SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 10 — 15 Questions

Question 1

A help desk technician reviews a voicemail in which the caller claims to be from the security team, says the user will be locked out unless they read back a one-time passcode, and leaves a callback number. What type of attack is this?

Accepted Answer

Vishing, because the attacker is using voice communication to pressure the user.. Option B is correct because vishing (voice phishing) uses voice communication—such as phone calls or voicemails—to trick victims into revealing sensitive information. In this scenario, the attacker leaves a voicemail claiming to be from the security team and pressures the user to read back a one-time passcode, which is a classic vishing tactic that exploits trust and urgency over voice channels.

Answer

Smishing, because the attacker is using a text message with a link.

Answer

Baiting, because the attacker is offering a reward to entice the user.

Answer

Pretexting, because the attacker invented a role and story.

Question 2

A file server suddenly renames documents, creates ransom notes, and users can no longer open their files. Which malware type is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and demands payment for decryption. The symptoms—documents being renamed, ransom notes appearing, and users losing access to their files—are classic indicators of ransomware activity, which typically uses strong encryption algorithms like AES or RSA to lock files.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 3

After a suspected compromise, a server's local tools report sshd listening on port 22, but netstat and the EDR console fail to show the process that owns the socket. A reboot does not remove the issue, and firmware integrity checks pass. Which malware type is most likely installed?

Accepted Answer

Rootkit, because it is designed to hide processes, drivers, or sockets from normal security tools.. Option B is correct because a rootkit is specifically designed to hide its presence from the operating system and security tools by intercepting system calls (e.g., those used by netstat and EDR) to conceal processes, drivers, and network sockets. The persistence after reboot and clean firmware integrity checks indicate the rootkit is installed at the kernel or boot level, bypassing user-mode detection.

Answer

Spyware, because hidden software is often used to collect credentials and data.

Answer

Ransomware, because the server remains operational while still hiding evidence.

Answer

Logic bomb, because the issue persists after reboot and could trigger later.

Question 4

A web application lets users save a profile "display name." One employee enters a value that contains script code, and later other users who view that profile start seeing pop-ups and redirects to a fake login page. Which attack is most likely occurring?

Accepted Answer

Cross-site scripting, because untrusted content is executed in another user's browser context.. Option B is correct because the employee's display name containing script code is stored in the database and later rendered in the browsers of other users without proper sanitization. This is a classic stored cross-site scripting (XSS) attack, where untrusted user input is executed as HTML/JavaScript in the context of another user's session, leading to pop-ups and redirects to a fake login page.

Answer

SQL injection, because the database is being queried with unsafe concatenated input.

Answer

Cross-site request forgery, because the attacker is forcing the victim to submit a form automatically.

Answer

Broken authentication, because the login system is failing to verify usernames correctly.

Question 5

An employee receives a text message that says, "Your MFA enrollment expired. Tap here now to re-activate access or your account will be locked." What should the employee do first?

Accepted Answer

Verify the request using a known company contact method and report the text. Option B is correct because the message is a classic phishing attempt designed to harvest MFA credentials or session tokens. The employee must first verify the request through a trusted company channel (e.g., calling the IT help desk or checking the official security portal) and then report the text to the security team. This prevents falling for social engineering that could bypass MFA protections.

Answer

Tap the link and complete the MFA reset immediately

Answer

Forward the text to coworkers so they can watch for it too

Answer

Reply to the sender and ask for more details

Question 6

Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?

Accepted Answer

DNS poisoning. DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.

Answer

Denial of service

Answer

Replay attack

Answer

Port scanning

Question 7

A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to pressure support staff into changing access.. Option B is correct because vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.

Answer

Spear phishing, because the caller used specific employee details to appear credible.

Answer

Pretexting, because the attacker is creating a false identity and believable story.

Answer

Baiting, because the attacker offered a tempting opportunity tied to a customer demo.

Question 8

Based on the exhibit, what type of malware is the most likely issue on the workstation?

Accepted Answer

Spyware, because the system appears to be collecting user data silently.. The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Answer

Ransomware, because the browser settings changed after installation.

Answer

Rootkit, because the endpoint security console detected an unknown process.

Answer

Worm, because the software was installed from an unofficial website.

Question 9

A vulnerability scan of a branch-office print server finds that its administrative web console is reachable from the internet. The appliance is still using the vendor's default password, and no access control list limits management access to the office subnet or VPN. Which remediation would reduce risk the most with the least disruption?

Accepted Answer

Restrict management access to the office network or VPN and change the default credentials.. Option C reduces risk the most with the least disruption by immediately addressing the two primary vulnerabilities: the default password and unrestricted internet exposure. Changing the default credentials prevents trivial authentication bypass, while restricting management access to the office subnet or VPN eliminates the attack surface from the public internet. This approach requires no hardware replacement or downtime, and it directly mitigates the highest-severity issues identified in the scan.

Answer

Increase the password length policy and leave the console publicly reachable.

Answer

Disable the management interface entirely and replace the device immediately.

Answer

Apply a patch after the next quarterly maintenance window and keep the current exposure unchanged.

Question 10

A small business web server still allows remote administration from the internet on port 3389, and the administrator password has never been changed from the vendor default. Which two issues should the security team prioritize first? Select two.

Accepted Answer

An exposed remote administration service. Port 3389 is used by Remote Desktop Protocol (RDP), which is a remote administration service. Exposing RDP directly to the internet is a critical vulnerability because it allows attackers to perform brute-force or credential-stuffing attacks against the service. This is a high-priority issue because it provides an attack vector that can lead to full system compromise.

Answer

A missing screen-lock timeout on nearby laptops

Answer

A lack of encrypted email attachments

Answer

An outdated printer driver on the finance network

Question 11

A user opens an attached document, and the endpoint security tool shows PowerShell running from memory with no new executable file written to disk. What type of attack is most likely?

Accepted Answer

Fileless attack. The scenario describes PowerShell running from memory without a new executable file written to disk, which is the hallmark of a fileless attack. Fileless attacks leverage legitimate system tools like PowerShell, WMI, or .NET to execute malicious code directly in memory, bypassing traditional file-based detection mechanisms.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 12

An accounts payable clerk receives an email that appears to continue an existing thread with a shipping vendor. The sender name, signature block, and invoice number all match a real open order, and the message asks the clerk to use a "new payment portal" and confirm bank details before 3 PM to avoid delayed shipment. The email contains no attachments and only one URL. Which attack type is most likely?

Accepted Answer

Pretexting, because the attacker is impersonating a trusted vendor to create a believable reason for the request.. Option B is correct because the attacker is not just sending a generic targeted email but is actively impersonating a trusted vendor and fabricating a scenario (the need to use a new payment portal to avoid shipment delay) to manipulate the victim into divulging sensitive bank details. This aligns with pretexting, where the attacker creates a false pretext (a believable reason) to obtain information, rather than relying on malicious attachments or links alone. The email's use of an existing thread, matching sender details, and time pressure all support the pretext, making it a classic impersonation-based social engineering attack.

Answer

Spear phishing, because the email uses targeted business context and time pressure.

Answer

Smishing, because the attacker is using a text message to reach the victim.

Answer

Baiting, because the attacker is offering a portal link that appears helpful to the recipient.

Question 13

A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?

Accepted Answer

Restrict SSH to the management network and block public access with firewall or host-based rules.. Option B is correct because the vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.

Answer

Patch the SSH client on administrator laptops so the server cannot be reached externally.

Answer

Enable a captive portal on the public interface so only authenticated users see the service.

Answer

Replace SSH with FTP because FTP can be configured to allow administrative access more easily.

Question 14

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

Accepted Answer

Session hijacking, because a valid session token is being replayed from a different location.. Option A is correct because the scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Answer

Credential stuffing, because the attacker used many passwords against the portal.

Answer

Cross-site request forgery, because the attacker is making requests on behalf of the user.

Answer

Phishing, because the attacker likely stole the user's password first.

Question 15

A person wearing a contractor badge asks reception to let them into the office because they forgot their access card and say they are expected for a server maintenance visit. What social engineering technique is most likely?

Accepted Answer

Pretexting. Pretexting is correct because the attacker creates a fabricated scenario (the 'pretext') of being a contractor on a server maintenance visit to gain unauthorized physical access. The use of a contractor badge and the claim of a forgotten access card are designed to exploit the receptionist's trust and willingness to help, bypassing security controls without technical hacking.

Answer

Baiting

Answer

Smishing

Answer

Ransomware