SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 17 — 15 Questions

Question 1

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

Accepted Answer

Smishing. This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Answer

Pretexting

Answer

Tailgating

Answer

Spoofing

Question 2

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

Accepted Answer

SQL injection, because the attacker is altering the database query through crafted input.. The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Answer

Cross-site scripting, because malicious code is being reflected in the browser.

Answer

Cross-site request forgery, because the request appears to be an unauthorized action.

Answer

Broken access control, because the API is not validating the user role correctly.

Question 3

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

Accepted Answer

DNS poisoning. The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Answer

Brute-force authentication

Answer

Port scanning

Answer

Packet sniffing

Question 4

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

Accepted Answer

Phishing, because the attacker is using a fraudulent message to steal credentials.. This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Answer

Baiting, because the attacker is offering something attractive to lure the user.

Answer

Vishing, because the attacker is trying to trick the user into revealing information.

Answer

Impersonation, because the attacker is pretending to be someone from the company.

Question 5

A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.

Accepted Answer

The message creates a short deadline and pressures the user to act quickly.. Option A is correct because phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.

Answer

The message includes the company's logo and professional-looking formatting.

Answer

The email refers to a shared document that the user should review.

Answer

The message was received during normal business hours.

Question 6

A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.

Accepted Answer

Smishing is used because the first lure arrives by text message.. Option B is correct because the initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.

Answer

Email phishing is used because the attacker is requesting a login action.

Answer

Baiting is used because the attacker offers a free reward or device.

Answer

Tailgating is used because the attacker follows someone into a restricted area.

Question 7

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

Accepted Answer

DNS amplification reflection denial-of-service.. This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Answer

DNS zone transfer abuse against the organization.

Answer

A replay attack against a web application session token.

Answer

ARP poisoning inside the local network segment.

Question 8

A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?

Accepted Answer

Implement breached-password screening plus MFA.. Option B is correct because the attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.

Answer

Increase password length requirements only.

Answer

Disable account lockouts to avoid user inconvenience.

Answer

Allow unlimited retries so legitimate users are never blocked.

Question 9

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Accepted Answer

Use parameterized queries or prepared statements for all database access.. Option A is correct because parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.

Answer

Store the database password in the page source so the app can connect faster.

Answer

Disable TLS so the application can inspect requests more easily.

Answer

Allow the application to build SQL statements by concatenating raw user input.

Question 10

A finance team receives emails that appear to come from the CEO's assistant and ask them to review a document. Several users entered their passwords on a fake login page, and the attackers then signed in from a new country using the same credentials. Which control most directly reduces successful account takeover if a password is stolen?

Accepted Answer

Use phishing-resistant MFA such as FIDO2 or WebAuthn.. Phishing-resistant MFA, such as FIDO2 or WebAuthn, directly prevents account takeover even when a password is stolen because these methods use public-key cryptography and origin-bound credentials. The fake login page cannot intercept the private key or replay the authentication, so the attacker cannot sign in from a new country despite having the password.

Answer

Require password changes every 30 days for all users.

Answer

Turn off all external email to eliminate the chance of future messages.

Answer

Use single sign-on without MFA so users authenticate only once.

Question 11

A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?

Accepted Answer

Use parameterized queries or prepared statements in the application code.. Option B is correct because parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.

Answer

Deploy only a web application firewall and keep the code unchanged.

Answer

Store the database password as a salted hash in the application configuration.

Answer

Disable HTTPS so the request body is easier to inspect by network tools.

Question 12

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

Accepted Answer

Enable SMB signing and remove anonymous access to the share.. Option C is correct because enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Answer

Remove all backup jobs until the scan is cleared.

Answer

Disable the file server and rebuild it from scratch immediately.

Answer

Increase the directory quota so the share cannot overflow.

Question 13

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

Accepted Answer

Isolate the affected systems from the network and preserve evidence.. Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Answer

Pay the ransom immediately to restore access quickly.

Answer

Reimage the server immediately without documenting the event.

Answer

Disable antivirus alerts so staff can work without distractions.

Question 14

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

Accepted Answer

Move the console to a separate management network and restrict access to admin hosts only.. The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Answer

Increase the number of shared passwords so administrators can log in faster.

Answer

Leave the console exposed but shorten the password expiration period.

Answer

Disable logging so failed attempts do not generate noise.

Question 15

An EDR alert shows a Windows workstation used certutil.exe to download an encoded script, then created a scheduled task named UpdateCheck that runs every 15 minutes. The machine is also making short HTTPS connections to the same external IP. What is the best description of what the attacker is doing?

Accepted Answer

Living-off-the-land abuse with persistence through a scheduled task is occurring.. Option B is correct because the attacker is using certutil.exe, a native Windows tool, to download an encoded script (living-off-the-land), and then creating a scheduled task named UpdateCheck to maintain persistence by running every 15 minutes. This combination of abusing trusted binaries and establishing a recurring task is a classic indicator of LOTL abuse with persistence.

Answer

A buffer overflow exploit is likely corrupting memory in the operating system.

Answer

The evidence most strongly suggests a drive-by download from a compromised browser session.

Answer

A man-in-the-middle attack is intercepting and modifying the TLS session.