SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 14 — 15 Questions

Question 1

Several employees in a branch office report that their laptops automatically connected to a network named "CorpWiFi" even though they were away from the office. Shortly afterward, a few users saw a captive portal asking them to re-enter company credentials. Which threat best explains this situation?

Accepted Answer

Evil twin access point impersonating the legitimate wireless network. The scenario describes an evil twin attack where a rogue access point broadcasts the SSID "CorpWiFi" to trick laptops into automatically connecting. Once connected, the attacker presents a fake captive portal to harvest credentials. This exploits the fact that client devices often prioritize known SSIDs without verifying the authenticity of the access point, relying solely on the network name.

Answer

Bluetooth pairing abuse from a nearby device

Answer

DNS poisoning caused by a compromised resolver

Answer

NFC relay attack against the laptops' login process

Question 2

Based on the exhibit, which supply-chain threat is most likely?

Accepted Answer

Dependency compromise. The exhibit shows a dependency on a third-party library (e.g., a JavaScript package from a CDN or a software component from an external repository). A dependency compromise occurs when an attacker injects malicious code into that trusted third-party component, which is then pulled into the organization's environment during updates or builds. This is the most likely supply-chain threat because it directly exploits the trust placed in external dependencies.

Answer

Brute-force attack

Answer

SQL injection

Answer

Privilege escalation

Question 3

A development team updates a third-party software library used by its web application. After the release, new deployments begin making unexpected outbound connections to an unfamiliar domain. What type of threat is most likely?

Accepted Answer

Dependency compromise. The correct answer is A, dependency compromise. This scenario describes a supply chain attack where a third-party library has been maliciously altered or replaced, causing the web application to make unauthorized outbound connections to an attacker-controlled domain. Such compromises often occur when developers unknowingly integrate a tampered version of a library from a compromised repository or via a typosquatting attack, leading to data exfiltration or command-and-control (C2) communication.

Answer

Phishing

Answer

Rootkit infection

Answer

Password spraying

Question 4

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

Accepted Answer

DNS amplification DDoS. This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Answer

Replay attack

Answer

ARP poisoning

Answer

Session fixation

Question 5

A security team can patch only one system today. Which asset should be remediated first?

Accepted Answer

An internet-facing application server with a critical vulnerability and a known exploit. Option C is correct because an internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Answer

An internal print server with a high-severity finding and no direct user access

Answer

A lab workstation with a critical finding and no sensitive data

Answer

A user laptop with a medium-severity issue that requires local access

Question 6

A scanner reports a critical vulnerability on an internal Linux server. The administrator confirms the vulnerable package is installed, but the affected feature is only enabled when an optional module is loaded, and that module is currently disabled. The server also requires downtime for patching. What is the best next step?

Accepted Answer

Verify whether the vulnerable function is reachable, then apply a compensating control or schedule remediation. Option B is correct because even though the vulnerable module is disabled, the administrator must first verify that the vulnerable function is not reachable through other means (e.g., via a different service or misconfiguration). If it is unreachable, applying a compensating control (like a firewall rule or SELinux policy) can mitigate risk without immediate downtime, allowing patching to be scheduled. This aligns with the principle of defense-in-depth and proper risk management.

Answer

Immediately accept the risk and leave the server unchanged

Answer

Mark the finding as a false positive and close the ticket

Answer

Remove the server from production immediately and rebuild it from scratch

Question 7

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

Accepted Answer

Create a time-limited exception and apply compensating controls until patching is possible. Option B is correct because the vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Answer

Ignore the finding because the scanner is clearly wrong

Answer

Reinstall the disabled plugin so the scanner output matches the running configuration

Answer

Expose the server to the internet for faster monitoring and patch testing

Question 8

Based on the exhibit, what is the most likely issue with the software component being built?

Accepted Answer

Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.. The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Answer

Cross-site scripting, because the package name suggests the application handles web content.

Answer

Credential stuffing, because automated systems frequently reuse credentials during updates.

Answer

Replay attack, because the nightly pipeline used an old copy of the package request.

Question 9

Based on the exhibit, which vulnerability is being exploited?

Accepted Answer

Authentication bypass. The exhibit shows a URL parameter `?admin=false` being changed to `?admin=true`, which directly toggles an administrative access control flag. This is a classic authentication bypass vulnerability because the application trusts client-supplied input to determine authorization status, allowing an attacker to escalate privileges without valid credentials.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

Command injection

Question 10

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

Accepted Answer

An evil twin access point impersonating the real corporate wireless network. This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Answer

A Bluetooth replay attack that reuses captured pairing data

Answer

A cloud misconfiguration exposing a storage bucket to the internet

Answer

A dependency compromise in a software library used by the company portal

Question 11

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

Accepted Answer

Server-side request forgery. The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 12

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

Accepted Answer

Logic bomb triggered by a time or condition after being planted earlier. The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Answer

Worm that is automatically propagating to other endpoints

Answer

Spyware that is secretly collecting keystrokes and screenshots

Answer

Rootkit that is hiding itself in the kernel to maintain stealth

Question 13

A help desk technician receives a phone call from someone claiming to be the VP of Finance. The caller says they are in an airport, forgot their phone, and need a password reset immediately. They also ask the technician to skip callback verification because a meeting starts in five minutes. Which two details are the strongest indicators of a pretexting or vishing attempt? Select two.

Accepted Answer

the caller claims an executive title and uses authority to pressure the technician. Option A is correct because the caller's use of an executive title (VP of Finance) and urgent authority pressure is a classic social engineering tactic known as pretexting. In a vishing (voice phishing) attack, the attacker fabricates a scenario to manipulate the technician into bypassing standard security procedures. This aligns with the SY0-701 domain on threats, vulnerabilities, and mitigations, specifically social engineering techniques.

Answer

the call is routed through the company ticketing system with an approved change record

Answer

the caller answers all security questions correctly after being prompted for them

Answer

the call occurs after normal business hours on a holiday weekend

Question 14

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A indicates a critical vulnerability with a CVSS score of 9.8, which is the highest severity among the findings. Remediation should prioritize the most severe risk to minimize potential impact, as this vulnerability could allow remote code execution without authentication.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 15

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

Accepted Answer

ARP spoofing. The correct answer is B, ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Answer

Replay attack

Answer

DNS amplification

Answer

Man-in-the-middle via TLS downgrade