SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, what should the employee do first?

Accepted Answer

Report the message through the company’s phishing-report process and do not share the code.. The message exhibits classic social engineering indicators: an unsolicited request for a sensitive code, urgency, and a spoofed sender address. The employee must report it via the company's phishing-report process to alert the security team and must not share the code, as that would compromise the account. This aligns with security awareness training that emphasizes verifying requests out-of-band and never providing credentials or codes in response to email requests.

Answer

Reply with the code because the request appears to come from payroll support.

Answer

Forward the email to coworkers so they can watch for the same request.

Answer

Open the attached file to see whether it contains the payroll fix details.

Question 2

An employee receives an email that appears to come from the company's payroll provider. It says payroll documents will be deleted today unless the employee signs in through the included link. What is the best first action?

Accepted Answer

Report the message and verify the request using a trusted contact method.. The email exhibits classic signs of a phishing attack—urgency, a threat of data loss, and a link to a fake login page. The best first action is to report the suspicious message to the security team and independently verify the request by contacting the payroll provider through a trusted channel (e.g., a known phone number or a previously bookmarked URL). This prevents credential theft and potential account compromise.

Answer

Click the link quickly and sign in to avoid losing the documents.

Answer

Reply to the sender and ask whether the message is legitimate.

Answer

Forward the email to coworkers so they can watch for the same warning.

Question 3

A help desk technician reports several workstations are suddenly showing lots of pop-up ads and browser redirects after users installed a free media player. What type of unwanted software is most likely present?

Accepted Answer

Adware. Adware is the most likely culprit because it is a type of unwanted software designed to display intrusive advertisements, often through pop-up ads and browser redirects. The infection vector—users installing a free media player—is a classic distribution method for adware, which bundles itself with legitimate software to generate revenue via ad impressions. Unlike ransomware or rootkits, adware does not encrypt files or hide its presence; it directly manipulates browser sessions to serve ads.

Answer

Ransomware

Answer

Rootkit

Answer

Logic bomb

Question 4

A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?

Accepted Answer

The malware's SHA-256 file hash because it uniquely identifies the sample.. The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.

Answer

The current domain name because it is the easiest item to block immediately.

Answer

The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

Answer

The malware's file name because attackers usually keep the same name for convenience.

Question 5

Based on the exhibit, what type of social engineering attack is the caller using?

Accepted Answer

Vishing, because the attacker is using a phone call to pressure the target.. The caller is using a phone call to impersonate a trusted figure (the CEO) and create urgency to pressure the target into violating security policy. This matches the definition of vishing (voice phishing), which relies on social engineering over voice channels to extract sensitive information or actions.

Answer

Ransomware, because the caller is asking for money.

Answer

SQL injection, because the caller is asking for account details.

Answer

Tailgating, because the attacker mentions an executive assistant.

Question 6

A user says their files suddenly have a new extension and a note appears demanding payment to restore access. Which type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files and appends a new extension, then displays a ransom note demanding payment for decryption. This matches the user's description of files becoming inaccessible with a new extension and a payment demand.

Answer

Adware

Answer

Spam filter

Answer

Screen saver

Question 7

An employee receives a text message from an unknown number pretending to be IT. It includes a shortened URL for "urgent MFA re-enrollment" and says the account will be locked in 15 minutes. What is the best response?

Accepted Answer

Report the message through the official security channel and verify the request using known IT contact information.. It follows the principle of verifying unsolicited requests through trusted channels, which is a key defense against social engineering and phishing attacks. The message exhibits classic phishing indicators: an unknown sender, a shortened URL (which can mask the true destination), a false sense of urgency, and a request for MFA re-enrollment—a common pretext to harvest credentials or MFA tokens. Reporting through the official security channel ensures the incident is logged and investigated, while verifying with known IT contact information prevents falling for a spoofed or compromised source.

Answer

Open the link and enter the requested information if the page looks legitimate.

Answer

Forward the text to coworkers so they can check whether they received the same message.

Answer

Reply to the text asking for a company badge number before proceeding.

Question 8

A security tool reports repeated DNS requests for long, random-looking subdomains under the same domain name. What is the most likely explanation?

Accepted Answer

DNS tunneling used to hide command-and-control traffic.. DNS tunneling encodes non-DNS traffic (e.g., C2 commands) into DNS queries and responses, often using long, random-looking subdomains to evade detection. Repeated requests for such subdomains under a single domain are a classic indicator of data exfiltration or covert channel activity, as each query can carry a small payload.

Answer

A normal software update process from the operating system.

Answer

A successful password reset workflow for users.

Answer

A hardware failure on the network adapter.

Question 9

EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?

Accepted Answer

Isolate the laptop from the network using the EDR platform.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.

Answer

Reboot the laptop to clear any malicious process from memory.

Answer

Run a full antivirus scan and wait for the results before taking further action.

Answer

Reset the user's password and keep the laptop online for monitoring.

Question 10

An attacker calls the service desk claiming to be a traveling contractor whose phone was stolen. They know the contractor's manager name and ask for an MFA reset to a new number 'just for today.' Which control would best reduce the success of this attack?

Accepted Answer

Require a callback to a previously verified number and ticket approval before reset.. It introduces two verification factors that directly counter the social engineering vector: a callback to a previously verified number ensures the requestor is reachable at a known trusted contact point, and ticket approval creates an audit trail and requires secondary authorization. This combination prevents an attacker from simply claiming an identity and requesting a change without independent confirmation, which is the core weakness the attacker exploits.

Answer

Trust any caller who can provide a manager's name and employee ID.

Answer

Remove MFA so users are less likely to get locked out while traveling.

Answer

Use caller ID alone to confirm the person is legitimate.

Question 11

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

Accepted Answer

Pretexting, because the attacker is inventing a believable support story to gain trust.. The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Answer

Watering hole, because the attacker is targeting a trusted web service used by employees.

Answer

Tailgating, because the attacker is attempting to bypass a physical security barrier.

Answer

Whaling, because the attacker is targeting a high-value executive account directly.

Question 12

Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

Accepted Answer

The malware file hash, because it remains consistent across incidents.. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.

Answer

The daily domain names, because they are the easiest indicator to find.

Answer

The color of the phishing email, because visual style is unique to the attacker.

Answer

The user's browser homepage, because attackers often change it after infection.

Question 13

Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

Accepted Answer

Business email compromise using executive impersonation and urgency.. This scenario describes a business email compromise (BEC) attack where the threat actor impersonates an executive (the CFO) using a lookalike domain to trick a finance employee into making an unauthorized gift-card purchase. The use of urgency, confidentiality, and pressure to bypass normal approval processes are classic BEC social engineering tactics, not technical exploits.

Answer

Watering-hole attack targeting employees through a compromised website.

Answer

Smishing attempt delivered through a text message to a mobile phone.

Answer

Credential stuffing against the CFO's mailbox using previously leaked passwords.

Question 14

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?

The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

Accepted Answer

The unique mutex name created by the malware on infected endpoints. A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Answer

The current source IP addresses hosting the payloads

Answer

The exact wording of the latest phishing email lure

Answer

The filename of the attachment used in the most recent incident

Question 15

A finance manager gets a phone call from someone claiming to be the CEO's assistant, urgently requesting a wire transfer before a board meeting. What type of attack is this?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) uses a phone call to socially engineer the victim into performing a sensitive action, such as a wire transfer. The attacker impersonates a trusted authority (the CEO's assistant) and exploits urgency to bypass normal verification procedures. This is distinct from text-based phishing (smishing) or targeted email attacks (spear phishing).

Answer

Smishing

Answer

Spear phishing

Answer

Watering-hole attack