SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 15 — 15 Questions

Question 1

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

Accepted Answer

Fileless attack. The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Answer

Ransomware campaign

Answer

Worm propagation

Answer

Rootkit persistence

Question 2

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

Accepted Answer

Parameterize the database queries with prepared statements. The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Answer

Encode all output returned to the browser

Answer

Add CSRF tokens to the login form

Answer

Move the application to a separate VLAN

Question 3

Based on the exhibit, which attack is most likely occurring on the local network?

Accepted Answer

ARP spoofing. ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification denial-of-service

Question 4

Based on the exhibit, which attack is most likely being attempted against the application?

Accepted Answer

Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.. The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Answer

Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

Answer

Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

Answer

SQL injection, because the attacker is manipulating a query parameter to expose backend data.

Question 5

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

Accepted Answer

Logic bomb. The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Answer

Worm

Answer

Rootkit

Answer

Spyware

Question 6

Several users on the same subnet report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows ARP replies that map the gateway IP to a different MAC address. What attack is most likely occurring?

Accepted Answer

ARP spoofing, which poisons address resolution on the local network. ARP spoofing (also known as ARP poisoning) is the correct answer because the attacker sends forged ARP replies that associate the default gateway's IP address with the attacker's MAC address. This causes the victims' switches to update their ARP caches with the false mapping, so traffic destined for the gateway is instead sent to the attacker, leading to intermittent connectivity and misrouted packets. The symptoms—slow traffic and reaching the wrong device—are classic indicators of a man-in-the-middle (MITM) attack via ARP cache poisoning.

Answer

DNS amplification, which overwhelms the target with reflected DNS traffic

Answer

Replay attack, which resends captured authentication data

Answer

Port scanning, which probes hosts for open services and ports

Question 7

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

Accepted Answer

Request a risk exception and document compensating controls until patching is possible. Option B is correct because the vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Answer

Ignore the finding because the scanner produced a false positive

Answer

Disable the vulnerability scanner to prevent repeated alerts

Answer

Immediately retire the server even though the application is still business-critical

Question 8

Several users on the same subnet report intermittent loss of access to the default gateway. A packet capture shows repeated unsolicited ARP replies mapping the gateway IP address to a different MAC address. Traffic is occasionally sent through an unknown workstation. What attack is most likely occurring?

Accepted Answer

ARP poisoning. The attack is ARP poisoning (also known as ARP spoofing). The attacker sends unsolicited ARP replies to associate the gateway's IP address with the attacker's MAC address, causing traffic destined for the gateway to be redirected through the attacker's workstation. This results in intermittent connectivity as the attacker can forward or drop packets, and the repeated unsolicited replies overwrite the legitimate ARP cache entries on the victim hosts.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification attack

Question 9

Based on the exhibit, which finding should the security team remediate first?

Accepted Answer

WEB01 because it is internet-facing and has a critical exploitable vulnerability. WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.

Answer

LAP09 because user devices are always the easiest to patch

Answer

PRN01 because firmware issues can affect many users

Answer

FILE02 because internal servers are always more important than public ones

Question 10

Based on the exhibit, which malware type best explains the behavior?

Accepted Answer

Rootkit. A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.

Answer

Trojan

Answer

Logic bomb

Answer

Spyware

Question 11

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 12

A help desk analyst receives a ticket stating that an employee got an urgent text message from someone claiming to be the CEO. The message asked the employee to buy gift cards and send the redemption codes immediately. What attack is most likely taking place?

Accepted Answer

Smishing, because the attacker is using SMS or text messaging to trick the employee into taking an action.. Option B is correct because the attack uses SMS/text messaging as the delivery vector, which is the defining characteristic of smishing. The urgent request to buy gift cards and send redemption codes is a classic social engineering tactic designed to exploit the employee's trust in the CEO's authority, not to steal credentials or install malware directly.

Answer

Phishing, because the attacker is trying to steal information through a deceptive message sent to a user.

Answer

Vishing, because the attacker is using a phone call to pressure the employee into complying.

Answer

Baiting, because the attacker is tempting the user with a reward in exchange for cooperation.

Question 13

During testing of a shopping portal, a POST request to /api/address/update succeeds even when the anti-CSRF token is removed. In a separate test, changing customerId=1842 to customerId=1843 in a GET request returns another user's invoice data. Which two vulnerabilities are present? Select two.

Accepted Answer

Cross-site request forgery is present because the state-changing request works without a valid anti-CSRF token.. Option A is correct because the POST request to /api/address/update succeeds without the anti-CSRF token, which means the application does not validate the origin of the request. This allows an attacker to forge a cross-site request that changes the victim's address without their knowledge, a classic CSRF vulnerability.

Answer

SQL injection is present because the customerId value changes in the URL.

Answer

Cross-site scripting is present because the invoice data is returned in the browser.

Answer

Insecure deserialization is present because the request uses JSON-like parameters.

Question 14

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Accepted Answer

A process injects into explorer.exe and monitors keyboard and clipboard activity.. Option A is correct because process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Answer

User files are renamed with a new extension and a ransom note appears.

Answer

CPU usage spikes only during a scheduled operating system update.

Answer

The browser certificate store was refreshed after applying a patch.

Question 15

A vulnerability scan reports three findings: a critical remote code execution issue on an internet-facing VPN appliance with a public exploit, a high-severity local privilege escalation on an isolated lab PC, and a medium-severity outdated browser plug-in on a workstation used for training. Which finding should be remediated first?

Accepted Answer

The internet-facing VPN appliance, because it combines critical severity, exposure, and public exploit availability.. The internet-facing VPN appliance should be remediated first because it combines a critical severity rating, direct exposure to the internet, and a publicly available exploit. This creates an immediate and high-probability risk of remote code execution, which could lead to full compromise of the network perimeter. In contrast, the other findings are isolated or lower severity, making them less urgent.

Answer

The isolated lab PC, because local privilege escalation is always the highest technical severity.

Answer

The training workstation, because browser plug-ins are common entry points for attackers.

Answer

None of them, because all vulnerability findings should wait for the next planned maintenance cycle.

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 15 — 15 Questions

Exhibit

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 15 — 15 Questions

Exhibit