SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 6 — 15 Questions

Question 1

Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?

Accepted Answer

The malware file hash from the shared sample. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.

Answer

The current weather in the city where the attack was observed

Answer

The logo used on the phishing email

Answer

The time zone used by the help desk

Question 2

Threat intelligence reports a campaign that rotates domains daily and repacks the malware for each delivery. Analysts also observe the same TLS certificate fingerprint, the same mutex name, and the same JA3 client fingerprint across multiple samples. Which three indicators are most useful to prioritize for hunting or blocking? Select three.

Accepted Answer

The TLS certificate fingerprint reused by multiple samples.. The TLS certificate fingerprint is a reliable indicator because it is derived from the certificate's public key and metadata, which remain static even when the malware's domain or IP address changes. Since the threat intelligence report states the same fingerprint is reused across multiple samples, this provides a stable, immutable identifier that can be used to detect or block malicious TLS handshakes regardless of domain rotation.

Answer

The current domain name used by the command-and-control server.

Answer

The public IP address currently hosting the malware sample.

Question 3

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

Accepted Answer

The executable hash from the malware sample.. Option B is correct because the executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Answer

The daily domain name used for command and control.

Answer

The employee's home city where the alert was observed.

Answer

The brand of the user's keyboard and mouse.

Question 4

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

Accepted Answer

Smishing, because the attack is delivered by text message.. This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Answer

Watering hole, because the attacker compromised the HR partner's website.

Answer

Spoofing only, because the attacker copied the HR logo in the message.

Answer

Port scanning, because the attacker wants to find open services on the phone.

Question 5

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Accepted Answer

Verify the request using a known supplier contact method before taking action. Option C is correct because the clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 6

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 7

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

Accepted Answer

Isolate the workstation to stop possible lateral movement. Option B is correct because the SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Answer

Ignore the alert because SMB is a normal file-sharing protocol

Answer

Increase the workstation's monitor brightness to help the user notice alerts

Answer

Disable all SMB traffic across the entire company immediately

Question 8

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. Option A is correct because the request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 9

Based on the exhibit, what is the MOST likely explanation for the network traffic?

The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

Accepted Answer

DNS tunneling used for command-and-control or data transfer. The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Answer

ARP poisoning causing the host to redirect traffic to a rogue gateway

Answer

A browser cache synchronization feature repeatedly polling a cloud service

Answer

A misconfigured static route sending all web traffic to the wrong subnet

Question 10

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

Accepted Answer

The internet-facing file transfer appliance, because exploitability and exposure increase risk.. The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Answer

The lab server, because critical severity is always higher than high severity.

Answer

Both issues at the same time, because prioritization is unnecessary when two findings are present.

Answer

The lab server, because systems behind VPN are always more trusted than public systems.

Question 11

Based on the exhibit, what is the BEST response by the employee?

The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

Accepted Answer

Verify the request using a known internal help desk number or portal before taking any action.. Option A is correct because verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Answer

Reply with the six-digit code so the help desk can complete the repair quickly.

Answer

Open the linked repair page from the email and sign in immediately to avoid suspension.

Answer

Forward the message to the manager and continue using the account until the suspension occurs.

Question 12

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

Accepted Answer

Disconnect the laptop, then reimage it from a known-good source. Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Answer

Run a quick cleanup script and return the laptop to the user

Answer

Disable the user account and leave the device in place

Answer

Delete the suspected hidden files manually from Windows Explorer

Question 13

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 14

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.

Question 15

NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.

Accepted Answer

A rapid burst of SMB and WinRM connections to many internal systems from one source host.. Option A is correct because a rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.

Answer

Regular outbound DNS lookups for common internet services like time synchronization or content delivery.

Answer

A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.