SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 17 — 15 Questions

Question 1

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vishing. The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Answer

Phishing

Answer

Baiting

Answer

Watering hole attack

Question 2

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

Accepted Answer

Rootkit. The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Answer

Spyware

Answer

Trojan

Answer

Logic bomb

Question 3

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to manipulate the target in real time.. The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Answer

Smishing, because the attacker requested a code and mentioned a financial problem.

Answer

Baiting, because the caller offered to fix the payment issue for the employee.

Answer

Tailgating, because the attacker used a trusted identity to gain access.

Question 4

An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?

Accepted Answer

Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.. The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.

Answer

Worm behavior, because the malware is automatically spreading across the network.

Answer

Rootkit behavior, because the attacker is hiding from the operating system at a low level.

Answer

Spyware, because the malware is using HTTPS traffic to contact an external domain.

Question 5

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

Accepted Answer

Smishing. This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Answer

Pretexting

Answer

Tailgating

Answer

Spoofing

Question 6

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

Accepted Answer

SQL injection, because the attacker is altering the database query through crafted input.. The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Answer

Cross-site scripting, because malicious code is being reflected in the browser.

Answer

Cross-site request forgery, because the request appears to be an unauthorized action.

Answer

Broken access control, because the API is not validating the user role correctly.

Question 7

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

Accepted Answer

DNS poisoning. The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Answer

Brute-force authentication

Answer

Port scanning

Answer

Packet sniffing

Question 8

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

Accepted Answer

Phishing, because the attacker is using a fraudulent message to steal credentials.. This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Answer

Baiting, because the attacker is offering something attractive to lure the user.

Answer

Vishing, because the attacker is trying to trick the user into revealing information.

Answer

Impersonation, because the attacker is pretending to be someone from the company.

Question 9

A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.

Accepted Answer

The message creates a short deadline and pressures the user to act quickly.. Phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.

Answer

The message includes the company's logo and professional-looking formatting.

Answer

The email refers to a shared document that the user should review.

Answer

The message was received during normal business hours.

Question 10

A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.

Accepted Answer

Smishing is used because the first lure arrives by text message.. The initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.

Answer

Email phishing is used because the attacker is requesting a login action.

Answer

Baiting is used because the attacker offers a free reward or device.

Answer

Tailgating is used because the attacker follows someone into a restricted area.

Question 11

A public web server becomes unreachable during an outage. Netflow shows a large number of DNS responses arriving from many open resolvers, while the server itself only sent tiny spoofed DNS queries with the victim's address as the source. What type of attack is this?

Accepted Answer

DNS amplification reflection denial-of-service.. This is a classic DNS amplification reflection DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's address) to open resolvers, which then send large DNS responses to the victim, overwhelming its bandwidth. The NetFlow data shows the server receiving many large DNS responses while only sending tiny spoofed queries, confirming the amplification and reflection vectors.

Answer

DNS zone transfer abuse against the organization.

Answer

A replay attack against a web application session token.

Answer

ARP poisoning inside the local network segment.

Question 12

A SOC analyst sees many login attempts against one SaaS account from hundreds of IPs over 20 minutes. Most passwords are valid-looking, but only a few result in successful logons, and the successful attempts use a password pattern that was exposed in a public breach list. What is the best mitigation to reduce this attack?

Accepted Answer

Implement breached-password screening plus MFA.. The attack uses passwords from a public breach list, so breached-password screening would block those known compromised passwords. Additionally, MFA would stop the attacker even if they use a valid breached password, as they lack the second factor. This combination directly addresses the two key weaknesses: reused breached passwords and the lack of additional authentication.

Answer

Increase password length requirements only.

Answer

Disable account lockouts to avoid user inconvenience.

Answer

Allow unlimited retries so legitimate users are never blocked.

Question 13

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Accepted Answer

Use parameterized queries or prepared statements for all database access.. Parameterized queries and prepared statements separate SQL logic from user-supplied data, ensuring that input is treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL commands into the query string, as the database driver automatically escapes or binds parameters safely. This is the most effective defense against SQL injection attacks.

Answer

Store the database password in the page source so the app can connect faster.

Answer

Disable TLS so the application can inspect requests more easily.

Answer

Allow the application to build SQL statements by concatenating raw user input.

Question 14

A finance team receives emails that appear to come from the CEO's assistant and ask them to review a document. Several users entered their passwords on a fake login page, and the attackers then signed in from a new country using the same credentials. Which control most directly reduces successful account takeover if a password is stolen?

Accepted Answer

Use phishing-resistant MFA such as FIDO2 or WebAuthn.. Phishing-resistant MFA, such as FIDO2 or WebAuthn, directly prevents account takeover even when a password is stolen because these methods use public-key cryptography and origin-bound credentials. The fake login page cannot intercept the private key or replay the authentication, so the attacker cannot sign in from a new country despite having the password.

Answer

Require password changes every 30 days for all users.

Answer

Turn off all external email to eliminate the chance of future messages.

Answer

Use single sign-on without MFA so users authenticate only once.

Question 15

A developer reports that a search field returns all customer records when they enter a single quote followed by OR 1=1. Security confirms the web app concatenates user input directly into SQL statements. Which remediation is best?

Accepted Answer

Use parameterized queries or prepared statements in the application code.. Parameterized queries or prepared statements separate SQL logic from user input, preventing the concatenation that allows SQL injection. By using placeholders (e.g., `?` or `:param`) and binding user input as data, the database engine treats the single quote and `OR 1=1` as literal string values, not executable SQL code. This directly remediates the root cause—dynamic SQL construction—without relying on external filters or insecure workarounds.

Answer

Deploy only a web application firewall and keep the code unchanged.

Answer

Store the database password as a salted hash in the application configuration.

Answer

Disable HTTPS so the request body is easier to inspect by network tools.