SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 12 — 15 Questions

Question 1

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the request using a known-good contact method and report the message as suspicious.. The best immediate response is to verify the request using a known-good contact method (e.g., a phone number from the corporate directory) and report the message as suspicious. This defeats the impersonation attempt because the attacker cannot control the out-of-band channel. It also follows the principle of verifying unusual or urgent financial requests through a separate trusted path.

Answer

Reply to the email asking for additional payment details and wait for a response.

Answer

Process the transfer quickly because the message appears to come from an executive.

Answer

Forward the email to another finance employee so someone else can confirm the request.

Question 2

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

Accepted Answer

Insecure deserialization, because a crafted object triggered unexpected server-side actions.. The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Answer

SQL injection, because the attacker likely altered a database query.

Answer

Cross-site scripting, because the attacker could have injected script into the portal.

Answer

CSRF, because the attacker may have forced an administrator to submit a form.

Question 3

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 4

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

Accepted Answer

Spear phishing, because the email is tailored to a specific team, project, and recipient.. B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Answer

Phishing, because the message asks recipients to open a file and respond quickly.

Answer

Pretexting, because the sender claims to have spoken with the recipient before.

Answer

Baiting, because the attacker offers a useful file related to the project.

Question 5

A help desk technician receives a call from someone claiming to be a new contractor whose MFA app failed during travel. The caller knows the company org chart, names the technician's supervisor, and says the technician should use a callback number included in a text message they just sent. What is the safest first action?

Accepted Answer

End the call and verify the request through a published help desk number or ticketing system.. The safest first action when receiving an unsolicited call requesting privileged actions (like MFA reset) is to independently verify the request through official channels. The caller's knowledge of internal details (org chart, supervisor name) and the request to use a callback number from a text message are classic social engineering red flags, as the callback number could be attacker-controlled. Hanging up and calling back via a published help desk number ensures the request is legitimate and prevents MFA bypass or account takeover.

Answer

Reset MFA immediately, since the caller has provided enough internal details to seem credible.

Answer

Ask the caller to read a one-time code aloud so the technician can confirm their identity.

Answer

Approve the request if the caller can name the supervisor and the contractor's project team.

Question 6

Users on a wired subnet report intermittent outages when reaching an internal application. A packet capture shows the default gateway IP address repeatedly mapped to a different workstation MAC address, and traffic is being forwarded through that workstation. What attack is most likely occurring?

Accepted Answer

ARP spoofing, because false Layer 2 address mappings are redirecting traffic.. B is correct because ARP spoofing (also known as ARP poisoning) involves an attacker sending forged ARP messages over a local area network. This results in the attacker's MAC address being associated with the IP address of the default gateway, causing traffic destined for the gateway to be forwarded to the attacker's workstation instead. The packet capture evidence of the default gateway IP repeatedly mapped to a different workstation MAC address is the classic signature of this attack.

Answer

DNS poisoning, because the hostname is resolving to the wrong server.

Answer

Replay attack, because packets are being resent to the gateway.

Answer

Rogue DHCP service, because clients are losing access to the default gateway.

Question 7

A Linux server is missing expected security-agent processes, but users can still connect to the application. Local command output does not show a suspicious daemon that another monitoring tool says is listening on port 4444. A raw disk scan reveals a kernel module loaded at boot, and several files appear only when viewed outside the normal operating system tools. What malware type is most likely?

Accepted Answer

Rootkit, because kernel-level components are hiding processes and files from normal user-mode visibility.. The scenario describes a rootkit: a kernel-level rootkit can load a malicious kernel module at boot, intercept system calls (e.g., `open`, `readdir`, `netstat`), and hide processes, files, and network listeners from user-mode tools like `ps`, `ls`, or `netstat`. The raw disk scan reveals files invisible to normal OS tools, and the missing security-agent processes and hidden daemon on port 4444 are classic signs of kernel-mode hooking that bypasses standard visibility.

Answer

Trojan, because it could have introduced the suspicious service after the initial compromise.

Answer

Spyware, because it may collect data while leaving the application functional.

Answer

Logic bomb, because the malware activates after startup and changes what administrators see.

Question 8

A user's workstation suddenly renames documents with a new extension, displays a ransom note, and blocks access to a shared drive. Which two indicators support ransomware? Select two.

Accepted Answer

Files are renamed or encrypted and no longer open normally. Ransomware typically encrypts files and renames them with a new extension (e.g., .encrypted, .locked), making them unopenable without the decryption key. This behavior directly matches the scenario where documents are renamed and access is blocked, confirming file encryption as a core indicator of ransomware.

Answer

The mouse pointer moves slowly after long idle periods

Answer

The browser homepage changed after a software update

Answer

A new USB keyboard is detected by the operating system

Question 9

Users on a branch VLAN intermittently reach a fake login page even though DNS records have not changed. A packet capture shows the default gateway MAC address changing every 60 seconds, and the switch logs list repeated unsolicited ARP replies from one workstation. Which attack is most likely?

Accepted Answer

ARP poisoning, because forged ARP replies are associating the gateway IP with the attacker's MAC address.. The repeated unsolicited ARP replies from one workstation, combined with the default gateway MAC address changing every 60 seconds, directly indicate an ARP poisoning attack. The attacker is sending forged ARP replies to associate the gateway IP with its own MAC address, causing traffic destined for the gateway to be intercepted. This allows the attacker to redirect users to a fake login page without altering DNS records.

Answer

DNS poisoning, because name resolution is directing users to the wrong server.

Answer

Replay attack, because previously captured traffic is being resent to the network.

Answer

Denial of service, because the branch users cannot reliably reach websites.

Question 10

A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?

Accepted Answer

Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.. The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.

Answer

Reflected cross-site scripting, because the tester's input is being echoed back into the response.

Answer

Command injection, because the application is pausing while executing system-level sleep commands.

Answer

Session fixation, because the tester is manipulating how the application handles user input over time.

Question 11

After a workstation reboot, users see many files renamed with random extensions. A ransom note demands cryptocurrency, and Volume Shadow Copies were deleted from the machine. What malware type is most likely?

Accepted Answer

Ransomware, because the files were encrypted and payment was demanded.. The scenario describes files renamed with random extensions (indicating encryption), a ransom note demanding cryptocurrency, and deletion of Volume Shadow Copies (VSS) to prevent file recovery. These are hallmark behaviors of ransomware, specifically a crypto-ransomware variant that encrypts user data and removes backup copies to maximize extortion pressure.

Answer

Trojan, because the malware may have been disguised as a legitimate application.

Answer

Worm, because the malware likely spread automatically to other systems.

Answer

Rootkit, because the attacker would want to hide persistence on the system.

Question 12

Based on the exhibit, which security issue should the analyst report first?

Accepted Answer

Exposed service, because VNC and the web admin interface are reachable from untrusted networks.. The scan reveals that VNC (port 5900) and a web admin interface (port 443 or 8080) are exposed to untrusted networks, such as the internet. This violates the principle of least exposure, as these services are known attack vectors for remote code execution and credential theft. The analyst should prioritize this issue because an exposed service directly increases the attack surface and risk of unauthorized access, whereas other findings may be less immediately critical.

Answer

Outdated component, because the scan did not list software version details.

Answer

Weak permissions, because SSH requires password login only.

Answer

Default credentials, because the server is in the DMZ.

Question 13

After a facilities outage, multiple employees report that their phones automatically joined a network named "CorpWiFi" in the lobby even though the legitimate access point was offline. A nearby attacker device then captured the captive portal login traffic. What attack is most likely?

Accepted Answer

Evil twin. Evil twin. In this scenario, the attacker set up a rogue access point with the same SSID ("CorpWiFi") as the legitimate network, which was offline. When employees' phones automatically attempted to reconnect to a known SSID, they associated with the attacker's device, which then presented a fake captive portal to capture login credentials. This is the classic definition of an evil twin attack: a fraudulent AP that mimics a legitimate one to intercept traffic.

Answer

Rogue access point

Answer

Bluetooth bluejacking

Answer

NFC relay attack

Question 14

An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

Accepted Answer

A fileless attack that relies on trusted tools already on the system. This is a fileless attack because PowerShell, a trusted system tool, is used to download and execute encoded commands directly in memory without writing any malicious executable to disk. The attack leverages living-off-the-land binaries (LOLBins) and PowerShell's ability to run scripts in memory, bypassing traditional file-based detection mechanisms.

Answer

A worm that spreads by exploiting a network service

Answer

A logic bomb that waits for a specific date or event

Answer

A rootkit that changes kernel behavior to hide processes

Question 15

A laptop user reports that many files now have strange extensions, a ransom note appears on the desktop, and the files cannot be opened. Which malware is most likely responsible?

Accepted Answer

Ransomware. Ransomware is the correct answer because it encrypts the user's files, appends a new extension (e.g., .encrypted or .locked), and displays a ransom note demanding payment for the decryption key. The symptoms of inaccessible files with altered extensions and a visible ransom note are the classic indicators of a ransomware infection, such as those caused by CryptoLocker or LockBit.

Answer

Spyware

Answer

Rootkit

Answer

Worm