SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 5 — 15 Questions

Question 1

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

Accepted Answer

The host is likely being used for lateral movement or internal reconnaissance.. SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Answer

The workstation is probably downloading a routine operating system update.

Answer

The network is likely suffering from a wireless interference problem.

Answer

The user is likely printing documents to multiple shared printers.

Question 2

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

Accepted Answer

Use phishing-resistant MFA with number matching or hardware security keys. Option B is correct because phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Answer

Increase password complexity requirements

Answer

Shorten the screen-lock timeout on user devices

Answer

Allow users to approve any MFA prompt sent during business hours

Question 3

During testing, a login form returns all user records when the tester enters ' OR '1'='1 in a username field. What is the best fix for this issue?

Accepted Answer

Use parameterized queries or prepared statements. The SQL injection attack ' OR '1'='1 bypasses authentication by always evaluating to true, returning all user records. Parameterized queries (prepared statements) separate SQL logic from user input, preventing the injected string from altering the query structure. This is the industry-standard mitigation for SQL injection vulnerabilities.

Answer

Hide database error messages from the login page only

Answer

Require users to change passwords more often

Answer

Move the login page to a different URL

Question 4

A scan returns five findings. Which two should be remediated first based on real-world risk? Select two. A) Internet-facing SSO gateway, CVSS 8.8, public exploit code, and auth bypass impact. B) Internal print server, CVSS 9.8, no known exploit, isolated VLAN, no sensitive data. C) File server with regulated customer records, CVSS 6.5, active exploitation in the wild, reachable from VPN. D) Lab hypervisor, CVSS 7.5, no exploit, scheduled retirement next month, used only by testers. E) Dev wiki, CVSS 5.0, no exploit, no sensitive data.

Accepted Answer

Internet-facing SSO gateway with public exploit code and authentication-bypass impact.. Option A is correct because the SSO gateway is internet-facing, has a CVSS 8.8 with public exploit code, and an authentication-bypass impact. This combination means an attacker can gain unauthorized access to all federated applications without credentials, representing a critical risk that must be remediated immediately.

Answer

Internal print server on an isolated VLAN with no known exploit and no sensitive data.

Answer

Lab hypervisor that is scheduled for retirement next month and used only by testers.

Answer

Development wiki with low severity, no exploit, and no sensitive data.

Question 5

NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?

Accepted Answer

Isolate the workstation and begin investigating for credential compromise or lateral movement. The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.

Answer

Treat the traffic as normal because the workstation used valid credentials

Answer

Increase the DHCP lease time to reduce network noise

Answer

Block all SMB and WinRM traffic across the entire enterprise

Question 6

SIEM alerts show one workstation making SMB connections to 30 internal hosts within 10 minutes, followed by remote service creation and repeated access attempts to admin shares. The workstation also begins authenticating with several privileged accounts. What is the most likely activity?

Accepted Answer

Lateral movement after credential compromise or endpoint takeover.. The sequence of SMB connections to many internal hosts, followed by remote service creation and repeated access attempts to admin shares, combined with authentication using privileged accounts, is the classic pattern of lateral movement. This indicates the attacker has already compromised the workstation (endpoint takeover) or obtained valid credentials and is now using SMB and PsExec-like techniques to move laterally across the network, escalate privileges, and establish persistence.

Answer

A distributed denial-of-service attack launched from a compromised internal host.

Answer

DNS tunneling used to exfiltrate data through allowed name-resolution traffic.

Answer

ARP spoofing to redirect local traffic at the network layer.

Question 7

During testing, entering ' OR '1'='1 into a login field returns all user records instead of rejecting the input. What is the best fix to address this flaw?

Accepted Answer

Use parameterized queries or prepared statements for database access. Option B is correct because the flaw is a classic SQL injection vulnerability, where unsanitized user input is concatenated directly into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data, ensuring that input like ' OR '1'='1 is treated as a literal string value, not executable code. This is the industry-standard mitigation per OWASP and effectively prevents injection attacks.

Answer

Add client-side JavaScript validation to block quote characters

Answer

Store passwords in a stronger hash format

Answer

Change the login page to HTTPS

Question 8

After a new search feature goes live, logs show requests containing `UNION SELECT` and the application returns database error messages. Security testing confirms attackers can retrieve rows from other tables by modifying the query string. Which fix is best?

Accepted Answer

Rewrite the database access layer to use parameterized queries or prepared statements.. The attack described is SQL injection, where the attacker uses `UNION SELECT` to extract data from other tables. The most effective and industry-standard fix is to use parameterized queries or prepared statements, which separate SQL logic from user input, preventing the database from interpreting malicious input as executable code. This directly addresses the root cause by ensuring user-supplied data is treated as data, not as part of the SQL command.

Answer

Encode special characters in the browser before submitting the search form.

Answer

Disable detailed error messages so attackers cannot see the database name.

Answer

Increase password complexity requirements for all application users.

Question 9

Threat intelligence reports that an adversary changes domains daily and uses disposable cloud hosting, but the malware binary hash and a unique mutex name remain unchanged across incidents. Which indicator is the best candidate for immediate detection rule creation?

Accepted Answer

The malware file hash, because it directly identifies the reused sample.. Option B is correct because the malware file hash (e.g., SHA-256) provides a static, deterministic identifier for the exact binary sample. Since the adversary reuses the same malware binary across incidents, the hash remains unchanged and can be used to create a precise detection rule (e.g., a YARA rule or hash-based IOC blocklist) that will reliably match the malicious file regardless of network-level churn like domain or IP changes.

Answer

The daily domain names, because they are the easiest items to collect.

Answer

The cloud provider name, because the attacker uses disposable infrastructure.

Answer

The time of day the campaign was observed, because the attacker is consistent.

Question 10

A user's laptop starts renaming many documents, and a ransom note appears on the desktop. What is the best immediate action for the help desk to recommend?

Accepted Answer

Disconnect the laptop from the network to contain the infection.. Disconnecting the laptop from the network immediately stops the ransomware from communicating with its command-and-control (C2) server, preventing further encryption of network shares and lateral movement. This containment step is critical before any remediation, as it isolates the threat and preserves evidence for forensic analysis.

Answer

Shut down the laptop immediately and leave it on the desk.

Answer

Delete the ransom note and continue working until the next reboot.

Answer

Install a new browser extension to block the attacker.

Question 11

Based on the exhibit, what is the BEST immediate containment action?

The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.

Accepted Answer

Immediately isolate the endpoint from the network using EDR containment or switch quarantine.. Option A is correct because the immediate priority is to stop the active malicious activity (file renaming, system slowdown) by severing the workstation's network connectivity. EDR containment or switch quarantine isolates the endpoint at Layer 2, preventing the attacker from exfiltrating data, communicating with command-and-control servers, or spreading laterally, while preserving volatile memory for forensic analysis. This is faster and more controlled than powering off, which destroys evidence and may trigger destructive payloads.

Answer

Power off the workstation immediately to prevent any further file changes.

Answer

Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.

Answer

Block the destination IP address at the firewall and wait for the user to log off.

Question 12

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

Accepted Answer

Fileless malware that relies on scripting and memory-resident execution.. Option A is correct because the described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Answer

A macro virus that only runs when a document is opened.

Answer

A boot sector virus that persists by altering startup code.

Answer

A logic bomb that activates only when a specific date or event is reached.

Question 13

A user reports that their laptop is showing frequent pop-up ads, the browser homepage keeps changing, and the system has become noticeably slower. What is the most likely immediate containment action?

Accepted Answer

Disconnect the laptop from the network and begin endpoint isolation. The best immediate action is to isolate the laptop from the network. The symptoms suggest malicious or unwanted software may be communicating with outside servers or affecting the browser. Isolation limits further damage, prevents possible spread, and gives responders time to inspect the system safely. This is a standard first containment step when a workstation appears compromised but is still active.

Why others are wrong: Keeping the laptop online risks continued malicious activity. Reimaging too early can destroy evidence needed for root-cause analysis. Simply reinstalling the browser may remove a symptom, but it does not address the possibility of a broader endpoint compromise.

Answer

Keep the laptop online so security tools can continue collecting data

Answer

Immediately reimage the laptop before preserving any evidence

Answer

Ask the user to uninstall the browser and reinstall it manually

Question 14

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

Accepted Answer

Lateral movement using compromised credentials to pivot across the environment.. The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Answer

Distributed denial-of-service activity against the internal network.

Answer

Port scanning from an external attacker trying to enumerate exposed services.

Answer

DNS tunneling used to bypass content filtering and exfiltrate data.

Question 15

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

Accepted Answer

The VPN appliance issue, because it is critical and publicly exploitable.. The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Answer

The internal test server issue, because test systems are always higher risk.

Answer

Both issues at the same time without assigning a priority.

Answer

Neither issue, because scanners can produce false positives.