SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 16 — 15 Questions

Question 1

Based on the exhibit, which finding should the security team remediate first?

Accepted Answer

WEB01 because it is internet-facing and has a critical exploitable vulnerability. WEB01 is internet-facing and has a critical exploitable vulnerability, meaning an attacker can directly compromise it from the public internet with minimal effort. This represents the highest risk because it combines high likelihood (exploit available) with high impact (full compromise of a public-facing server). Remediating this first aligns with the principle of prioritizing externally exposed systems with known critical flaws over internal or less severe issues.

Answer

LAP09 because user devices are always the easiest to patch

Answer

PRN01 because firmware issues can affect many users

Answer

FILE02 because internal servers are always more important than public ones

Question 2

Based on the exhibit, which malware type best explains the behavior?

Accepted Answer

Rootkit. A rootkit is designed to hide its presence and the presence of other malware by modifying the operating system's kernel or system calls, allowing it to evade detection by security tools. The exhibit likely shows behavior such as file hiding, process concealment, or system call interception, which are hallmarks of rootkit activity. This aligns with the SY0-701 objective on understanding malware types and their characteristics.

Answer

Trojan

Answer

Logic bomb

Answer

Spyware

Question 3

A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Accepted Answer

Fileless attack. The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.

Answer

Trojan

Answer

Rootkit

Answer

Worm

Question 4

A help desk analyst receives a ticket stating that an employee got an urgent text message from someone claiming to be the CEO. The message asked the employee to buy gift cards and send the redemption codes immediately. What attack is most likely taking place?

Accepted Answer

Smishing, because the attacker is using SMS or text messaging to trick the employee into taking an action.. The attack uses SMS/text messaging as the delivery vector, which is the defining characteristic of smishing. The urgent request to buy gift cards and send redemption codes is a classic social engineering tactic designed to exploit the employee's trust in the CEO's authority, not to steal credentials or install malware directly.

Answer

Phishing, because the attacker is trying to steal information through a deceptive message sent to a user.

Answer

Vishing, because the attacker is using a phone call to pressure the employee into complying.

Answer

Baiting, because the attacker is tempting the user with a reward in exchange for cooperation.

Question 5

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Accepted Answer

A process injects into explorer.exe and monitors keyboard and clipboard activity.. Process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Answer

User files are renamed with a new extension and a ransom note appears.

Answer

CPU usage spikes only during a scheduled operating system update.

Answer

The browser certificate store was refreshed after applying a patch.

Question 6

A vulnerability scan reports three findings: a critical remote code execution issue on an internet-facing VPN appliance with a public exploit, a high-severity local privilege escalation on an isolated lab PC, and a medium-severity outdated browser plug-in on a workstation used for training. Which finding should be remediated first?

Accepted Answer

The internet-facing VPN appliance, because it combines critical severity, exposure, and public exploit availability.. The internet-facing VPN appliance should be remediated first because it combines a critical severity rating, direct exposure to the internet, and a publicly available exploit. This creates an immediate and high-probability risk of remote code execution, which could lead to full compromise of the network perimeter. In contrast, the other findings are isolated or lower severity, making them less urgent.

Answer

The isolated lab PC, because local privilege escalation is always the highest technical severity.

Answer

The training workstation, because browser plug-ins are common entry points for attackers.

Answer

None of them, because all vulnerability findings should wait for the next planned maintenance cycle.

Question 7

A vulnerability scan produces these results:
- Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls
- Finding 2: Critical severity, internal development workstation, requires authenticated local access
- Finding 3: Medium severity, test server, no public exploit and not reachable from outside
Which finding should be remediated first?

Accepted Answer

Finding 1. Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Answer

Finding 2

Answer

Finding 3

Answer

All findings are equal because the severity rating alone determines priority

Question 8

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

Accepted Answer

DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.. B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Answer

ARP spoofing, because the attacker is changing the MAC address used on the local network.

Answer

Port scanning, because the attacker is probing internal services for open ports.

Answer

Denial-of-service, because the attacker is overwhelming the portal with traffic.

Question 9

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

Accepted Answer

Broken access control. The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 10

A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?

Accepted Answer

Port scanning, because the source is systematically probing many ports and hosts for exposed services.. The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.

Answer

Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.

Answer

Man-in-the-middle, because the attacker is intercepting communications between internal hosts.

Answer

Protocol abuse, because the attacker is sending malformed traffic to crash services.

Question 11

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Accepted Answer

PowerShell was launched with encoded, hidden execution arguments from a document process.. The use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Answer

A new executable named updater.exe was copied into Program Files by an administrator.

Answer

The browser cache was cleared after a routine user sign-out.

Answer

A signed video driver updated successfully through Windows Update.

Question 12

Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?

Accepted Answer

ARP spoofing. B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.

Answer

DNS poisoning

Answer

MAC flooding

Answer

SYN flood

Question 13

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Accepted Answer

Fileless attack. The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 14

A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Accepted Answer

Ransomware, because the attacker is encrypting data and demanding payment to restore access.. Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.

Answer

Trojan, because the attack requires a disguised program to install itself.

Answer

Spyware, because the attacker is likely trying to monitor file activity.

Answer

Logic bomb, because the malware likely triggered after a specific condition was met.

Question 15

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Accepted Answer

ARP spoofing or poisoning is occurring on the local network.. The evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Answer

The network is experiencing a SYN flood against the gateway.

Answer

An external host is performing broad port scanning on public services.

Answer

A password-spraying campaign is targeting remote logins.