SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 11 — 15 Questions

Question 1

A help desk technician receives a phone call from someone claiming to be a contractor. The caller says their MFA app was lost, asks the technician to enroll a new device immediately, and pressures them to ignore policy. What type of attack is this?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to impersonate a contractor and socially engineer the technician into bypassing MFA enrollment policies. Vishing specifically exploits voice communication to manipulate victims, unlike phishing which uses email or malicious links.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 2

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

Accepted Answer

Smishing, because the attacker is using a text message to deliver a targeted credential lure.. Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Answer

Vishing, because the attacker is pretending to be a delivery service representative.

Answer

Spear phishing, because the message is targeted using the recipient's role and location.

Answer

Baiting, because the message offers a shipment verification reward to encourage action.

Question 3

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

Accepted Answer

Stored cross-site scripting, because the malicious script is saved and served to other users later.. The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Answer

Reflected cross-site scripting, because the payload only appears in the current request response.

Answer

Command injection, because the script runs inside the web server process.

Answer

Session fixation, because the attacker wants the victim to use an old session ID.

Question 4

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

Accepted Answer

Verify the request using a known-good contact method and report the message as suspicious.. The best response is to verify the request through a known, trusted communication path and then report it. In a spear phishing or business email compromise scenario, the attacker relies on urgency, authority, and familiarity to bypass normal controls. A separate phone call, chat message, or in-person confirmation using an existing contact list provides stronger assurance than any reply to the suspicious email itself.

Why others are wrong: Replying, processing the transfer, or forwarding the message all keep the workflow inside the attacker’s channel and increase the chance of fraud. None of those actions independently validate the sender’s identity or the payment change request. The key security habit is to stop, verify outside the email thread, and escalate the suspicious communication.

Answer

Reply to the email asking for additional payment details and wait for a response.

Answer

Process the transfer quickly because the message appears to come from an executive.

Answer

Forward the email to another finance employee so someone else can confirm the request.

Question 5

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

Accepted Answer

Insecure deserialization, because a crafted object triggered unexpected server-side actions.. Option C is correct because the scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Answer

SQL injection, because the attacker likely altered a database query.

Answer

Cross-site scripting, because the attacker could have injected script into the portal.

Answer

CSRF, because the attacker may have forced an administrator to submit a form.

Question 6

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 7

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

Accepted Answer

Spear phishing, because the email is tailored to a specific team, project, and recipient.. B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Answer

Phishing, because the message asks recipients to open a file and respond quickly.

Answer

Pretexting, because the sender claims to have spoken with the recipient before.

Answer

Baiting, because the attacker offers a useful file related to the project.

Question 8

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

Accepted Answer

End the call and verify the request through a published help desk number or ticketing system.. Option C is correct because the safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Answer

Reset MFA immediately, since the caller has provided enough internal details to seem credible.

Answer

Ask the caller to read a one-time code aloud so the technician can confirm their identity.

Answer

Approve the request if the caller can name the supervisor and the contractor's project team.

Question 9

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

Accepted Answer

ARP spoofing, because false Layer 2 address mappings are redirecting traffic.. B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Answer

DNS poisoning, because the hostname is resolving to the wrong server.

Answer

Replay attack, because packets are being resent to the gateway.

Answer

Rogue DHCP service, because clients are losing access to the default gateway.

Question 10

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

Accepted Answer

Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.. Option C is correct because the scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Answer

Trojan, because it could have introduced the suspicious service after the initial compromise.

Answer

Spyware, because it may collect data while leaving the application functional.

Answer

Logic bomb, because the malware activates after startup and changes what administrators see.

Question 11

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Accepted Answer

Files are renamed or encrypted and no longer open normally. Option A is correct because ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Answer

The mouse pointer moves slowly after long idle periods

Answer

The browser homepage changed after a software update

Answer

A new USB keyboard is detected by the operating system

Question 12

Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?

Accepted Answer

ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.. The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.

Answer

DNS poisoning, because name resolution is directing users to the wrong server.

Answer

Replay attack, because previously captured traffic is being resent to the network.

Answer

Denial of service, because the branch users cannot reliably reach websites.

Question 13

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

Accepted Answer

Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.. The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Answer

Reflected cross-site scripting, because the tester's input is being echoed back into the response.

Answer

Command injection, because the application is pausing while executing system-level sleep commands.

Answer

Session fixation, because the tester is manipulating how the application handles user input over time.

Question 14

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

Accepted Answer

Ransomware, because the files were encrypted and payment was demanded.. The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Answer

Trojan, because the malware may have been disguised as a legitimate application.

Answer

Worm, because the malware likely spread automatically to other systems.

Answer

Rootkit, because the attacker would want to hide persistence on the system.

Question 15

Based on the exhibit, which security issue should the analyst report first?

Accepted Answer

Exposed service, because VNC and the web admin interface are reachable from untrusted networks.. Option B is correct because the scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.

Answer

Outdated component, because the scan did not list software version details.

Answer

Weak permissions, because SSH requires password login only.

Answer

Default credentials, because the server is in the DMZ.