SY0-701 Threats, Vulnerabilities, and Mitigations — 15 Questions

Question 1

A security analyst reviews authentication logs and notices multiple failed login attempts using various usernames from a single IP address over several hours. Eventually, a successful login occurs using a username that had many failed attempts. The organization requires multi-factor authentication (MFA). Which type of attack is most likely indicated by this pattern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Brute-force attack. The pattern of multiple failed login attempts using various usernames from a single IP address, followed by a successful login for a username that had many failed attempts, is characteristic of a brute-force attack. In a brute-force attack, the attacker systematically tries many passwords against a known or guessed username until success. The fact that the successful username had many prior failed attempts indicates the attacker attempted multiple passwords for that account. Credential stuffing typically uses stolen username/password pairs, usually one attempt per pair, and would not show many failed attempts for the same username. Password spraying uses one common password across many usernames, also not matching this pattern. The MFA requirement does not change the attack type; it only means the attacker would need to also possess the second factor.

Answer

Credential stuffing

Answer

Password spraying

Answer

Shoulder surfing

Question 2

A security analyst receives an alert from the email security gateway about a message sent to an employee. The email has an attachment named 'Invoice_Q4_2024.exe'. The employee claims they did not open the attachment, and the email appears to come from a known vendor's domain but the sender address has a slight typo. Which type of attack is most likely being attempted?

Accepted Answer

Spear phishing. The email is targeted at a specific employee and impersonates a known vendor to exploit a trusted business relationship. The use of a domain typo (domain spoofing) is a common spear phishing technique to trick the recipient into executing malware. While the lure ('Invoice_Q4_2024.exe') is not highly personalized, the impersonation of a known vendor constitutes targeting a specific organization, making spear phishing more likely than broad, unsolicited phishing.

Answer

Phishing

Answer

Smishing

Answer

Vishing

Question 3

A support portal lets users upload files and name them manually. During review, a tester submits a filename containing path traversal sequences, and logs later show the application trying to access files outside the intended upload folder. Which two changes best address the flaw? Select two.

Accepted Answer

Validate and canonicalize the filename on the server, then allow only approved name patterns.. Server-side canonicalization with an allowlist resolves traversal sequences such as `../` and rejects unsafe filenames. Assigning a server-generated random filename (e.g., a UUID) to the stored file and mapping the original name separately prevents user-supplied names from being used in the filesystem path, directly eliminating path traversal. Storing uploads outside the web root or denying execution would not stop traversal.

Answer

Increase the maximum upload size so the application can handle more files.

Answer

Add browser-side JavaScript validation to reject suspicious filenames.

Answer

Hide detailed error messages from end users only.

Question 4

A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Accepted Answer

Isolate the affected server from the network through EDR or switch controls.. Both A and B are correct immediate containment steps. Isolating the affected server via EDR or switch controls stops the malware from spreading through SMB connections and prevents further encryption of network-accessible files. Disabling or resetting the compromised service account and revoking its active sessions removes the attacker's authentication capability and halts any ongoing malicious activity using that account. Recovery actions such as restoring from backup or deleting files should not be performed until the threat is contained, and dismissing the incident as a false positive is inappropriate.

Answer

Restore the server from backup before taking any containment action.

Answer

Delete the suspicious files from the server to stop the encryption process.

Answer

Inform users that the incident is likely a false positive and continue monitoring.

Question 5

A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?

Accepted Answer

A critical flaw on an internet-facing VPN appliance with known exploit code. The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.

Answer

A low-severity finding on an internal test server with no network access

Answer

A cosmetic configuration warning on a printer management interface

Answer

A medium-severity issue on a device that is powered off and not in service

Question 6

A scan returns five findings. Which two should be remediated first based on real-world risk? Select two. A) Internet-facing SSO gateway, CVSS 8.8, public exploit code, and auth bypass impact. B) Internal print server, CVSS 9.8, no known exploit, isolated VLAN, no sensitive data. C) File server with regulated customer records, CVSS 6.5, active exploitation in the wild, reachable from VPN. D) Lab hypervisor, CVSS 7.5, no exploit, scheduled retirement next month, used only by testers. E) Dev wiki, CVSS 5.0, no exploit, no sensitive data.

Accepted Answer

Internet-facing SSO gateway with public exploit code and authentication-bypass impact.. The SSO gateway is internet-facing, has a CVSS 8.8 with public exploit code, and an authentication-bypass impact. This combination means an attacker can gain unauthorized access to all federated applications without credentials, representing a critical risk that must be remediated immediately. The file server contains regulated customer records, is actively exploited in the wild, and is reachable from the VPN, so the combination of sensitive data and active exploitation makes it a top priority despite a lower CVSS score. The other findings have compensating controls (e.g., isolated VLAN, no exploit, no sensitive data) that reduce real-world risk.

Answer

Internal print server on an isolated VLAN with no known exploit and no sensitive data.

Answer

Lab hypervisor that is scheduled for retirement next month and used only by testers.

Answer

Development wiki with low severity, no exploit, and no sensitive data.

Question 7

Threat intelligence reports a campaign that rotates domains daily and repacks the malware for each delivery. Analysts also observe the same TLS certificate fingerprint, the same mutex name, and the same JA3 client fingerprint across multiple samples. Which three indicators are most useful to prioritize for hunting or blocking? Select three.

Accepted Answer

The TLS certificate fingerprint reused by multiple samples.. The TLS certificate fingerprint is a reliable indicator because it is derived from the certificate's public key and metadata, which remain static even when the malware's domain or IP address changes. Similarly, the mutex name is a consistent artifact created by the malware on endpoints, and the JA3 client fingerprint is a static representation of the TLS client hello characteristics. Since these three indicators remain constant across samples despite domain rotation and repacking, they are the most useful for hunting or blocking. In contrast, the current domain name and public IP address are dynamic and change frequently, making them less reliable for persistent detection.

Answer

The current domain name used by the command-and-control server.

Answer

The public IP address currently hosting the malware sample.

Question 8

An employee receives a text message from "IT Help" saying their account will be disabled unless they tap a link and enter a one-time code. Five minutes later, someone calls claiming to be from IT and asks the employee to read back the same code. Which two social engineering delivery methods are used? Select two.

Accepted Answer

Smishing. Smishing is correct because the initial contact is via SMS text message, which is the defining characteristic of smishing (SMS phishing). The attacker uses a text message to deliver a phishing lure, prompting the employee to tap a link and enter a one-time code. Vishing is correct because the subsequent voice call asking the employee to read back the code is a voice phishing (vishing) attempt.

Answer

Baiting

Answer

Whaling

Answer

Tailgating

Question 9

A small business web server still allows remote administration from the internet on port 3389, and the administrator password has never been changed from the vendor default. Which two issues should the security team prioritize first? Select two.

Accepted Answer

An exposed remote administration service. Port 3389 is used by Remote Desktop Protocol (RDP), which is a remote administration service. Exposing RDP directly to the internet is a critical vulnerability because it allows attackers to perform brute-force or credential-stuffing attacks against the service. This is a high-priority issue because it provides an attack vector that can lead to full system compromise. Additionally, the administrator password has never been changed from the vendor default, meaning default credentials are still in use. Default credentials are a critical vulnerability because attackers can easily guess or look up known default passwords, allowing them to gain unauthorized access without any brute-force effort. Together, exposed RDP and default credentials present a severe, immediate risk that must be addressed first.

Answer

A missing screen-lock timeout on nearby laptops

Answer

A lack of encrypted email attachments

Answer

An outdated printer driver on the finance network

Question 10

An accounts payable clerk receives an email that appears to continue an existing thread with a shipping vendor. The sender name, signature block, and invoice number all match a real open order, and the message asks the clerk to use a "new payment portal" and confirm bank details before 3 PM to avoid delayed shipment. The email contains no attachments and only one URL. Which attack type is most likely?

Accepted Answer

Spear phishing, because the email uses targeted business context and time pressure.. The email is a targeted phishing attempt using specific business context (existing thread, real invoice number, vendor impersonation) to trick the victim into clicking a link and entering bank details. This is classic spear phishing. Pretexting is a broader social engineering technique that involves creating a false scenario, but the attack vector here is the email with a URL, which makes it a phishing attack. The presence of a link and urgency are hallmarks of spear phishing, not pretexting alone.

Answer

Pretexting, because the attacker is impersonating a trusted vendor to create a believable reason for the request.

Answer

Smishing, because the attacker is using a text message to reach the victim.

Answer

Baiting, because the attacker is offering a portal link that appears helpful to the recipient.

Question 11

A scanner reports a critical vulnerability on an internal Linux server. The administrator confirms the vulnerable package is installed, but the affected feature is only enabled when an optional module is loaded, and that module is currently disabled. The server also requires downtime for patching. What is the best next step?

Accepted Answer

Verify whether the vulnerable function is reachable, then apply a compensating control or schedule remediation. Even though the vulnerable module is disabled, the administrator must first verify whether the vulnerable function is reachable through other means (e.g., via a different service or misconfiguration). If it is reachable, applying a compensating control (like a firewall rule or SELinux policy) can mitigate risk without immediate downtime, allowing patching to be scheduled. If it is unreachable, the vulnerability is not currently exploitable, but remediation should still be scheduled to eliminate the vulnerable package. This aligns with the principle of defense-in-depth and proper risk management.

Answer

Immediately accept the risk and leave the server unchanged

Answer

Mark the finding as a false positive and close the ticket

Answer

Remove the server from production immediately and rebuild it from scratch

Question 12

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A is prioritized first because it represents the highest overall risk when considering exploitability, potential impact, and asset criticality. While CVSS scores are a factor, remediation decisions should weigh the likelihood of exploitation and the severity of consequences; Finding A poses an immediate and severe threat that could lead to significant compromise, thereby requiring urgent action.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 13

Several users on the same subnet report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows ARP replies that map the gateway IP to a different MAC address. What attack is most likely occurring?

Accepted Answer

ARP spoofing, which poisons address resolution on the local network. ARP spoofing (also known as ARP poisoning) is the correct answer because the attacker sends forged ARP replies that associate the default gateway's IP address with the attacker's MAC address. This causes the victims' ARP caches to update with the false mapping, so traffic destined for the gateway is instead sent to the attacker, leading to intermittent connectivity and misrouted packets. The symptoms—slow traffic and reaching the wrong device—are classic indicators of a man-in-the-middle (MITM) attack via ARP cache poisoning. (Switches maintain MAC address tables, not ARP caches.)

Answer

DNS amplification, which overwhelms the target with reflected DNS traffic

Answer

Replay attack, which resends captured authentication data

Answer

Port scanning, which probes hosts for open services and ports

Question 14

During testing of a shopping portal, a POST request to /api/address/update succeeds even when the anti-CSRF token is removed. In a separate test, changing customerId=1842 to customerId=1843 in a GET request returns another user's invoice data. Which two vulnerabilities are present? Select two.

Accepted Answer

Cross-site request forgery is present because the state-changing request works without a valid anti-CSRF token.. The POST request to /api/address/update succeeds without the anti-CSRF token, which means the application does not validate the origin of the request. This allows an attacker to forge a cross-site request that changes the victim's address without their knowledge, a classic CSRF vulnerability. Separately, the GET request with a manipulated customerId returns another user's invoice, indicating the application fails to enforce access control on the object (IDOR/broken object level authorization).

Answer

SQL injection is present because the customerId value changes in the URL.

Answer

Cross-site scripting is present because the invoice data is returned in the browser.

Answer

Insecure deserialization is present because the request uses JSON-like parameters.

Question 15

A branch office reports intermittent failures reaching internal sites. DHCP logs show clients receiving leases from an unknown MAC address, and DNS responses for intranet.example resolve to an address owned by the same device. Which two attacks best match the evidence? Select two.

Accepted Answer

A rogue DHCP server is issuing unauthorized lease information.. The evidence shows two distinct attacks. First, DHCP logs showing clients receiving leases from an unknown MAC address indicate a rogue DHCP server on the network, which issues unauthorized IP configurations and can disrupt connectivity. Second, DNS responses for intranet.example resolving to an address owned by the same device indicate DNS spoofing or poisoning, where an attacker corrupts DNS resolution to redirect users to a malicious or unintended host. Together, these two attacks explain the intermittent failures and the shared ownership of the unauthorized DHCP server and DNS response address.

Answer

A SYN flood is exhausting the DHCP service.

Answer

A port scan is enumerating exposed services on the branch subnet.

Answer

Password spraying is attempting many logins with common passwords.