SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 12 — 15 Questions

Question 1

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

Accepted Answer

Evil twin. The correct answer is B, Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials. This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Answer

Rogue access point

Answer

Bluetooth bluejacking

Answer

NFC relay attack

Question 2

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Vishing. The exhibit shows a voicemail message instructing the recipient to call a specific phone number to verify account activity. This is a classic vishing (voice phishing) attack, where the attacker uses a phone call or voicemail to trick the victim into providing sensitive information or calling a fraudulent number. Unlike phishing, which uses email or text, vishing relies on voice communication channels.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 3

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

Accepted Answer

A fileless attack that relies on trusted tools already on the system. This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Answer

A worm that spreads by exploiting a network service

Answer

A logic bomb that waits for a specific date or event

Answer

A rootkit that changes kernel behavior to hide processes

Question 4

A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.

Answer

Spyware

Answer

Rootkit

Answer

Worm

Question 5

A caller says they are from IT support and asks a user to read back the one-time MFA code that just arrived on their phone. What type of attack is this most likely?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the attacker uses a phone call to socially engineer the victim into revealing a one-time MFA code. Unlike phishing (email) or smishing (SMS), vishing relies on voice communication to bypass technical controls and trick the user into providing the code, which the attacker can then use to authenticate as the victim.

Answer

Phishing

Answer

Smishing

Answer

Baiting

Question 6

A vulnerability scanner reports a critical issue on a Linux server. The administrator checks the application and confirms the vulnerable package is installed, but the affected feature is not enabled anywhere in production. What should the security team do next?

Accepted Answer

Validate whether the issue is a false positive or lower-risk finding before prioritizing remediation. Option B is correct because the vulnerability scanner reports a critical issue, but the administrator has confirmed the vulnerable package is installed while the affected feature is not enabled in production. This means the actual risk is lower than the scanner's severity rating, as exploitation requires the feature to be active. The security team should validate whether this is a false positive or a lower-risk finding to prioritize remediation efforts appropriately, ensuring resources are allocated to genuine threats.

Answer

Ignore the finding permanently because the package is installed

Answer

Immediately shut down the server without further investigation

Answer

Apply an exception without documenting any compensating controls

Question 7

Based on the exhibit, what wireless threat is most likely occurring?

Accepted Answer

Evil twin access point. The exhibit shows a legitimate access point (SSID: 'CorpNet') with a second, rogue access point broadcasting the same SSID but with a stronger signal. This is the classic behavior of an evil twin attack, where an attacker sets up a fraudulent AP to intercept client connections and capture credentials or sensitive data. The victim's device automatically associates with the stronger signal, believing it is the legitimate network.

Answer

Bluetooth pairing abuse

Answer

NFC skimming

Answer

DNS poisoning

Question 8

Users on one VLAN report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows unsolicited ARP replies claiming to be the gateway. Which two actions are the best mitigations on managed switches? Select two.

Accepted Answer

enable DHCP snooping so trusted IP-to-MAC bindings can be validated. Option A is correct because DHCP snooping creates a trusted database of IP-to-MAC bindings by monitoring DHCP messages. This database is then used by Dynamic ARP Inspection (DAI) to validate ARP packets, ensuring that only legitimate gateway addresses are accepted. Without DHCP snooping, DAI has no reliable source of truth to compare against, making it ineffective against ARP spoofing attacks.

Answer

change the default gateway IP address on the subnet

Answer

disable spanning tree protocol to reduce switching delays

Answer

replace private addressing with NAT on every endpoint

Question 9

Based on the exhibit, which control should be enabled to mitigate this issue?

Accepted Answer

Dynamic ARP inspection with DHCP snooping, because it validates ARP replies against trusted bindings.. Dynamic ARP inspection (DAI) with DHCP snooping validates ARP packets against a trusted binding database, preventing man-in-the-middle attacks where an attacker spoofs the MAC address of a legitimate host (e.g., the default gateway) to intercept traffic. The exhibit likely shows a scenario of ARP spoofing or cache poisoning, which DAI directly mitigates by dropping invalid ARP replies. DHCP snooping builds the trusted binding table by recording which IP address is assigned to which MAC address on which port.

Answer

DNSSEC, because it validates DNS records and would stop local address-to-MAC spoofing.

Answer

Port forwarding, because it can direct traffic to the correct internal host more reliably.

Answer

Load balancing, because it would distribute traffic and reduce the impact of connectivity issues.

Question 10

A help desk technician receives a phone call from someone who claims to be the CFO. The caller knows the executive team structure, says they are traveling, and insists the technician reset MFA to 'avoid delaying a wire transfer.' Which social engineering technique is the caller primarily using?

Accepted Answer

Pretexting, because the caller builds a believable story to manipulate the employee. The caller is using pretexting because they have fabricated a scenario (the CFO traveling and needing an urgent wire transfer) and assumed a false identity to manipulate the help desk technician into resetting MFA. Pretexting relies on a crafted story or pretext to gain trust and bypass security controls, which is exactly what the caller is doing here.

Answer

Baiting, because the caller is offering something valuable in exchange for action

Answer

Vishing, because the attack happens by voice call

Answer

Smishing, because the attacker is using a mobile device

Question 11

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Logic bomb. The exhibit shows a script that checks for a specific employee name and, if the condition is met, deletes critical system files. This is a classic logic bomb: malicious code embedded in a legitimate program that executes when predefined conditions (e.g., a specific user, date, or event) are satisfied. Logic bombs do not self-replicate or continuously spy; they lie dormant until triggered.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 12

A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?

Accepted Answer

Fileless attack using trusted system tools to run malicious code in memory. The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.

Answer

Worm behavior that is spreading through SMB shares

Answer

Rootkit that is hiding itself by modifying kernel drivers

Answer

Trojan that can only run after a user manually opens a malicious attachment

Question 13

A help desk technician receives a call from a user who says many of their documents now have strange file extensions and a ransom note appeared on the desktop. The files will not open. What type of malware is the user most likely experiencing?

Accepted Answer

Ransomware that encrypts files and demands payment for recovery. The user's symptoms—unopenable files with strange extensions and a ransom note—are classic indicators of ransomware. Ransomware encrypts files using a symmetric key (e.g., AES-256) and then demands payment, typically in cryptocurrency, to provide the decryption key. This matches the scenario exactly, as the files are rendered inaccessible and a note is left behind.

Answer

Spyware that silently records user activity over time

Answer

A worm that spreads mainly by scanning for other hosts

Answer

A rootkit that hides malicious processes from the operating system

Question 14

A cloud-hosted image-processing API accepts a URL parameter so it can download a picture and generate a thumbnail. Logs show a user submitting `http://169.254.169.254/latest/meta-data/` and receiving instance credentials in the response. Which attack is being used?

Accepted Answer

Server-side request forgery (SSRF). The attack is Server-Side Request Forgery (SSRF) because the cloud-hosted API is tricked into making a request to the internal metadata service at the link-local address 169.254.169.254. This endpoint is only accessible from within the cloud provider's network and exposes instance credentials, which the attacker then receives in the response. SSRF exploits the server's ability to make outbound requests to internal or restricted resources.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Question 15

Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?

Accepted Answer

Fileless malware. The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.

Answer

Trojan

Answer

Worm

Answer

Rootkit