SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 4 — 15 Questions

Question 1

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Accepted Answer

Enforce server-side object-level authorization checks before returning any document.. The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Answer

Add client-side JavaScript to hide document IDs from the user interface.

Answer

Require users to change passwords more frequently to prevent unauthorized document access.

Answer

Place the document server behind a load balancer to prevent direct access to the application.

Question 2

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

Accepted Answer

The internet-facing SFTP gateway, because it has higher immediate risk.. The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Answer

The internal lab server, because every high-severity finding should be fixed first.

Answer

Both systems can wait until the next scheduled maintenance window.

Answer

Neither system needs urgent action because the lab server is isolated.

Question 3

A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Accepted Answer

Isolate the affected server from the network through EDR or switch controls.. Isolating the affected server from the network via EDR or switch controls is correct because it immediately stops the malware from spreading to other hosts through SMB connections and prevents further encryption of network-accessible files. This containment step breaks the lateral movement and data exfiltration channels without relying on potentially compromised credentials or incomplete cleanup.

Answer

Restore the server from backup before taking any containment action.

Answer

Delete the suspicious files from the server to stop the encryption process.

Answer

Inform users that the incident is likely a false positive and continue monitoring.

Question 4

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Accepted Answer

Isolate the workstation from the network for containment.. Option B is correct because the workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Answer

Allow the traffic because SMB is a normal file-sharing protocol.

Answer

Delete the local event logs to reduce alert noise.

Answer

Disable all SMB services on every server immediately.

Question 5

A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?

Accepted Answer

A critical flaw on an internet-facing VPN appliance with known exploit code. The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.

Answer

A low-severity finding on an internal test server with no network access

Answer

A cosmetic configuration warning on a printer management interface

Answer

A medium-severity issue on a device that is powered off and not in service

Question 6

Based on the exhibit, what is the MOST likely activity taking place on the network?

A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.

Accepted Answer

An attacker is performing lateral movement using stolen credentials and remote administration tools.. The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.

Answer

A worm is flooding the network with broadcast traffic and exhausting bandwidth.

Answer

A malicious insider is exfiltrating data through a cloud sync application.

Answer

A misconfigured printer is repeatedly scanning the subnet for available services.

Question 7

A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?

Accepted Answer

Use parameterized queries or prepared statements for the search filters.. Option B is correct because parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.

Answer

Escape apostrophes in the input before building the SQL statement.

Answer

Disable database error messages so attackers cannot see query details.

Answer

Place the application behind a VPN so only internal users can run searches.

Question 8

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Ransomware, because the files are being renamed and recovery copies are being deleted.. The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer

Adware, because documents are no longer opening correctly.

Answer

Rootkit, because the system is using a command-line utility.

Answer

Spyware, because the attacker wants to read user documents.

Question 9

A file-sharing portal uses a download URL like /download?file=12345. A tester changes the value to 12346 and can access another department's document without logging in again. Which control most directly prevents this issue?

Accepted Answer

Implement server-side authorization checks for every object request.. The issue is that the server trusts the file identifier in the URL without verifying that the authenticated user is authorized to access the requested resource. Implementing server-side authorization checks for every object request ensures that before serving any file, the server validates whether the current session or user has explicit permission to access that specific document. This directly prevents the IDOR (Insecure Direct Object Reference) vulnerability demonstrated by the tester.

Answer

Make the identifier longer so users cannot guess nearby values.

Answer

Move the portal to HTTPS so request parameters cannot be intercepted.

Answer

Store the document name in a hidden field and validate it in JavaScript.

Question 10

An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.

Accepted Answer

Isolate the workstation from the network using EDR or NAC containment.. Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.

Answer

Immediately wipe and reimage the workstation before collecting anything else.

Answer

Power the workstation off immediately to stop the malware process.

Answer

Disable every user account in the finance department to prevent further compromise.

Question 11

An employee receives an email that appears to come from payroll and asks them to open a link to "confirm direct deposit details". The link goes to a site with a slightly misspelled company name. What should the employee do first?

Accepted Answer

Use the company's known payroll portal or help desk contact to verify the request. Option C is correct because the safest first step when receiving a suspicious email is to verify its legitimacy through a trusted, independent channel—such as the company's known payroll portal or the help desk. This avoids interacting with the potentially malicious link or sender, which could lead to credential theft or malware installation. The email exhibits classic phishing indicators: a spoofed sender, a request for sensitive action, and a URL with a misspelled domain.

Answer

Click the link and sign in quickly before the account is locked

Answer

Reply to the email and ask payroll whether the message is real

Answer

Forward the message to co-workers so they can compare it with similar emails

Question 12

Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?

Accepted Answer

The TLS certificate fingerprint that remains constant across samples.. Option C is correct because a TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.

Answer

The daily-changing domain names used by the campaign.

Answer

The executable file hash that remains constant across samples.

Answer

The changing user agent string seen on each host.

Question 13

A scan reports a critical remote code execution vulnerability on an internet-facing VPN appliance with public proof-of-concept exploit code available. It also reports a critical local privilege escalation on an isolated lab workstation. Patch windows are limited this week. Which should be remediated first?

Accepted Answer

The internet-facing VPN appliance because it has higher exposure and exploitability.. The internet-facing VPN appliance presents a higher risk because it is exposed to the public internet and has a known remote code execution vulnerability with public exploit code. This combination of high exposure (attack surface) and high exploitability (availability of proof-of-concept code) significantly increases the likelihood of a successful attack, making it the priority for remediation despite limited patch windows.

Answer

The isolated lab workstation because all critical findings must be patched in numerical order.

Answer

The internal printer because peripheral devices are often overlooked and therefore most dangerous.

Answer

The lab workstation because local privilege escalation is always more dangerous than remote code execution.

Question 14

A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?

Accepted Answer

Disconnect the laptop from the network immediately.. Option B is correct because ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.

Answer

Reboot the laptop to stop the malicious process.

Answer

Delete the ransom note and continue working.

Answer

Change the user's password and wait for more details.

Question 15

Based on the exhibit, what is the BEST remediation for the application flaw shown?

A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

Accepted Answer

Replace the shell call with a safe library function and strictly allowlist approved host values.. Option B is correct because the application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Answer

Keep the current shell command, but add HTML encoding to the response page.

Answer

Increase the web server timeout so the ping utility has more time to complete.

Answer

Require users to authenticate before they can access the page.

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 4 — 15 Questions

Exhibit

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 4 — 15 Questions

Exhibit