SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 4 — 15 Questions

Question 1

An employee receives a text message from an unknown number pretending to be IT. It includes a shortened URL for "urgent MFA re-enrollment" and says the account will be locked in 15 minutes. What is the best response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Report the message through the official security channel and verify the request using known IT contact information.. It follows the principle of verifying unsolicited requests through trusted channels, which is a key defense against social engineering and phishing attacks. The message exhibits classic phishing indicators: an unknown sender, a shortened URL (which can mask the true destination), a false sense of urgency, and a request for MFA re-enrollment—a common pretext to harvest credentials or MFA tokens. Reporting through the official security channel ensures the incident is logged and investigated, while verifying with known IT contact information prevents falling for a spoofed or compromised source.

Answer

Open the link and enter the requested information if the page looks legitimate.

Answer

Forward the text to coworkers so they can check whether they received the same message.

Answer

Reply to the text asking for a company badge number before proceeding.

Question 2

A security tool reports repeated DNS requests for long, random-looking subdomains under the same domain name. What is the most likely explanation?

Accepted Answer

DNS tunneling used to hide command-and-control traffic.. DNS tunneling encodes non-DNS traffic (e.g., C2 commands) into DNS queries and responses, often using long, random-looking subdomains to evade detection. Repeated requests for such subdomains under a single domain are a classic indicator of data exfiltration or covert channel activity, as each query can carry a small payload.

Answer

A normal software update process from the operating system.

Answer

A successful password reset workflow for users.

Answer

A hardware failure on the network adapter.

Question 3

EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?

Accepted Answer

Isolate the laptop from the network using the EDR platform.. The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.

Answer

Reboot the laptop to clear any malicious process from memory.

Answer

Run a full antivirus scan and wait for the results before taking further action.

Answer

Reset the user's password and keep the laptop online for monitoring.

Question 4

An attacker calls the service desk claiming to be a traveling contractor whose phone was stolen. They know the contractor's manager name and ask for an MFA reset to a new number 'just for today.' Which control would best reduce the success of this attack?

Accepted Answer

Require a callback to a previously verified number and ticket approval before reset.. It introduces two verification factors that directly counter the social engineering vector: a callback to a previously verified number ensures the requestor is reachable at a known trusted contact point, and ticket approval creates an audit trail and requires secondary authorization. This combination prevents an attacker from simply claiming an identity and requesting a change without independent confirmation, which is the core weakness the attacker exploits.

Answer

Trust any caller who can provide a manager's name and employee ID.

Answer

Remove MFA so users are less likely to get locked out while traveling.

Answer

Use caller ID alone to confirm the person is legitimate.

Question 5

A caller claims to be from the company's SaaS provider and says a tenant migration will fail unless the help desk reads back a one-time verification code sent to an administrator's phone. The caller knows the admin's name and ticket number. What attack technique is being used?

Accepted Answer

Pretexting, because the attacker is inventing a believable support story to gain trust.. The attacker is using pretexting by fabricating a plausible scenario (a tenant migration requiring a verification code) to manipulate the help desk into divulging sensitive information. This social engineering technique relies on building false trust through invented details like the admin's name and ticket number, rather than exploiting technical vulnerabilities. The goal is to obtain the one-time verification code, which could be used for unauthorized access or account takeover.

Answer

Watering hole, because the attacker is targeting a trusted web service used by employees.

Answer

Tailgating, because the attacker is attempting to bypass a physical security barrier.

Answer

Whaling, because the attacker is targeting a high-value executive account directly.

Question 6

Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

Accepted Answer

The malware file hash, because it remains consistent across incidents.. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.

Answer

The daily domain names, because they are the easiest indicator to find.

Answer

The color of the phishing email, because visual style is unique to the attacker.

Answer

The user's browser homepage, because attackers often change it after infection.

Question 7

Finance staff receive an email from the 'CFO' using a lookalike domain. The message requests an urgent gift-card purchase, says the recipient must keep it confidential, and pressures them to skip normal approval steps. What attack is this most likely?

Accepted Answer

Business email compromise using executive impersonation and urgency.. This scenario describes a business email compromise (BEC) attack where the threat actor impersonates an executive (the CFO) using a lookalike domain to trick a finance employee into making an unauthorized gift-card purchase. The use of urgency, confidentiality, and pressure to bypass normal approval processes are classic BEC social engineering tactics, not technical exploits.

Answer

Watering-hole attack targeting employees through a compromised website.

Answer

Smishing attempt delivered through a text message to a mobile phone.

Answer

Credential stuffing against the CFO's mailbox using previously leaked passwords.

Question 8

Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?

The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.

Accepted Answer

The unique mutex name created by the malware on infected endpoints. A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.

Answer

The current source IP addresses hosting the payloads

Answer

The exact wording of the latest phishing email lure

Answer

The filename of the attachment used in the most recent incident

Question 9

A finance manager gets a phone call from someone claiming to be the CEO's assistant, urgently requesting a wire transfer before a board meeting. What type of attack is this?

Accepted Answer

Vishing. B is correct because vishing (voice phishing) uses a phone call to socially engineer the victim into performing a sensitive action, such as a wire transfer. The attacker impersonates a trusted authority (the CEO's assistant) and exploits urgency to bypass normal verification procedures. This is distinct from text-based phishing (smishing) or targeted email attacks (spear phishing).

Answer

Smishing

Answer

Spear phishing

Answer

Watering-hole attack

Question 10

A threat report says an attacker changes domains daily and rehosts infrastructure in cloud VPS environments, but the phishing email wording, login-page flow, and PowerShell download behavior remain the same. What type of information is most useful for a durable detection rule?

Accepted Answer

The attacker’s behavioral pattern and technique sequence. The attacker's behavioral pattern and technique sequence remain consistent even as infrastructure changes. A durable detection rule should focus on the invariant TTPs (Tactics, Techniques, and Procedures) such as the phishing email wording, login-page flow, and PowerShell download behavior, which are stable indicators of compromise (IOCs) that persist across domain and IP changes. This aligns with the MITRE ATT&CK framework's emphasis on detecting adversary behaviors rather than ephemeral artifacts like hashes or IP addresses.

Answer

Only the current malware hash from the latest sample

Answer

The names of the victim company’s departments

Answer

A screenshot of the phishing email subject line only

Question 11

A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

Accepted Answer

Isolate the workstation from the network using the EDR containment feature. The workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.

Answer

Run a full antivirus scan while leaving the system connected

Answer

Reboot the workstation to clear any active malicious processes

Answer

Uninstall the email client that delivered the attachment

Question 12

A user's laptop suddenly shows encrypted .docx files, a ransom note, and the EDR console reports mass file renames and shadow copy deletion. The device is still online and connected to the corporate VPN. What is the best immediate action?

Accepted Answer

Quarantine the endpoint from the network through EDR or physical isolation.. The immediate priority in a confirmed ransomware incident is to contain the threat by isolating the compromised host from the network. The EDR console showing mass file renames and shadow copy deletion indicates active encryption and lateral movement risk. Quarantining via EDR or physically disconnecting the network cable stops the ransomware from encrypting additional shares or communicating with its C2 server, preserving evidence and preventing further damage.

Answer

Reboot the laptop into safe mode and attempt manual malware removal.

Answer

Restore the affected files from backup before taking any other action.

Answer

Tell the user to change their password and continue working from the same laptop.

Question 13

A caller says they are from the help desk and need the employee's MFA code to "complete a password reset". Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to trick a victim into divulging sensitive information. In this case, the attacker pretends to be from the help desk and invokes a false password reset procedure to obtain the employee's MFA code, which should never be shared. The MFA code is a time-based one-time password (TOTP) or push notification response that authenticates the user, not a tool for password resets.

Answer

Phishing

Answer

DDoS

Answer

SQL injection

Question 14

A vulnerability scan finds two issues: a critical deserialization flaw on a non-production lab server behind a VPN, and a high-severity privilege escalation flaw on the production jump server that administrators use to reach the rest of the environment. Which should be remediated first?

Accepted Answer

The jump server flaw, because it affects a production administrative access point. The jump server flaw must be remediated first because it is a high-severity privilege escalation vulnerability on a production system that administrators use as a gateway to the entire environment. Compromise of this jump server would give an attacker administrative access to all connected production systems, making the business impact far greater than the critical deserialization flaw on an isolated non-production lab server. In risk-based prioritization, severity alone is insufficient; the asset's role, exposure, and potential blast radius must be considered.

Answer

The lab server flaw, because critical severity always comes first

Answer

Neither issue, because VPN access reduces the need for urgent remediation

Answer

The lab server flaw, because non-production systems are always easier to patch later

Question 15

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Accepted Answer

Replace shell command concatenation with a parameterized API or safe library call.. Replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Answer

HTML-encode the report name before inserting it into the shell command.

Answer

Switch the feature from POST to GET so the values are easier to inspect.

Answer

Hide the server error messages so attackers cannot see the failure details.