework provides a structured approach.

Answer

Procedure: Recommended best practices, not mandatory

Answer

Guideline: Step-by-step instructions for performing a task

Question 9

Match each security monitoring artifact from the SOC alert queue to the best investigation focus.

Accepted Answer

Phishing: Investigate email headers and links. Each alert type suggests a specific investigation focus: phishing requires email analysis; malware needs file/behavior analysis; brute force focuses on auth logs; data exfiltration looks at outbound traffic; privileged misuse examines user activity; ransomware involves encryption events.

Answer

Brute force: Audit user activity logs for unusual administrative actions

Answer

Data exfiltration: Check for file encryption events and ransom notes

Answer

Privileged misuse: Monitor outbound traffic volume to unusual destinations

Answer

Ransomware: Review authentication logs for repeated failures

Question 10

Match each awareness-program metric to the interpretation the security team should use.
1. 8% of users clicked the simulated phishing link.
2. 34% of users reported the simulation using the report-phish button.
3. The median time from message delivery to first user report was 12 minutes.
4. 96% of staff completed the annual awareness module.

Accepted Answer

8% of users clicked: Indicates user susceptibility to phishing.. Each metric guides interpretation: click rate indicates susceptibility, report rate shows security culture, reaction time measures responsiveness, and completion rate reflects training adoption.

Answer

8% of users clicked: Demonstrates strong security culture.

Answer

34% of users reported: Measures susceptibility to phishing.

Question 11

Match each access principle to the best description.

Accepted Answer

Least privilege: Users get minimal permissions needed. Least privilege grants minimal permissions, separation of duties splits critical tasks, defense in depth uses multiple security layers, need-to-know restricts data access, RBAC assigns permissions by role, and accountability ensures traceability.

Answer

Least privilege: Splitting critical tasks among multiple people

Answer

Separation of duties: Users get minimal permissions

Question 12

Match each excerpt from a small enterprise security program to the correct governance artifact.

Accepted Answer

Policy: All employees must use multi-factor authentication. Policy defines mandatory rules; Procedure gives step-by-step instructions; Standard specifies technical requirements; Guideline offers best practices.

Answer

Procedure: All employees must use multi-factor authentication

Answer

Policy: It is recommended to use complex passwords

Question 13

Match each data example to the most appropriate classification label.
1. A public marketing flyer approved for external posting.
2. An internal org chart and office directory meant only for employees.
3. A customer case file with contact details and order history.
4. A vault export containing API keys and encryption secrets.

Accepted Answer

A public marketing flyer approved for external posting: Public. These matches follow a typical data classification scheme: Public for non-sensitive info, Internal for company-only data, Confidential for customer PII, and Restricted for highly sensitive secrets.

Answer

A vault export containing API keys and encryption secrets: Confidential

Answer

A public marketing flyer approved for external posting: Internal

Question 14

Match each cryptographic action to the most appropriate use case.

Accepted Answer

Encryption: Ensuring confidentiality. Encryption ensures confidentiality, hashing ensures integrity, digital signatures provide authentication and non-repudiation, key exchange enables secure key distribution, certificate signing establishes trust, and random numbers are essential for key generation.

Answer

Key Exchange: Ensuring integrity

Answer

Random Number Generation: Providing authentication

Question 15

Match each principle to the scenario that best illustrates it.

Accepted Answer

Least privilege: A user is given only the permissions needed to perform their job.. Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.

Answer

Least privilege: Two people are required to approve a financial transaction.

Answer

Separation of duties: A user is given only the permissions needed to perform their job.

Answer

Defense in depth: An employee accesses customer data only when required for their role.

Question 16

Match each detection pattern to the most likely security issue. Each item has one best match.

Accepted Answer

Repeated login failures: Brute-force attack. Repeated login failures indicate brute-force; Outbound connections to malicious IPs suggest C2; Large data transfers at odd hours indicate exfiltration; Random DNS subdomains are typical of tunneling; Conflicting ARP replies show spoofing; Multiple ICMP requests from many sources indicate DDoS.

Answer

Random DNS subdomains: DDoS

Answer

Conflicting ARP replies: Data exfiltration

Question 17

Match each security principle to the best description.

Accepted Answer

Confidentiality: Restricts access to authorized users.. These pairings match the CIA triad plus additional principles: confidentiality restricts access, integrity prevents unauthorized changes, availability ensures uptime, non-repudiation provides proof of actions, authentication verifies identity, and authorization defines permissions.

Answer

Non-repudiation: Ensures data is unchanged.

Answer

Authentication: Grants permissions.

Answer

Authorization: Verifies identity.

Question 18

Match each cloud security concept to the best description.

Accepted Answer

Encryption: Protects data by converting it into a secure format.. Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Answer

Encryption: Manages user access to resources.

Answer

IAM: Protects data by encoding it.

Question 19

Match each security control type to the best example in a small office environment.

Accepted Answer

Administrative: Security awareness training policy. These matches classify security controls by type: administrative involves policies, technical uses technology, physical secures premises, deterrent discourages violations, preventive stops incidents, and detective identifies occurrences.

Answer

Administrative: Firewall

Answer

Physical: Security awareness training policy

Question 20

Match each network segment to the best use in a small enterprise.

Accepted Answer

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.. Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Answer

VPN: Used for managing network devices (switches, routers).

Answer

Management: Provides secure remote access to internal network for employees.