SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 16 — 15 Questions

Question 1

A branch office reports intermittent failures reaching internal sites. DHCP logs show clients receiving leases from an unknown MAC address, and DNS responses for intranet.example resolve to an address owned by the same device. Which two attacks best match the evidence? Select two.

Accepted Answer

A rogue DHCP server is issuing unauthorized lease information.. A rogue DHCP server on the network can issue unauthorized lease information, causing clients to receive IP configurations from an unknown MAC address. This matches the DHCP log evidence and can lead to intermittent connectivity issues as clients receive conflicting or incorrect network settings.

Answer

A SYN flood is exhausting the DHCP service.

Answer

A port scan is enumerating exposed services on the branch subnet.

Answer

Password spraying is attempting many logins with common passwords.

Question 2

A vulnerability scan produces these results:
- Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls
- Finding 2: Critical severity, internal development workstation, requires authenticated local access
- Finding 3: Medium severity, test server, no public exploit and not reachable from outside
Which finding should be remediated first?

Accepted Answer

Finding 1. Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.

Answer

Finding 2

Answer

Finding 3

Answer

All findings are equal because the severity rating alone determines priority

Question 3

Users on the internal Wi-Fi report that the finance portal suddenly resolves to a different IP address, and the browser shows a fake login page that closely matches the real site. The DNS resolver cache on the network also contains unexpected entries for that host name. What attack is most likely?

Accepted Answer

DNS poisoning, because the attacker has corrupted name resolution so users are sent to a malicious destination.. B is correct because DNS poisoning (also known as DNS cache poisoning) directly corrupts the name resolution process, causing the finance portal's hostname to resolve to a malicious IP address. The presence of unexpected DNS resolver cache entries for that hostname confirms that the attack targeted the DNS infrastructure, not the ARP table or network availability.

Answer

ARP spoofing, because the attacker is changing the MAC address used on the local network.

Answer

Port scanning, because the attacker is probing internal services for open ports.

Answer

Denial-of-service, because the attacker is overwhelming the portal with traffic.

Question 4

A support agent notices that changing `invoiceId=8842` to `invoiceId=8843` in a portal URL returns another customer's invoice PDF without any additional login prompt. The user is already authenticated to the application. Which vulnerability is most likely present?

Accepted Answer

Broken access control. The vulnerability is broken access control (B) because the application fails to verify that the authenticated user is authorized to access the resource identified by `invoiceId=8843`. By simply changing a numeric parameter in the URL, the user can view another customer's invoice PDF without any additional authentication or authorization check. This is a classic insecure direct object reference (IDOR) flaw, which falls under the broader category of broken access control.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 5

A SOC analyst reviews a suspicious email about an overdue invoice. The display name matches a known supplier, but the envelope sender is from a free webmail domain, and the Reply-To address uses a look-alike domain with one swapped letter. The message also includes a company logo and a PDF attachment. Which two findings are the strongest indicators of a phishing attempt? Select two.

Accepted Answer

The display name matches the supplier, but the envelope sender is from a free webmail provider.. Option A is correct because the envelope sender (the actual origin address in the SMTP MAIL FROM command) being from a free webmail domain while the display name matches a known supplier is a classic phishing red flag. Legitimate business invoices are almost never sent from free webmail providers like Gmail or Yahoo, as organizations use their own domains for official correspondence. This mismatch between the visible display name and the actual sender address indicates spoofing.

Answer

The message was transmitted over TLS to the recipient's mail gateway.

Answer

The email contains a PDF invoice attachment with a normal business filename.

Answer

The message includes the supplier's logo and a standard-looking signature block.

Question 6

A firewall analyst reviews logs and sees one external IP address sending connection attempts to TCP ports 22, 80, 139, 445, and 3389 on dozens of internal hosts every few seconds. No payloads are delivered and no sessions are established. What is the most likely activity?

Accepted Answer

Port scanning, because the source is systematically probing many ports and hosts for exposed services.. The observed behavior—a single external IP sending connection attempts to multiple TCP ports (22, 80, 139, 445, 3389) across many internal hosts at regular intervals—is the hallmark of a port scan. The absence of payload delivery or session establishment confirms the attacker is only probing for open services, not attempting exploitation or data transfer. This matches the definition of a reconnaissance activity, specifically a horizontal port scan targeting common service ports.

Answer

Reflection-based denial-of-service, because the attacker is using third-party systems to amplify traffic.

Answer

Man-in-the-middle, because the attacker is intercepting communications between internal hosts.

Answer

Protocol abuse, because the attacker is sending malformed traffic to crash services.

Question 7

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Accepted Answer

PowerShell was launched with encoded, hidden execution arguments from a document process.. Option A is correct because the use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Answer

A new executable named updater.exe was copied into Program Files by an administrator.

Answer

The browser cache was cleared after a routine user sign-out.

Answer

A signed video driver updated successfully through Windows Update.

Question 8

Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?

Accepted Answer

ARP spoofing. B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.

Answer

DNS poisoning

Answer

MAC flooding

Answer

SYN flood

Question 9

An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Accepted Answer

Fileless attack. The EDR console shows mshta.exe (a Microsoft binary for executing HTML Applications) launching PowerShell from a user profile directory, followed by a script that never writes a new executable to disk. This is classic fileless malware behavior, where the malicious payload runs entirely in memory (e.g., via PowerShell or .NET reflection) without dropping a file, making it harder for traditional signature-based antivirus to detect. The subsequent outbound HTTPS connections to an unfamiliar IP indicate command-and-control (C2) communication, consistent with a fileless attack that persists only in memory.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 10

A file server suddenly shows renamed files with a new extension, users see a ransom note demanding cryptocurrency, and shadow copies are deleted from the host. Which malware family is the best match?

Accepted Answer

Ransomware, because the attacker is encrypting data and demanding payment to restore access.. Ransomware is the correct classification because the scenario describes file encryption (renamed files with new extensions), a ransom note demanding cryptocurrency, and the deletion of shadow copies (Volume Shadow Copy Service snapshots) to prevent file recovery. These are hallmark behaviors of ransomware, specifically crypto-ransomware, which encrypts data and demands payment for decryption keys.

Answer

Trojan, because the attack requires a disguised program to install itself.

Answer

Spyware, because the attacker is likely trying to monitor file activity.

Answer

Logic bomb, because the malware likely triggered after a specific condition was met.

Question 11

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Accepted Answer

ARP spoofing or poisoning is occurring on the local network.. Option A is correct because the evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Answer

The network is experiencing a SYN flood against the gateway.

Answer

An external host is performing broad port scanning on public services.

Answer

A password-spraying campaign is targeting remote logins.

Question 12

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

Accepted Answer

Vishing. The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Answer

Phishing

Answer

Baiting

Answer

Watering hole attack

Question 13

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

Accepted Answer

Rootkit. The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Answer

Spyware

Answer

Trojan

Answer

Logic bomb

Question 14

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to manipulate the target in real time.. The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Answer

Smishing, because the attacker requested a code and mentioned a financial problem.

Answer

Baiting, because the caller offered to fix the payment issue for the employee.

Answer

Tailgating, because the attacker used a trusted identity to gain access.

Question 15

An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?

Accepted Answer

Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.. The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.

Answer

Worm behavior, because the malware is automatically spreading across the network.

Answer

Rootkit behavior, because the attacker is hiding from the operating system at a low level.

Answer

Spyware, because the malware is using HTTPS traffic to contact an external domain.