SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 8 — 15 Questions

Question 1

NetFlow and authentication logs show one workstation opening SMB and WinRM sessions to many internal hosts within ten minutes. The same source also generates a sharp rise in Kerberos service-ticket requests and attempts to access administrative shares. Which three observations most strongly support lateral movement rather than normal admin activity? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A rapid burst of SMB and WinRM connections to many internal systems from one source host.. A rapid burst of SMB and WinRM connections from a single workstation to many internal hosts is a classic indicator of lateral movement. Normal administrative activity typically involves targeted, sequential connections to specific systems for maintenance, not a broad, automated sweep. This pattern suggests an attacker using tools like PsExec or PowerShell remoting to propagate across the network.

Answer

Regular outbound DNS lookups for common internet services like time synchronization or content delivery.

Answer

A successful sign-in to the user's cloud email account from the employee's home network at lunchtime.

Question 2

A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?

Accepted Answer

Session hijacking, because a stolen session token was reused to impersonate the user.. The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.

Answer

Pretexting, because the attacker pretended to be an authorized employee on a phone call.

Answer

CSRF, because the victim was tricked into sending unwanted requests from their browser.

Answer

Insecure deserialization, because serialized objects were accepted without validation.

Question 3

A web login form uses unsanitized input in the backend query. When an attacker enters `' OR '1'='1'--` into the username field, the application grants access without a valid password. Which attack pattern is being used?

Accepted Answer

SQL injection, because the input changes the meaning of the database query.. The attacker's input (`' OR '1'='1'--`) is a classic SQL injection payload that alters the structure of the backend SQL query. By injecting a tautology (`OR '1'='1'`) and commenting out the rest of the query with `--`, the attacker bypasses authentication, causing the database to return a valid row without requiring a correct password.

Answer

Cross-site scripting, because the attacker is trying to run code in the browser.

Answer

Broken session management, because the user is still logged in after leaving the page.

Answer

Insecure deserialization, because the application accepts user input.

Question 4

A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?

Accepted Answer

Replace or upgrade the end-of-life firmware with a supported version.. Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.

Answer

Increase logging and keep the current firmware until a problem appears.

Answer

Move the server to a different subnet and continue using the same firmware.

Answer

Change the administrator password and leave the device in place.

Question 5

A forum lets users save a profile signature. One user enters a string containing script code, and later other users who view that profile see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic stored cross-site scripting (XSS) attack. The malicious script is permanently stored on the server (in the user's profile signature) and executed in the browsers of any other user who views that profile. The attack exploits the forum's failure to sanitize user input before rendering it in HTML, allowing arbitrary JavaScript to run in the victim's session context.

Answer

Command injection

Answer

CSRF

Answer

Broken authentication

Question 6

During troubleshooting, several hosts in VLAN 20 lose access to the default gateway at random. Their ARP caches now map the gateway IP to a workstation MAC address, and traffic briefly flows through that workstation before timing out. What attack is most likely?

Accepted Answer

ARP poisoning, because false ARP replies are redirecting gateway traffic to another host.. The scenario describes classic ARP poisoning (also known as ARP spoofing). The attacker sends forged ARP replies to the hosts in VLAN 20, associating the gateway's IP address with the attacker's MAC address. This causes the hosts to forward traffic destined for the gateway to the attacker's workstation, where it is briefly forwarded (or dropped) before timing out, matching the symptoms of a man-in-the-middle attack via ARP cache corruption.

Answer

DNS poisoning, because the workstation name may be resolving to the wrong IP address.

Answer

Replay attack, because the attacker is reusing old network frames to confuse the hosts.

Answer

Denial of service, because traffic eventually times out and connectivity is lost.

Question 7

Based on the exhibit, what type of malware behavior is most likely occurring?

Accepted Answer

Fileless attack, because PowerShell was launched in memory with no new payload written to disk.. The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.

Answer

Ransomware, because the endpoint made an outbound connection after opening a document.

Answer

Spyware, because the laptop made an encrypted outbound connection.

Answer

Worm activity, because the laptop communicated with an external IP address.

Question 8

A vulnerability scan reports that a public web server is running an operating system version that no longer receives security updates. Which issue is present?

Accepted Answer

Outdated component. An operating system version that no longer receives security updates is an outdated component. This means the vendor has ceased patching known vulnerabilities, leaving the system exposed to exploits that target unpatched flaws. In the context of a public web server, this directly violates the principle of maintaining a secure baseline and is a common finding in vulnerability scans.

Answer

Weak permissions

Answer

DNS poisoning

Answer

Smishing

Question 9

After a switch reboot in a conference room, several laptops obtain valid IP addresses in the correct subnet, but their default gateway changes to 10.20.40.50, which is not the legitimate router. Packet capture shows DHCP offers coming from a MAC address that does not belong to the approved DHCP server, and the rogue device responds faster than the real server. What attack is most likely occurring?

Accepted Answer

Rogue DHCP service, because an unauthorized DHCP server is handing out network settings.. The scenario describes an unauthorized device responding to DHCP discovery messages faster than the legitimate server, assigning valid IPs but a rogue default gateway (10.20.40.50). This is the classic behavior of a rogue DHCP server, which intercepts DHCP traffic to manipulate client network settings, enabling man-in-the-middle attacks. The packet capture confirming DHCP offers from an unknown MAC address directly identifies the attack as a Rogue DHCP service.

Answer

ARP poisoning, because the attacker is changing IP-to-MAC mappings on the local network.

Answer

Replay attack, because the attacker is reusing old DHCP offers.

Answer

DNS poisoning, because the clients are being sent to the wrong network path.

Question 10

Based on the exhibit, what type of web attack is most likely taking place?

Accepted Answer

SQL injection, because the attacker is manipulating the database query with crafted input.. The exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.

Answer

Cross-site scripting, because the input is visible in the URL and causes an error.

Answer

Broken authentication, because the application returns a 500 error.

Answer

Insecure deserialization, because the application is parsing attacker-controlled data.

Question 11

A web portal builds its database query by directly appending a user's search input. When the user types a single quote, the application returns a database error. Which attack is most likely?

Accepted Answer

SQL injection. The application directly concatenates user input into a database query without sanitization. When a single quote (') is appended, it breaks the SQL string delimiter, causing a syntax error that the database exposes. This is the classic indicator of a SQL injection vulnerability, where an attacker can manipulate the query structure.

Answer

Cross-site scripting

Answer

DNS poisoning

Answer

Privilege escalation

Question 12

At a conference, employees connect to a Wi-Fi network named "CorpGuest" and then see certificate warnings in their browsers. The network has a stronger signal than the hotel's legitimate guest Wi-Fi. What attack is this?

Accepted Answer

Rogue access point. This scenario describes a rogue access point attack. The attacker sets up a Wi-Fi network named "CorpGuest" with a stronger signal than the legitimate hotel guest Wi-Fi, tricking employees into connecting to it. Once connected, the attacker can intercept traffic and present a fake certificate, causing browser certificate warnings. This is a classic evil twin variant of a rogue access point attack.

Answer

ARP poisoning

Answer

Replay attack

Answer

Denial of service

Question 13

Based on the exhibit, what security issue is most likely present?

Accepted Answer

Exposed service, because management and streaming ports are listening on all interfaces and allowed from anywhere.. The exhibit shows that both the management interface (TCP 443) and the streaming interface (TCP 554) are bound to 0.0.0.0 (all interfaces) and the firewall rules allow traffic from 0.0.0.0/0 (any source). This exposes the camera's web management and RTSP streaming services to the entire internet, making it vulnerable to unauthorized access, reconnaissance, and potential exploitation. An exposed service of this nature is a common entry point for attackers to compromise IoT devices.

Answer

Weak permissions, because the camera streams video to multiple ports.

Answer

Default credentials, because the admin login is enabled.

Answer

Outdated component, because firmware version 1.0.3 is listed.

Question 14

A user enters `` into a public comment field, and other visitors see the script run in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic cross-site scripting (XSS) attack because the user-supplied input containing a script tag is echoed back to other visitors' browsers without proper sanitization or encoding. The script executes in the context of the victim's browser, allowing the attacker to steal cookies, redirect users, or deface the page. XSS exploits the trust a user has for a particular website, unlike SQL injection which targets the database.

Answer

SQL injection

Answer

Broken authentication

Answer

Insecure deserialization

Question 15

Based on the exhibit, what network attack is most likely occurring on the office LAN?

Accepted Answer

ARP poisoning, because a rogue system is sending false layer 2 address mappings.. ARP poisoning is the correct answer because the exhibit shows a rogue system sending unsolicited ARP replies that map the gateway's IP address to the attacker's MAC address. This causes traffic destined for the gateway to be redirected to the attacker, enabling man-in-the-middle interception. The attack exploits the lack of authentication in ARP, allowing false layer 2 address mappings to corrupt the ARP cache of other hosts on the LAN.

Answer

Replay attack, because the same ARP reply appears multiple times.

Answer

Denial of service, because users notice certificate warnings.

Answer

DNS poisoning, because the users cannot reach internal sites cleanly.