SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 7 — 15 Questions

Question 1

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the request using a known supplier contact method before taking action. The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Answer

Open the link and compare it with the supplier's branding

Answer

Reply to the text and ask the sender to confirm the request

Answer

Forward the message to finance so they can decide whether it is legitimate

Question 2

Based on the exhibit, which issue should be remediated FIRST?

The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

Accepted Answer

Internet-facing VPN appliance. The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Answer

Internal HR file server

Answer

Lab workstation

Answer

DMZ reporting server

Question 3

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

Accepted Answer

Isolate the workstation to stop possible lateral movement. The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Answer

Ignore the alert because SMB is a normal file-sharing protocol

Answer

Increase the workstation's monitor brightness to help the user notice alerts

Answer

Disable all SMB traffic across the entire company immediately

Question 4

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Accepted Answer

The message requests a payment change outside the normal approval workflow.. The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Answer

The email contains a professional logo and a consistent signature block.

Answer

The email uses correct spelling and grammar throughout.

Question 5

Based on the exhibit, what is the MOST likely explanation for the network traffic?

The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

Accepted Answer

DNS tunneling used for command-and-control or data transfer. The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Answer

ARP poisoning causing the host to redirect traffic to a rogue gateway

Answer

A browser cache synchronization feature repeatedly polling a cloud service

Answer

A misconfigured static route sending all web traffic to the wrong subnet

Question 6

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

Accepted Answer

The internet-facing file transfer appliance, because exploitability and exposure increase risk.. The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Answer

The lab server, because critical severity is always higher than high severity.

Answer

Both issues at the same time, because prioritization is unnecessary when two findings are present.

Answer

The lab server, because systems behind VPN are always more trusted than public systems.

Question 7

Based on the exhibit, what is the BEST response by the employee?

The message appears to come from a trusted internal support team, but the sender details and request do not align with normal procedures.

Accepted Answer

Verify the request using a known internal help desk number or portal before taking any action.. Verifying the request through a known internal help desk number or portal is the standard security practice to confirm the legitimacy of any unexpected communication, especially when sender details and procedures do not align. This approach mitigates the risk of social engineering attacks, such as phishing or business email compromise (BEC), where attackers impersonate trusted entities to trick employees into revealing sensitive information or performing unauthorized actions. By using an independently verified contact method, the employee ensures they are not falling victim to a fraudulent request that could lead to account compromise or data breach.

Answer

Reply with the six-digit code so the help desk can complete the repair quickly.

Answer

Open the linked repair page from the email and sign in immediately to avoid suspension.

Answer

Forward the message to the manager and continue using the account until the suspension occurs.

Question 8

A security team suspects a rootkit after seeing hidden processes, boot-time persistence, and altered system files on a laptop. What is the best next step after confirming the suspicion?

Accepted Answer

Disconnect the laptop, then reimage it from a known-good source. Once a rootkit is confirmed, the system's integrity is compromised at the kernel or boot level, making any software-based cleanup unreliable. Reimaging from a known-good source ensures all malicious code, including bootkits and hidden processes, is completely eradicated. This aligns with the SY0-701 domain of incident response, where containment and eradication require a trusted baseline.

Answer

Run a quick cleanup script and return the laptop to the user

Answer

Disable the user account and leave the device in place

Answer

Delete the suspected hidden files manually from Windows Explorer

Question 9

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 10

An employee receives an email from someone claiming to be from IT. The message says the employee must read back a one-time verification code so their mailbox can be 'repaired.' What social engineering technique is being used?

Accepted Answer

Pretexting, because the attacker is using a fake identity and story to gain trust.. The attacker is using a fabricated identity (IT support) and a false scenario (mailbox repair requiring a verification code) to manipulate the employee into divulging sensitive information. This is the classic definition of pretexting, where the attacker creates a believable pretext to lower the victim's defenses and extract data or access.

Answer

Tailgating, because the attacker is trying to enter a secure area physically.

Answer

DDoS, because the message is designed to overwhelm the mailbox server.

Answer

Shoulder surfing, because the attacker is watching the screen from nearby.

Question 11

NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.

Accepted Answer

A rapid burst of SMB and WinRM connections to many internal systems from one source host.. A rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.

Answer

Regular outbound DNS lookups for common internet services like time synchronization or content delivery.

Answer

A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.

Question 12

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

Accepted Answer

Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.. The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Answer

SQL injection, because the attacker is changing a field to access a different page.

Answer

Cross-site request forgery, because the browser is sending a forged request to the application.

Answer

Cross-site scripting, because the modified object exposes an internal admin page.

Question 13

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

Accepted Answer

Session hijacking, because a stolen session token was reused to impersonate the user.. The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Answer

Pretexting, because the attacker pretended to be an authorized employee on a phone call.

Answer

CSRF, because the victim was tricked into sending unwanted requests from their browser.

Answer

Insecure deserialization, because serialized objects were accepted without validation.

Question 14

A web login form uses unsanitized input in the backend query. When an attacker enters `' OR '1'='1'--` into the username field, the application grants access without a valid password. Which attack pattern is being used?

Accepted Answer

SQL injection, because the input changes the meaning of the database query.. The attacker's input (`' OR '1'='1'--`) is a classic SQL injection payload that alters the structure of the backend SQL query. By injecting a tautology (`OR '1'='1'`) and commenting out the rest of the query with `--`, the attacker bypasses authentication, causing the database to return a valid row without requiring a correct password.

Answer

Cross-site scripting, because the attacker is trying to run code in the browser.

Answer

Broken session management, because the user is still logged in after leaving the page.

Answer

Insecure deserialization, because the application accepts user input.

Question 15

A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?

Accepted Answer

Replace or upgrade the end-of-life firmware with a supported version.. Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.

Answer

Increase logging and keep the current firmware until a problem appears.

Answer

Move the server to a different subnet and continue using the same firmware.

Answer

Change the administrator password and leave the device in place.