SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 8 — 15 Questions

Question 1

A SaaS portal issues signed JWTs in a browser cookie. The help desk confirms a user logged out at 09:10, but SIEM logs show the same token was accepted from a different IP at 09:12 and continued working until the token expired. The application does not keep a server-side revocation list. What weakness is most likely being abused?

Accepted Answer

Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.. The correct answer is B because the scenario describes a classic session hijacking or session abuse attack. The application issues signed JWTs in cookies and does not maintain a server-side revocation list, meaning once a token is issued, it remains valid until its expiration. Even after the legitimate user logs out at 09:10, the attacker can replay the same JWT from a different IP at 09:12, and the server will accept it because there is no mechanism to invalidate the token. This lack of revocation is the core weakness being exploited.

Answer

SQL injection, because the attacker must be manipulating backend database logic to reuse the token.

Answer

Insecure deserialization, because the token is being decoded and reconstructed on the server.

Answer

Cross-site request forgery, because the request is coming from a different IP address.

Question 2

An employee receives a text message from "IT Help" saying their account will be disabled unless they tap a link and enter a one-time code. Five minutes later, someone calls claiming to be from IT and asks the employee to read back the same code. Which two social engineering delivery methods are used? Select two.

Accepted Answer

Smishing. Smishing is correct because the initial contact is via SMS text message, which is the defining characteristic of smishing (SMS phishing). The attacker uses a text message to deliver a phishing lure, prompting the employee to tap a link and enter a one-time code.

Answer

Baiting

Answer

Whaling

Answer

Tailgating

Question 3

A customer service application shows the same session ID being used from two countries within five minutes. The legitimate user did not report a password change, but an order shipping address was modified successfully without reauthentication. What attack pattern is most likely?

Accepted Answer

Session abuse, because a stolen or replayed session token allowed unauthorized actions.. The simultaneous use of the same session ID from two different countries within five minutes, combined with a successful address change without reauthentication, indicates that an attacker has obtained and reused the legitimate user's session token. This is session abuse, where the attacker leverages a stolen or replayed session token to perform unauthorized actions, bypassing the need for credentials or reauthentication.

Answer

Broken authentication, because the application failed to verify the user again.

Answer

Cross-site request forgery, because the attacker may have tricked the browser into sending a request.

Answer

Credential stuffing, because the account was likely accessed using reused passwords.

Question 4

After installing a free utility from an unofficial website, a user's laptop starts quietly sending browsing data to an unknown server. What type of malware is most likely present?

Accepted Answer

Spyware. Spyware is designed to covertly collect user data, such as browsing habits, and transmit it to a remote server without consent. The scenario describes a free utility from an unofficial website that quietly exfiltrates browsing data, which is the classic behavior of spyware. Unlike other malware types, spyware focuses on surveillance and data theft rather than system damage or self-replication.

Answer

Ransomware

Answer

Worm

Answer

Rootkit

Question 5

A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?

Accepted Answer

Exposed management service. The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.

Answer

Default credentials

Answer

Outdated component

Answer

Weak permissions

Question 6

Based on the exhibit, which malware type is most likely involved?

Accepted Answer

Ransomware, because files were encrypted and recovery options were intentionally removed.. The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Answer

Trojan, because the malware was likely disguised as a legitimate file.

Answer

Spyware, because the attacker is trying to monitor user activity quietly.

Answer

Rootkit, because the attacker is hiding from the operating system.

Question 7

A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?

Accepted Answer

World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.. Option C is correct because the combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.

Answer

Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.

Answer

Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.

Answer

Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.

Question 8

Several employees receive a text message that says their payroll deposit failed and they must tap a link to verify account details. The link opens a fake login page. What type of attack is this?

Accepted Answer

Smishing. Smishing is a form of phishing that uses SMS (Short Message Service) text messages as the attack vector. In this scenario, the attacker sends a fraudulent text message claiming a payroll deposit failure and includes a link to a fake login page, which is the classic mechanism of smishing. The attack relies on social engineering via SMS to trick the recipient into revealing sensitive credentials.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 9

A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?

Accepted Answer

Fileless attack, because the malicious activity lives in memory and uses built-in tools.. The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.

Answer

Worm, because the host is making outbound connections to a remote system.

Answer

Spyware, because the host is communicating with an external IP address.

Answer

Rootkit, because the system tools are being hidden from the user.

Question 10

After a user installs a free PDF converter from an unofficial site, the browser homepage changes, the endpoint protection agent stops launching, and the system begins making periodic outbound connections to the same unfamiliar IP address. No exploit was used during installation, and the installer appeared legitimate. What type of malware best matches this behavior?

Accepted Answer

Trojan, because it masquerades as useful software while delivering hidden malicious functionality.. B is correct because the software masquerades as a legitimate PDF converter while secretly performing malicious actions—changing the browser homepage, disabling endpoint protection, and making unauthorized outbound connections. This is the classic definition of a Trojan horse: it appears useful but contains hidden, harmful functionality. The lack of an exploit and the user's voluntary installation further confirm it is a Trojan, not a self-replicating worm or a kernel-hiding rootkit.

Answer

Worm, because the infection is spreading automatically across the network.

Answer

Rootkit, because the attacker must have hidden files in the kernel.

Answer

Spyware, because the main symptom is that the browser homepage changed.

Question 11

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Spear phishing, because the email is tailored to a specific employee and business context.. Option B is correct because spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Answer

Phishing, because the message is a broad email that tries to trick the recipient.

Answer

Vishing, because the attacker is using a phone call to pressure the victim.

Answer

Baiting, because the attacker is offering a document that the user wants to open.

Question 12

EDR on a workstation shows winword.exe spawning powershell.exe with hidden, no-profile, and encoded arguments. No new executable is written to disk. Minutes later, a scheduled task creation is blocked, but the same host continues making HTTPS requests to a cloud IP address. Which malware category best fits this behavior?

Accepted Answer

Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.. The correct answer is D because the attack uses legitimate tools (winword.exe spawning powershell.exe) with hidden, no-profile, and encoded arguments to execute a payload entirely in memory, never writing a new executable to disk. This is the hallmark of a fileless attack, which relies on in-memory execution and living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection. The subsequent scheduled task creation block and persistent HTTPS connections to a cloud IP further indicate a fileless malware that establishes command-and-control (C2) without dropping files.

Answer

Trojan, because the malicious activity likely started from a user-opening event.

Answer

Worm, because the host is making repeated outbound network connections.

Answer

Rootkit, because the process is using hidden commands and network connections.

Question 13

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 14

Users in a warehouse report an SMS claiming a missed delivery. The link opens a login page that closely matches the company portal, and several users later receive unauthorized password reset emails. What attack is most likely?

Accepted Answer

Smishing, because the malicious lure is delivered through text messaging.. The attack is smishing because the initial lure is delivered via SMS (Short Message Service), directing victims to a fraudulent login page. This aligns with the definition of smishing, a form of phishing that uses text messages to trick recipients into revealing sensitive information. The subsequent unauthorized password reset emails confirm credential compromise, which is the typical goal of smishing attacks.

Answer

Vishing, because the attackers are likely trying to get a callback from the victims.

Answer

Spear phishing, because the message appears customized for warehouse employees.

Answer

Baiting, because the fake delivery notice tempts users to click for a reward.

Question 15

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

Accepted Answer

Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.. The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Answer

Replay attack, because previously captured wireless frames are being resent to the network.

Answer

DNS poisoning, because users are being sent to the wrong website through altered name resolution.

Answer

Denial of service, because users are simply unable to connect reliably.