SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 2 — 15 Questions

Question 1

A SOC analyst reviews a suspicious email about an overdue invoice. The display name matches a known supplier, but the envelope sender is from a free webmail domain, and the Reply-To address uses a look-alike domain with one swapped letter. The message also includes a company logo and a PDF attachment. Which two findings are the strongest indicators of a phishing attempt? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The display name matches the supplier, but the envelope sender is from a free webmail provider.. The envelope sender (the actual origin address in the SMTP MAIL FROM command) being from a free webmail domain while the display name matches a known supplier is a classic phishing red flag. Legitimate business invoices are almost never sent from free webmail providers like Gmail or Yahoo, as organizations use their own domains for official correspondence. This mismatch between the visible display name and actual sender address indicates spoofing. Additionally, the Reply-To address using a look-alike domain with one swapped letter is another strong indicator, as attackers often use typosquatted domains to appear legitimate while redirecting replies to an attacker-controlled mailbox.

Answer

The message was transmitted over TLS to the recipient's mail gateway.

Answer

The email contains a PDF invoice attachment with a normal business filename.

Answer

The message includes the supplier's logo and a standard-looking signature block.

Question 2

An employee reports a suspicious email that appears to be from the help desk. Which two details are the strongest signs of phishing? Select two.

Accepted Answer

The message creates urgency and threatens account suspension within 15 minutes.. Both A and B are strong indicators of phishing. Option A is a classic social engineering technique: creating urgency and threatening negative consequences to pressure the recipient into acting without thinking. Option B is a technical red flag: a look-alike domain with one letter changed is a common tactic to deceive users into believing the email is legitimate. Together, a suspicious sender address and a high-pressure message are two of the strongest signs that an email is a phishing attempt. In contrast, a professional email signature, delivery during normal business hours, and a personalized subject line with the department name are not reliable indicators because legitimate emails can contain those as well.

Answer

The email signature includes the company logo and a professional font.

Answer

The message was delivered during normal business hours.

Answer

The subject line includes the employee's department name.

Question 3

An organization is implementing security controls to mitigate the risk of social engineering attacks. Which three of the following are effective mitigations? (Choose three.)

Accepted Answer

Deploying email filtering and anti-phishing gateways. Effective mitigations for social engineering include: (1) Security awareness training, which teaches employees to recognize and resist social engineering tactics; (2) Deploying email filtering and anti-phishing gateways, which block many phishing attempts before they reach users; (3) Requiring multifactor authentication (MFA), which reduces the impact of compromised credentials. Physical barriers, USB port controls, and clean desk policies are more related to physical security and information handling, not core social engineering mitigation.

Answer

Implementing a strict clean desk policy

Answer

Installing physical barriers at building entrances

Answer

Disabling USB ports on all workstations

Question 4

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Answer

LDAP injection

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 5

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

Accepted Answer

Stack canaries. Stack canaries are the most effective runtime control for detecting and preventing buffer overflow exploitation. When a buffer overflow overwrites the stack, it corrupts a canary value placed between the buffer and the return address; before the function returns, the canary is checked, and if altered, the program terminates immediately, preventing arbitrary code execution.

Answer

Transport Layer Security (TLS)

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Question 6

A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

Accepted Answer

Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution. The attack is a business email compromise (BEC) using a lookalike domain. A policy requiring verbal verification via a known phone number adds a human out-of-band check that bypasses the email channel entirely, preventing the fraudulent transfer even if the email appears legitimate. This control directly addresses the social engineering aspect of the attack, which technical controls alone cannot fully mitigate.

Answer

Deploying a stronger email spam filter that blocks all emails from unrecognized domains

Answer

Requiring multi-factor authentication (MFA) for all corporate email accounts

Answer

Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

Question 7

A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) is a social engineering attack conducted over the phone, where the attacker impersonates a trusted entity (IT support) to trick the victim into revealing sensitive information such as credentials and MFA codes. The request for the current MFA code is a key indicator, as it would allow the attacker to bypass multi-factor authentication in real time.

Answer

Spear phishing

Answer

Pretexting

Answer

Tailgating

Question 8

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

Accepted Answer

Timing attack. The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.

Answer

Brute-force attack

Answer

Dictionary attack

Answer

Replay attack

Question 9

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

Accepted Answer

Replace dynamic SQL queries with parameterized prepared statements.. Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.

Answer

Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

Answer

Sanitize user input by escaping single quotes and other special characters before concatenation.

Answer

Encode all user input using HTML entity encoding before database operations.

Question 10

A security analyst is reviewing authentication logs from a corporate web application. The logs show thousands of failed login attempts over the past hour. Each attempt uses a different username, but all attempts use the same password 'Spring2024!'. The source IP addresses are widely distributed across several different geographic regions. Which type of attack is the analyst most likely observing?

Accepted Answer

Password spraying attack. The attack uses a single common password ('Spring2024!') against many different usernames, which is the hallmark of a password spraying attack. Unlike brute-force attacks that target one account with many passwords, password spraying avoids account lockout by trying one password across many accounts. The wide distribution of source IPs is consistent with a distributed password spraying campaign, often using botnets or proxies.

Answer

Brute-force attack

Answer

Credential stuffing attack

Answer

Dictionary attack

Question 11

A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?

Accepted Answer

Stored cross-site scripting (XSS). The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Reflected cross-site scripting (XSS)

Question 12

A security analyst is reviewing the session management implementation of a web application. The application generates session tokens by computing the MD5 hash of the concatenation of the username and the current server timestamp rounded to the nearest hour. An attacker has obtained a valid session token for her own account and discovers that she can forge tokens for other users by simply substituting the username in the hash calculation with a known target username. Which type of attack is the web application most vulnerable to?

Accepted Answer

Session prediction. The session token is generated using MD5(username + timestamp rounded to the nearest hour). Since the attacker knows her own token and can compute the hash for any username with the same timestamp, she can predict tokens for other users. This is a classic session prediction vulnerability, as the token generation lacks sufficient entropy and relies on predictable inputs.

Answer

Session hijacking via cross-site scripting (XSS)

Answer

Session replay attack

Answer

Session fixation

Question 13

A security analyst is reviewing the source code of a custom web application. The application receives JSON data from users, which includes a 'type' field. The application uses the 'type' field to determine which Java class to instantiate, and then calls a method on that object. The application does not validate or sanitize the 'type' field. An attacker sends a crafted JSON payload that causes the application to instantiate an unexpected class, leading to remote code execution. Which type of vulnerability does this example describe?

Accepted Answer

Insecure deserialization. The application deserializes untrusted JSON data and uses the 'type' field to dynamically instantiate a Java class without validation. This is a classic insecure deserialization vulnerability, where an attacker can supply a malicious class name (e.g., a gadget class like `Runtime` or a custom class) that, when instantiated and its method called, executes arbitrary code on the server. The lack of input sanitization on the 'type' field directly enables remote code execution via object instantiation.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 14

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

Accepted Answer

Whaling. This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Answer

Spear phishing

Answer

Vishing

Answer

Pharming

Question 15

A security analyst discovers that an organization's web application is vulnerable to SQL injection. The application uses a legacy database driver that does not support parameterized queries. Which of the following is the BEST mitigation to prevent this vulnerability?

Accepted Answer

Update the database driver to a version that supports parameterized queries.. The root cause of the SQL injection vulnerability is the legacy database driver that does not support parameterized queries. Updating the driver to a modern version that supports parameterized queries (also known as prepared statements) allows the application to separate SQL logic from user-supplied data, effectively preventing SQL injection at the database layer. This addresses the fundamental flaw rather than relying on external filtering or encoding.

Answer

Implement a web application firewall (WAF) to filter malicious input.

Answer

Encode all user input using HTML encoding.

Answer

Disable error messages that reveal database schema.