SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 18 — 15 Questions

Question 1

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SMB signing and remove anonymous access to the share.. Enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Answer

Remove all backup jobs until the scan is cleared.

Answer

Disable the file server and rebuild it from scratch immediately.

Answer

Increase the directory quota so the share cannot overflow.

Question 2

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

Accepted Answer

Isolate the affected systems from the network and preserve evidence.. Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Answer

Pay the ransom immediately to restore access quickly.

Answer

Reimage the server immediately without documenting the event.

Answer

Disable antivirus alerts so staff can work without distractions.

Question 3

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

Accepted Answer

Move the console to a separate management network and restrict access to admin hosts only.. The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Answer

Increase the number of shared passwords so administrators can log in faster.

Answer

Leave the console exposed but shorten the password expiration period.

Answer

Disable logging so failed attempts do not generate noise.

Question 4

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

Accepted Answer

Restrict outbound requests to an allowlist and block internal address ranges.. Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Answer

Allow the API to follow any redirect so it works with more image sources.

Answer

Store the fetched image in encrypted form before sending it to users.

Answer

Increase the session timeout to reduce repeated logins by legitimate users.

Question 5

A security analyst is investigating a potential data exfiltration incident. Which three of the following indicators are most commonly associated with a data exfiltration attack? (Choose three.)

Accepted Answer

A sudden increase in DNS queries to a known malicious domain. Unusual outbound network traffic, especially during non-business hours, is a classic indicator of data exfiltration because attackers often schedule transfers when monitoring is less active. Large volumes of data being transferred to an external IP address directly suggests that sensitive data is being moved outside the organization. A sudden increase in DNS queries to a known malicious domain can indicate DNS tunneling, where data is encoded in DNS requests to bypass traditional network controls.

Answer

An employee receiving a phishing email with a malicious attachment

Answer

A spike in CPU usage on a database server

Answer

Multiple failed login attempts from a single user account

Question 6

A security team is reviewing vulnerabilities in a web application. Which three of the following are common web application vulnerabilities that should be addressed? (Choose three.)

Accepted Answer

Cross-site scripting (XSS). Cross-site scripting (XSS) is a common web application vulnerability where an attacker injects malicious scripts into web pages viewed by other users, often through input fields or URL parameters. SQL injection occurs when an application improperly sanitizes user input in SQL queries, allowing attackers to manipulate the database. XML external entity (XXE) injection exploits poorly configured XML parsers to process external entities, leading to data disclosure or server-side request forgery. These three are consistently listed in the OWASP Top 10 as critical web application flaws.

Answer

Evil twin attack

Answer

ARP poisoning

Answer

DNS cache poisoning

Question 7

An organization wants to reduce the risk of malware infections from removable media. Which three of the following controls should be implemented? (Choose three.)

Accepted Answer

Using group policy to block execution from removable media. Disabling AutoRun and AutoPlay features prevents malicious code from executing automatically when removable media is inserted, which is a common infection vector. Using group policy to block execution from removable media stops any executable files from running, even if manually launched. Scanning all removable media with antivirus software upon insertion detects and quarantines known malware before it can interact with the system.

Answer

Requiring all removable media to be formatted as NTFS

Answer

Installing a host-based intrusion detection system on every workstation

Answer

Enforcing a policy of full disk encryption on all removable drives

Question 8

Which four of the following are common indicators of a phishing attack? (Choose four.)

Accepted Answer

Grammatical errors and poor formatting in the message body. These four options are correct because they represent classic hallmarks of phishing attacks. Urgent or threatening language is a social engineering tactic to bypass rational thought. Spoofed sender addresses exploit trust in familiar domains. Unsolicited attachments or links are the primary delivery mechanism for phishing payloads. Grammatical errors and poor formatting often indicate a lack of professional quality control typical of legitimate organizations.

Answer

Presence of a digital signature from a trusted certificate authority

Answer

A request for sensitive information via a secure web portal

Question 9

Which four of the following are effective mitigations against SQL injection attacks? (Choose four.)

Accepted Answer

Implementing input validation and sanitization. Parameterized queries and prepared statements are effective because they separate SQL logic from user input, ensuring that input is treated as data rather than executable code. This prevents attackers from injecting malicious SQL commands into query strings, as the database engine compiles the query structure before parameters are bound.

Answer

Using client-side JavaScript validation exclusively

Answer

Blocking all user input containing the word 'SELECT'

Question 10

Drag and drop the steps for the SSH key exchange process in the correct order.

Accepted Answer

1: Client initiates SSH connection, 2: Server sends host key, 3: Diffie-Hellman key exchange, 4: Encryption established. SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Answer

1: Client initiates, 2: Diffie-Hellman key exchange, 3: Server sends host key, 4: Encryption established

Answer

1: Server sends host key, 2: Client initiates, 3: Diffie-Hellman key exchange, 4: Encryption established

Answer

1: Client initiates, 2: Server sends host key, 3: Encryption established, 4: Diffie-Hellman key exchange

Question 11

Drag and drop the steps to configure a VPN tunnel using IPsec in tunnel mode into the correct order.

Accepted Answer

Configure IKE policy, then configure IPsec transform set, then create crypto map, then apply crypto map to the interface.. IPsec VPN setup involves two phases: IKE for key exchange, then IPsec for data encryption; the crypto map ties it to an interface.

Answer

Configure IKE policy, then create crypto map, then configure IPsec transform set, then apply crypto map to the interface.

Answer

Create crypto map, then configure IKE policy, then apply crypto map to the interface, then configure IPsec transform set.

Answer

Configure IPsec transform set, then configure IKE policy, then create crypto map, then apply crypto map to the interface.

Question 12

A security analyst reviews a packet capture from a public Wi-Fi network and sees a workstation repeatedly sending gratuitous ARP replies that map the default gateway's IP address to the workstation's own MAC address. Shortly afterward, several clients on the same subnet begin sending their internet-bound traffic through that workstation. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

An on-path attack using ARP cache poisoning. The spoofed gratuitous ARP replies overwrite clients' mappings of the gateway IP to the attacker's MAC, which redirects traffic through the attacker's workstation. That is the defining mechanism of an on-path attack via ARP cache poisoning. The subsequent flow of internet-bound traffic through the workstation confirms successful redirection rather than a naming, address-exhaustion, or VLAN-boundary issue.

Answer

A VLAN hopping attack using double-tagged 802.1Q frames

Answer

A DHCP starvation attack exhausting the address pool

Answer

A DNS cache poisoning attack against the local resolver

Question 13

A security analyst is examining a Windows workstation that has been exhibiting unusual outbound traffic to an IP address in a foreign country. The analyst runs `netstat -anob` and sees a process named `svchost.exe` listening on TCP port 4444 and maintaining an established connection to that foreign IP. The analyst knows that `svchost.exe` normally hosts legitimate Windows services. Which of the following is the MOST likely explanation for this finding?

Accepted Answer

The `svchost.exe` process has been trojanized and is being used as a backdoor listener.. A legitimate svchost.exe process hosts Windows services and does not listen on arbitrary high ports or maintain external established connections. The presence of a listener on TCP 4444 with an active session to a foreign IP indicates a backdoor, often achieved by injecting malicious code into svchost.exe or replacing it. This behavior is a classic sign of a remote access trojan or command-and-control channel.

Answer

The `svchost.exe` process is hosting the Windows Time service and synchronizing with an external NTP server.

Answer

A remote administration tool such as Remote Desktop is running on a non-standard port.

Answer

The workstation is participating in a legitimate peer-to-peer Windows Update delivery.

Question 14

A security engineer is reviewing a web application that uses a database. The application constructs SQL queries by concatenating user input directly into the query string. During a penetration test, an attacker enters `' OR '1'='1` in the username field and successfully logs in without valid credentials. Which of the following BEST describes the vulnerability and the most effective mitigation?

Accepted Answer

SQL injection; mitigate by using parameterized queries (prepared statements).. The payload `' OR '1'='1` is a textbook SQL injection that alters the query's WHERE clause to return true, allowing authentication bypass. The root cause is dynamic SQL construction via string concatenation. Parameterized queries ensure that user input is treated as data, not executable code, effectively neutralizing SQL injection. This is the most robust and recommended mitigation.

Answer

Cross-site scripting (XSS); mitigate by encoding output.

Answer

Cross-site request forgery (CSRF); mitigate by using anti-CSRF tokens.

Answer

Command injection; mitigate by validating input against a whitelist.

Question 15

A security analyst is investigating a recent security incident where an attacker gained unauthorized access to a server. The analyst suspects the attacker used a known vulnerability in an outdated web application. Which of the following are the MOST appropriate steps to mitigate this vulnerability in the future? (Choose two.)

Accepted Answer

Implement a patch management process to regularly update the web application.. The most effective ways to mitigate a known vulnerability in an outdated web application are to patch it regularly and to proactively identify vulnerabilities through scanning and remediation. These steps directly address the root cause by eliminating the vulnerable code. Other options like WAF, segmentation, or encryption are compensating controls or defense-in-depth measures, but they do not fix the underlying flaw.

Answer

Deploy a web application firewall (WAF) in blocking mode.

Answer

Implement network segmentation to isolate the web server.

Answer

Enable full disk encryption on the server.