SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 7 — 15 Questions

Question 1

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lateral movement using compromised credentials to pivot across the environment.. The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Answer

Distributed denial-of-service activity against the internal network.

Answer

Port scanning from an external attacker trying to enumerate exposed services.

Answer

DNS tunneling used to bypass content filtering and exfiltrate data.

Question 2

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

Accepted Answer

The VPN appliance issue, because it is critical and publicly exploitable.. The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Answer

The internal test server issue, because test systems are always higher risk.

Answer

Both issues at the same time without assigning a priority.

Answer

Neither issue, because scanners can produce false positives.

Question 3

Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?

Accepted Answer

The malware file hash from the shared sample. The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.

Answer

The current weather in the city where the attack was observed

Answer

The logo used on the phishing email

Answer

The time zone used by the help desk

Question 4

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

Accepted Answer

The executable hash from the malware sample.. The executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Answer

The daily domain name used for command and control.

Answer

The employee's home city where the alert was observed.

Answer

The brand of the user's keyboard and mouse.

Question 5

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

Accepted Answer

Smishing, because the attack is delivered by text message.. This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Answer

Watering hole, because the attacker compromised the HR partner's website.

Answer

Spoofing only, because the attacker copied the HR logo in the message.

Answer

Port scanning, because the attacker wants to find open services on the phone.

Question 6

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Accepted Answer

Verify the request using a known supplier contact method before taking action. The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 7

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 8

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

Accepted Answer

Isolate the workstation to stop possible lateral movement. The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Answer

Ignore the alert because SMB is a normal file-sharing protocol

Answer

Increase the workstation's monitor brightness to help the user notice alerts

Answer

Disable all SMB traffic across the entire company immediately

Question 9

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 10

Based on the exhibit, what is the MOST likely explanation for the network traffic?

The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

Accepted Answer

DNS tunneling used for command-and-control or data transfer. The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Answer

ARP poisoning causing the host to redirect traffic to a rogue gateway

Answer

A browser cache synchronization feature repeatedly polling a cloud service

Answer

A misconfigured static route sending all web traffic to the wrong subnet

Question 11

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

Accepted Answer

The internet-facing file transfer appliance, because exploitability and exposure increase risk.. The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Answer

The lab server, because critical severity is always higher than high severity.

Answer

Both issues at the same time, because prioritization is unnecessary when two findings are present.

Answer

The lab server, because systems behind VPN are always more trusted than public systems.

Question 12

Based on the exhibit, what is the BEST response by the employee?

The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

Accepted Answer

Verify the request using a known internal help desk number or portal before taking any action.. Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Answer

Reply with the six-digit code so the help desk can complete the repair quickly.

Answer

Open the linked repair page from the email and sign in immediately to avoid suspension.

Answer

Forward the message to the manager and continue using the account until the suspension occurs.

Question 13

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

Accepted Answer

Disconnect the laptop, then reimage it from a known-good source. Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Answer

Run a quick cleanup script and return the laptop to the user

Answer

Disable the user account and leave the device in place

Answer

Delete the suspected hidden files manually from Windows Explorer

Question 14

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 15

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.