SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 14 — 15 Questions

Question 1

A public website is overwhelmed by a flood of DNS responses arriving from many open resolvers after the attacker sends small forged queries to those resolvers. The target bandwidth is saturated and the source IPs vary widely. What kind of attack is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS amplification DDoS. B is correct because this scenario describes a DNS amplification DDoS attack. The attacker sends small forged DNS queries with a spoofed source IP (the victim's IP) to open resolvers, which respond with much larger DNS replies. The flood of amplified responses saturates the victim's bandwidth, and the varying source IPs make mitigation difficult. This matches the description of a reflection/amplification attack using DNS.

Answer

SYN flood

Answer

Replay attack

Answer

Man-in-the-middle attack

Question 2

A help desk technician receives an SMS claiming to be from the mobile carrier. The message says the user's corporate number will be suspended unless they open a link and confirm an MFA code. The user has not reported any account issues. What attack is this?

Accepted Answer

Smishing. Smishing is a phishing attack conducted via SMS (Short Message Service). The message impersonates the mobile carrier, creates urgency by threatening suspension, and lures the user to a malicious link to capture MFA codes or credentials. Since the attack vector is SMS, not email or voice, this is smishing.

Answer

Spear phishing

Answer

Vishing

Answer

Baiting

Question 3

A support portal has a search field that accepts customer last names. After a tester enters a single quote, the application returns a database syntax error. Which attack is the tester most likely trying to verify?

Accepted Answer

SQL injection. The tester is most likely trying to verify a SQL injection vulnerability. Entering a single quote into a search field that interacts with a database can break the SQL query syntax if user input is improperly sanitized, causing the database to return a syntax error. This error indicates that the input is being directly concatenated into a SQL statement, confirming the presence of a SQL injection flaw.

Answer

Cross-site scripting (XSS)

Answer

CSRF

Answer

SSRF

Question 4

Based on the exhibit, which attack is the developer most likely observing?

Accepted Answer

Server-side request forgery (SSRF). The developer is most likely observing a server-side request forgery (SSRF) attack because the log shows the application making an outbound HTTP request to an internal IP address (10.0.0.1) initiated by user-supplied input (the 'url' parameter). SSRF occurs when an attacker manipulates the server to send crafted requests to internal or external resources, bypassing access controls. The exhibit's pattern of a server-side request to a private IP range directly indicates SSRF, not client-side or database attacks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

CSRF

Question 5

A SOC analyst reviews an EDR alert on a finance workstation. The alert shows powershell.exe launched with an encoded command, downloaded a payload into memory, and then spawned rundll32.exe. No new executable was written to disk, but the process later created a scheduled task for persistence. Which two findings most strongly support a fileless attack? Select two.

Accepted Answer

powershell.exe launched with an encoded command and executed the payload in memory. Executing a PowerShell encoded command that downloads and runs a payload entirely in memory, without writing to disk, is a hallmark of fileless malware. This technique avoids traditional file-based detection by leveraging PowerShell's ability to load and execute scripts directly in memory, bypassing disk-based antivirus scans.

Answer

a new portable executable was written to the user's temporary folder before being run

Answer

the endpoint antivirus quarantined the payload after a signature match

Answer

a USB storage device was inserted shortly before the alert fired

Question 6

An employee receives an email that appears to come from the HR team. It says their payroll account will be suspended unless they click a link and sign in within 30 minutes. What type of attack is this most likely?

Accepted Answer

Phishing. This is a classic phishing attack because the threat actor uses a deceptive email message to trick the recipient into clicking a malicious link and providing sensitive credentials. Phishing specifically refers to social engineering attacks delivered via email, often leveraging urgency and impersonation of a trusted entity like HR to bypass the victim's critical thinking.

Answer

Smishing

Answer

Vishing

Answer

Pretexting

Question 7

An EDR console shows PowerShell launching from a scheduled task, decoding a command from memory, and spawning rundll32.exe. No suspicious executable is written to disk, and the activity stops when the process ends. Which threat best fits this behavior?

Accepted Answer

Fileless malware. The behavior describes PowerShell decoding a command from memory and spawning rundll32.exe without writing any executable to disk, which is the hallmark of fileless malware. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and rundll32) to execute malicious code, and it leaves no persistent file on the filesystem, so activity ceases when the process ends.

Answer

Trojan downloader

Answer

Rootkit

Answer

Worm

Question 8

A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?

Accepted Answer

SQL injection, because the input may be altering the database query. The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.

Answer

Cross-site scripting, because the page is executing malicious JavaScript in the browser

Answer

Server-side request forgery, because the server is making internal network calls

Answer

Cross-site request forgery, because the user is being tricked into submitting a form

Question 9

After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?

Accepted Answer

Supply-chain compromise. The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.

Answer

Evil twin access point

Answer

Bluetooth pairing abuse

Answer

DNS poisoning on the client network

Question 10

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

Accepted Answer

Evil twin access point impersonating the legitimate wireless network. The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Answer

Bluetooth pairing abuse from a nearby device

Answer

DNS poisoning caused by a compromised resolver

Answer

NFC relay attack against the laptops' login process

Question 11

Based on the exhibit, which supply-chain threat is most likely?

Accepted Answer

Dependency compromise. The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Answer

Brute-force attack

Answer

SQL injection

Answer

Privilege escalation

Question 12

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

Accepted Answer

Dependency compromise. Dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Answer

Phishing

Answer

Rootkit infection

Answer

Password spraying

Question 13

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

Accepted Answer

DNS amplification DDoS. This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Answer

Replay attack

Answer

ARP poisoning

Answer

Session fixation

Question 14

A security team can patch only one system today. Which asset should be remediated first?

Accepted Answer

An internet-facing application server with a critical vulnerability and a known exploit. An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Answer

An internal print server with a high-severity finding and no direct user access

Answer

A lab workstation with a critical finding and no sensitive data

Answer

A user laptop with a medium-severity issue that requires local access

Question 15

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Accepted Answer

Create a time-limited exception and apply compensating controls until patching is possible. The vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Answer

Ignore the finding because the scanner is clearly wrong

Answer

Reinstall the disabled plugin so the scanner output matches the running configuration

Answer

Expose the server to the internet for faster monitoring and patch testing