SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 2 — 15 Questions

Question 1

A security analyst receives an alert from the email security gateway about a message sent to an employee. The email has an attachment named 'Invoice_Q4_2024.exe'. The employee claims they did not open the attachment, and the email appears to come from a known vendor's domain but the sender address has a slight typo. Which type of attack is most likely being attempted?

Accepted Answer

Phishing. The email contains a malicious executable attachment ('Invoice_Q4_2024.exe') and uses a spoofed sender address with a typo to impersonate a known vendor. This is a classic phishing attack because it is a broad, unsolicited attempt to trick the recipient into executing malware, without any personalized targeting beyond the generic invoice lure. The slight typo in the sender domain indicates domain spoofing, a common phishing technique that exploits the lack of SPF/DKIM validation.

Answer

Spear phishing

Answer

Smishing

Answer

Vishing

Question 2

A security analyst notices that several employees have received an email with the subject line 'Urgent: Password Reset Required'. The email contains a link to a website that mimics the company's internal login portal. The email was sent from an external domain and addresses recipients by 'Dear Employee' rather than their actual names. Which type of social engineering attack is being described?

Accepted Answer

Phishing. The email is sent to multiple employees, uses a generic greeting ('Dear Employee'), and originates from an external domain, which are hallmarks of a broad, untargeted phishing campaign. Spear phishing would involve personalized details (e.g., the recipient's actual name) and targeting specific individuals. Vishing is voice-based, not email. Therefore, this is a standard phishing attack.

Answer

Spear phishing

Answer

Vishing

Answer

Tailgating

Question 3

A security analyst receives an alert about a user account attempting to access multiple network shares in rapid succession within a short time frame. The analyst reviews the logs and sees that the IP address originates from the internal network, but the user is currently on leave. Which type of attack is most likely occurring?

Accepted Answer

Internal reconnaissance. The correct answer is D because the behavior—an internal IP address rapidly querying multiple network shares—is characteristic of internal reconnaissance, where an attacker who has already gained a foothold maps out available resources. The user being on leave indicates the account is compromised, and the rapid succession of share access attempts is a classic sign of automated enumeration (e.g., using `net view` or SMB queries) rather than a direct credential attack.

Answer

Pass-the-hash attack

Answer

Brute-force attack

Answer

Credential stuffing attack

Question 4

A security analyst receives a phone call from an individual claiming to be a member of the IT help desk. The caller states that an emergency security update requires the analyst's password immediately, and the request sounds urgent. The analyst notices the caller's voice is unfamiliar and the background noise is inconsistent with an office environment. Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. This is a vishing (voice phishing) attack because the threat actor uses a phone call to impersonate IT help desk personnel and pressures the analyst into disclosing sensitive credentials. Vishing specifically leverages voice communication to bypass email-based security controls and exploit human trust through urgency and authority.

Answer

Phishing

Answer

Spear phishing

Answer

Pretexting

Question 5

A security analyst is investigating a web application that allows users to input a filename to view its contents. The application passes the user input directly to a system command without sanitization. An attacker submits the input 'file.txt; cat /etc/passwd' and successfully retrieves the contents of the password file. Which type of attack occurred?

Accepted Answer

Command injection. The application passes user input directly to a system command without sanitization. The attacker's input 'file.txt; cat /etc/passwd' uses a semicolon to terminate the intended command and execute a second command, which retrieves the password file. This is a classic command injection attack, where arbitrary system commands are executed via the vulnerable interface.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Directory traversal

Question 6

A security analyst receives reports that several employees are being redirected to a fraudulent login page after typing the correct URL for a company application into their browser. Further investigation reveals that the company's internal DNS server has been compromised. Which type of attack best describes this scenario?

Accepted Answer

Pharming. Pharming is correct because the attack redirects users from a legitimate website to a fraudulent one without their knowledge or interaction, typically by compromising the DNS resolution process. In this scenario, the internal DNS server has been compromised, so when employees type the correct URL, the DNS server returns the IP address of a fake login page instead of the real one. This is a classic example of DNS poisoning, a form of pharming.

Answer

Phishing

Answer

Spear phishing

Answer

Vishing

Question 7

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

Accepted Answer

Credential harvesting via phishing. The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Answer

On-path attack

Answer

Brute-force attack

Answer

Password spraying

Question 8

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

Accepted Answer

Trojan horse. The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Answer

Ransomware

Answer

Rootkit

Answer

Polymorphic malware

Question 9

Based on the exhibit, what should the employee do first?

Accepted Answer

Report the message through the company’s phishing-report process and do not share the code.. Option B is correct because the message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer

Reply with the code because the request appears to come from payroll support.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Open the attached file to see whether it contains the payroll fix details.

Question 10

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

Accepted Answer

Report the message and verify the request using a trusted contact method.. Option B is correct because the email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Answer

Click the link quickly and sign in to avoid losing the documents.

Answer

Reply to the sender and ask whether the message is legitimate.

Answer

Forward the email to coworkers so they can watch for the same warning.

Question 11

A help desk technician reports several workstations are suddenly showing lots of pop-up ads and browser redirects after users installed a free media player. What type of unwanted software is most likely present?

Accepted Answer

Adware. Adware is the most likely culprit because it is a type of unwanted software designed to display intrusive advertisements, often through pop-up ads and browser redirects. The infection vector—users installing a free media player—is a classic distribution method for adware, which bundles itself with legitimate software to generate revenue via ad impressions. Unlike ransomware or rootkits, adware does not encrypt files or hide its presence; it directly manipulates browser sessions to serve ads.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 12

A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?

Accepted Answer

The malware's SHA-256 file hash because it uniquely identifies the sample.. The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.

Answer

The current domain name because it is the easiest item to block immediately.

Answer

The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

Answer

The malware's file name because attackers usually keep the same name for convenience.

Question 13

Based on the exhibit, what type of social engineering attack is the caller using?

Accepted Answer

Vishing, because the attacker is using a phone call to pressure the target.. The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Answer

Ransomware, because the caller is asking for money.

Answer

SQL injection, because the caller is asking for account details.

Answer

Tailgating, because the attacker mentions an executive assistant.

Question 14

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Answer

Adware

Answer

Spam filter

Answer

Screen saver

Question 15

An employee receives a text message from an unknown number pretending to be IT. It includes a shortened URL for "urgent MFA re-enrollment" and says the account will be locked in 15 minutes. What is the best response?

Accepted Answer

Report the message through the official security channel and verify the request using known IT contact information.. Option B is correct because it follows the principle of verifying unsolicited requests through trusted channels, which is a key defense against social engineering and phishing attacks. The message exhibits classic phishing indicators: an unknown sender, a shortened URL (which can mask the true destination), a false sense of urgency, and a request for MFA re-enrollment—a common pretext to harvest credentials or MFA tokens. Reporting through the official security channel ensures the incident is logged and investigated, while verifying with known IT contact information prevents falling for a spoofed or compromised source.

Answer

Open the link and enter the requested information if the page looks legitimate.

Answer

Forward the text to coworkers so they can check whether they received the same message.

Answer

Reply to the text asking for a company badge number before proceeding.