SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 5 — 15 Questions

Question 1

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Accepted Answer

Enforce server-side object-level authorization checks before returning any document.. The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.

Answer

Add client-side JavaScript to hide document IDs from the user interface.

Answer

Require users to change passwords more frequently to prevent unauthorized document access.

Answer

Place the document server behind a load balancer to prevent direct access to the application.

Question 2

A vulnerability scan finds a critical flaw on an internet-facing SFTP gateway with public exploit code, and a high-severity flaw on an internal lab server that is only reachable from a restricted subnet. Which should be remediated first?

Accepted Answer

The internet-facing SFTP gateway, because it has higher immediate risk.. The internet-facing SFTP gateway has a critical vulnerability with public exploit code, meaning it is exposed to the entire internet and can be directly attacked without any network restrictions. This creates an immediate and high-likelihood risk of remote code execution or data breach, whereas the internal lab server is isolated to a restricted subnet, significantly reducing its attack surface and exploitability. Remediation priority should be based on risk severity (likelihood × impact), not just CVSS score, making the SFTP gateway the correct first choice.

Answer

The internal lab server, because every high-severity finding should be fixed first.

Answer

Both systems can wait until the next scheduled maintenance window.

Answer

Neither system needs urgent action because the lab server is isolated.

Question 3

A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Accepted Answer

Isolate the workstation from the network for containment.. The workstation's sudden SMB connections to many internal servers strongly indicate compromise, such as ransomware or worm propagation. Isolating the workstation immediately contains the threat, preventing lateral movement and further damage while preserving forensic evidence.

Answer

Allow the traffic because SMB is a normal file-sharing protocol.

Answer

Delete the local event logs to reduce alert noise.

Answer

Disable all SMB services on every server immediately.

Question 4

Based on the exhibit, what is the MOST likely activity taking place on the network?

A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.

Accepted Answer

An attacker is performing lateral movement using stolen credentials and remote administration tools.. The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.

Answer

A worm is flooding the network with broadcast traffic and exhausting bandwidth.

Answer

A malicious insider is exfiltrating data through a cloud sync application.

Answer

A misconfigured printer is repeatedly scanning the subnet for available services.

Question 5

A development team wants to allow users to search orders by customer name and date range. Logs show the team currently concatenates the filter values into SQL strings. Which change best reduces SQL injection risk without removing the search feature?

Accepted Answer

Use parameterized queries or prepared statements for the search filters.. Parameterized queries (also known as prepared statements) separate SQL logic from user data by sending the query structure and parameters independently to the database. This ensures that user-supplied filter values are always treated as data, never as executable SQL code, which completely prevents SQL injection even if the input contains malicious characters like apostrophes or SQL keywords.

Answer

Escape apostrophes in the input before building the SQL statement.

Answer

Disable database error messages so attackers cannot see query details.

Answer

Place the application behind a VPN so only internal users can run searches.

Question 6

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Ransomware, because the files are being renamed and recovery copies are being deleted.. The exhibit shows files being renamed with a new extension and recovery copies (shadow copies) being deleted via vssadmin.exe. This is a classic ransomware behavior: encrypting user files and removing Volume Shadow Copy backups to prevent recovery without the attacker's key. Ransomware specifically targets document files and system restore points to maximize extortion leverage.

Answer

Adware, because documents are no longer opening correctly.

Answer

Rootkit, because the system is using a command-line utility.

Answer

Spyware, because the attacker wants to read user documents.

Question 7

A file-sharing portal uses a download URL like /download?file=12345. A tester changes the value to 12346 and can access another department's document without logging in again. Which control most directly prevents this issue?

Accepted Answer

Implement server-side authorization checks for every object request.. The issue is that the server trusts the file identifier in the URL without verifying that the authenticated user is authorized to access the requested resource. Implementing server-side authorization checks for every object request ensures that before serving any file, the server validates whether the current session or user has explicit permission to access that specific document. This directly prevents the IDOR (Insecure Direct Object Reference) vulnerability demonstrated by the tester.

Answer

Make the identifier longer so users cannot guess nearby values.

Answer

Move the portal to HTTPS so request parameters cannot be intercepted.

Answer

Store the document name in a hidden field and validate it in JavaScript.

Question 8

An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.

Accepted Answer

Isolate the workstation from the network using EDR or NAC containment.. Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.

Answer

Immediately wipe and reimage the workstation before collecting anything else.

Answer

Power the workstation off immediately to stop the malware process.

Answer

Disable every user account in the finance department to prevent further compromise.

Question 9

An employee receives an email that appears to come from payroll and asks them to open a link to "confirm direct deposit details". The link goes to a site with a slightly misspelled company name. What should the employee do first?

Accepted Answer

Use the company's known payroll portal or help desk contact to verify the request. The safest first step when receiving a suspicious email is to verify its legitimacy through a trusted, independent channel—such as the company's known payroll portal or the help desk. This avoids interacting with the potentially malicious link or sender, which could lead to credential theft or malware installation. The email exhibits classic phishing indicators: a spoofed sender, a request for sensitive action, and a URL with a misspelled domain.

Answer

Click the link and sign in quickly before the account is locked

Answer

Reply to the email and ask payroll whether the message is real

Answer

Forward the message to co-workers so they can compare it with similar emails

Question 10

Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?

Accepted Answer

The TLS certificate fingerprint that remains constant across samples.. A TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.

Answer

The daily-changing domain names used by the campaign.

Answer

The executable file hash that remains constant across samples.

Answer

The changing user agent string seen on each host.

Question 11

A scan reports a critical remote code execution vulnerability on an internet-facing VPN appliance with public proof-of-concept exploit code available. It also reports a critical local privilege escalation on an isolated lab workstation. Patch windows are limited this week. Which should be remediated first?

Accepted Answer

The internet-facing VPN appliance because it has higher exposure and exploitability.. The internet-facing VPN appliance presents a higher risk because it is exposed to the public internet and has a known remote code execution vulnerability with public exploit code. This combination of high exposure (attack surface) and high exploitability (availability of proof-of-concept code) significantly increases the likelihood of a successful attack, making it the priority for remediation despite limited patch windows.

Answer

The isolated lab workstation because all critical findings must be patched in numerical order.

Answer

The internal printer because peripheral devices are often overlooked and therefore most dangerous.

Answer

The lab workstation because local privilege escalation is always more dangerous than remote code execution.

Question 12

A user's laptop suddenly starts renaming many files and showing a ransom note. The laptop is still connected to Wi-Fi. What is the best immediate action?

Accepted Answer

Disconnect the laptop from the network immediately.. Ransomware actively encrypts files and may communicate with a command-and-control (C2) server over the network to exfiltrate data or receive encryption keys. Disconnecting the Wi-Fi immediately stops further C2 communication, prevents lateral movement to other devices, and halts any ongoing data exfiltration. This containment step is critical before any remediation like system imaging or forensic analysis.

Answer

Reboot the laptop to stop the malicious process.

Answer

Delete the ransom note and continue working.

Answer

Change the user's password and wait for more details.

Question 13

Based on the exhibit, what is the BEST remediation for the application flaw shown?

A user-controlled parameter is being passed to a shell command on the server. The application is intended to test connectivity to approved internal hosts only.

Accepted Answer

Replace the shell call with a safe library function and strictly allowlist approved host values.. The application flaw is command injection: a user-controlled parameter is passed directly to a shell command (e.g., `ping`). The best remediation is to replace the shell call with a safe library function (e.g., `InetAddress.isReachable()` in Java or a dedicated ICMP library) and strictly allowlist approved internal host values, eliminating the possibility of injecting arbitrary commands like `; rm -rf /`.

Answer

Keep the current shell command, but add HTML encoding to the response page.

Answer

Increase the web server timeout so the ping utility has more time to complete.

Answer

Require users to authenticate before they can access the page.

Question 14

NetFlow shows one workstation opening SMB connections to a dozen internal servers and then attempting many WinRM connections. What is the most likely explanation?

Accepted Answer

The host is likely being used for lateral movement or internal reconnaissance.. SMB connections to many internal servers followed by WinRM attempts is a classic pattern of lateral movement or internal reconnaissance. An attacker or compromised host uses SMB to probe for accessible shares and then leverages WinRM for remote command execution, which is a common technique in post-exploitation frameworks like PsExec or CrackMapExec.

Answer

The workstation is probably downloading a routine operating system update.

Answer

The network is likely suffering from a wireless interference problem.

Answer

The user is likely printing documents to multiple shared printers.

Question 15

A user reports receiving repeated MFA push requests even though they are not logging in. Later, someone calls and claims to be IT, asking the user to approve one prompt so support can finish a password reset. Which control would best reduce the success of this attack?

Accepted Answer

Use phishing-resistant MFA with number matching or hardware security keys. Phishing-resistant MFA, such as number matching or hardware security keys (e.g., FIDO2/WebAuthn), prevents an attacker from tricking the user into approving a fraudulent push request. Number matching requires the user to enter a number displayed on the login screen into the MFA prompt, ensuring the approval is tied to an actual authentication attempt. Hardware security keys use cryptographic challenge-response, making it impossible for an attacker to replay or intercept the authentication factor.

Answer

Increase password complexity requirements

Answer

Shorten the screen-lock timeout on user devices

Answer

Allow users to approve any MFA prompt sent during business hours