SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 15 — 15 Questions

Question 1

Based on the exhibit, what is the most likely issue with the software component being built?

Accepted Answer

Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.. The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Answer

Cross-site scripting, because the package name suggests the application handles web content.

Answer

Credential stuffing, because automated systems frequently reuse credentials during updates.

Answer

Replay attack, because the nightly pipeline used an old copy of the package request.

Question 2

Based on the exhibit, which vulnerability is being exploited?

Accepted Answer

Authentication bypass. The exhibit shows a URL parameter `?admin=false` being changed to `?admin=true`, which directly toggles an administrative access control flag. This is a classic authentication bypass vulnerability because the application trusts client-supplied input to determine authorization status, allowing an attacker to escalate privileges without valid credentials.

Answer

Cross-site scripting (XSS)

Answer

Cross-site request forgery (CSRF)

Answer

Command injection

Question 3

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

Accepted Answer

An evil twin access point impersonating the real corporate wireless network. This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Answer

A Bluetooth replay attack that reuses captured pairing data

Answer

A cloud misconfiguration exposing a storage bucket to the internet

Answer

A dependency compromise in a software library used by the company portal

Question 4

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

Accepted Answer

Server-side request forgery. The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 5

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

Accepted Answer

Logic bomb triggered by a time or condition after being planted earlier. The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Answer

Worm that is automatically propagating to other endpoints

Answer

Spyware that is secretly collecting keystrokes and screenshots

Answer

Rootkit that is hiding itself in the kernel to maintain stealth

Question 6

A help desk technician receives a phone call from someone claiming to be the VP of Finance. The caller says they are in an airport, forgot their phone, and need a password reset immediately. They also ask the technician to skip callback verification because a meeting starts in five minutes. Which two details are the strongest indicators of a pretexting or vishing attempt? Select two.

Accepted Answer

the caller claims an executive title and uses authority to pressure the technician. The caller's use of an executive title (VP of Finance) and urgent authority pressure is a classic social engineering tactic known as pretexting. In a vishing (voice phishing) attack, the attacker fabricates a scenario to manipulate the technician into bypassing standard security procedures. This aligns with the SY0-701 domain on threats, vulnerabilities, and mitigations, specifically social engineering techniques.

Answer

the call is routed through the company ticketing system with an approved change record

Answer

the caller answers all security questions correctly after being prompted for them

Answer

the call occurs after normal business hours on a holiday weekend

Question 7

Based on the exhibit, which finding should be remediated first?

Accepted Answer

Finding A. Finding A is prioritized first because it represents the highest overall risk when considering exploitability, potential impact, and asset criticality. While CVSS scores are a factor, remediation decisions should weigh the likelihood of exploitation and the severity of consequences; Finding A poses an immediate and severe threat that could lead to significant compromise, thereby requiring urgent action.

Answer

Finding B

Answer

Finding C

Answer

Finding D

Question 8

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

Accepted Answer

ARP spoofing. ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Answer

Replay attack

Answer

DNS amplification

Answer

Man-in-the-middle via TLS downgrade

Question 9

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

Accepted Answer

Fileless attack. The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Answer

Ransomware campaign

Answer

Worm propagation

Answer

Rootkit persistence

Question 10

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

Accepted Answer

Parameterize the database queries with prepared statements. The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Answer

Encode all output returned to the browser

Answer

Add CSRF tokens to the login form

Answer

Move the application to a separate VLAN

Question 11

Based on the exhibit, which attack is most likely occurring on the local network?

Accepted Answer

ARP spoofing. ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification denial-of-service

Question 12

Based on the exhibit, which attack is most likely being attempted against the application?

Accepted Answer

Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.. The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Answer

Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

Answer

Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

Answer

SQL injection, because the attacker is manipulating a query parameter to expose backend data.

Question 13

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

Accepted Answer

Logic bomb. The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Answer

Worm

Answer

Rootkit

Answer

Spyware

Question 14

A vulnerability scan reports a critical finding on a legacy application server. The security team verifies that the flagged package is installed, but the vulnerable code path is disabled by configuration and cannot be exploited in the current deployment. The vendor will not support a patch until next quarter. What is the best next step?

Accepted Answer

Request a risk exception and document compensating controls until patching is possible. The vulnerability is real (the package is installed), but the risk is mitigated by a compensating control (the vulnerable code path is disabled). A risk exception formally documents this compensating control and the planned patch timeline, ensuring the finding is tracked and not forgotten. This aligns with the SY0-701 objective of managing risk through formal acceptance and compensating controls when immediate remediation is not possible.

Answer

Ignore the finding because the scanner produced a false positive

Answer

Disable the vulnerability scanner to prevent repeated alerts

Answer

Immediately retire the server even though the application is still business-critical

Question 15

Several users on the same subnet report intermittent loss of access to the default gateway. A packet capture shows repeated unsolicited ARP replies mapping the gateway IP address to a different MAC address. Traffic is occasionally sent through an unknown workstation. What attack is most likely occurring?

Accepted Answer

ARP poisoning. The attack is ARP poisoning (also known as ARP spoofing). The attacker sends unsolicited ARP replies to associate the gateway's IP address with the attacker's MAC address, causing traffic destined for the gateway to be redirected through the attacker's workstation. This results in intermittent connectivity as the attacker can forward or drop packets, and the repeated unsolicited replies overwrite the legitimate ARP cache entries on the victim hosts.

Answer

DNS cache poisoning

Answer

Replay attack

Answer

Amplification attack