SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 9 — 15 Questions

Question 1

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

Accepted Answer

Fileless attack, because the malicious activity is operating primarily in memory and using native tools.. The correct answer is A because the attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Answer

Ransomware, because the user opened an email attachment.

Answer

Worm, because PowerShell is a common scripting tool.

Answer

Rootkit, because the attacker is hiding the process from normal tools.

Question 2

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 3

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

Accepted Answer

SQL injection. The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 4

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

Accepted Answer

Verify the request using a known phone number or portal from previous records before taking action.. Option B is correct because the email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Answer

Reply to the email asking for confirmation of the new bank details.

Answer

Forward the email to the vendor's entire contact list to warn them immediately.

Answer

Open the attached invoice to check whether the payment information matches past records.

Question 5

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

Accepted Answer

Trojan. The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Answer

Worm

Answer

Rootkit

Answer

Ransomware

Question 6

A finance laptop is opened to review an invoice attachment. EDR then shows winword.exe launching powershell.exe with hidden, no-profile, and base64-encoded arguments. No executable is written to disk, network beacons begin from memory, and after a reboot the activity disappears unless the document is opened again. What type of malware behavior is most likely?

Accepted Answer

Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.. The scenario describes malicious code that executes entirely in memory without writing an executable to disk, which is the defining characteristic of a fileless attack. Winword.exe launching PowerShell with hidden, no-profile, and base64-encoded arguments is a classic technique to load and execute payloads directly in memory, bypassing traditional file-based detection. The fact that activity disappears after reboot unless the document is reopened confirms that no persistent artifact remains on disk, further supporting fileless behavior.

Answer

Worm behavior, because the infection would self-replicate across systems through the network.

Answer

Rootkit behavior, because the malware is hidden from normal user-mode tools.

Answer

Ransomware, because the user opened an invoice attachment before the suspicious activity started.

Question 7

Based on the exhibit, what vulnerability is the application most likely suffering from?

Accepted Answer

Stored cross-site scripting, because attacker-controlled script is saved and later rendered to other users.. The application stores user-supplied input in a review field and later renders it to other users without proper sanitization. The exhibit shows a script tag attempting to exfiltrate cookies to a remote host, which is a classic stored cross-site scripting (XSS) payload. Because the malicious script is persisted on the server and executed in the browsers of subsequent visitors, the vulnerability is stored XSS.

Answer

Command injection, because the script attempts to send cookies to a remote host.

Answer

Session fixation, because users saw the same review page after posting.

Answer

Insecure deserialization, because the payload is embedded in a review field.

Question 8

After an endpoint cleanup, an EDR agent shows inconsistent results: a suspicious process does not appear in normal task listings, a file in System32 is hidden from user-mode tools, and some security logs stop recording events at the same time. Which malware type best matches these symptoms?

Accepted Answer

Rootkit, because it hides processes, files, or activity from standard system tools.. A rootkit is designed to hide its presence and the presence of associated processes, files, and system activities from standard operating system tools and user-mode APIs. The symptoms described—a process invisible to task listings, a hidden file in System32, and security logs ceasing to record events—are classic indicators of kernel-mode or user-mode rootkit behavior that intercepts system calls to filter out its own artifacts.

Answer

Spyware, because it secretly collects user information and browser data.

Answer

Worm, because it spreads quickly through network shares and email attachments.

Answer

Trojan, because it masquerades as legitimate software to trick the user.

Question 9

After installing a free PDF-to-Word utility from an unofficial website, a user's laptop starts sending data to an unknown server and the security agent is disabled. Which malware type best fits?

Accepted Answer

Trojan. A Trojan is malware disguised as legitimate software, such as a free PDF-to-Word utility, that performs malicious actions without the user's knowledge. In this scenario, the Trojan exfiltrates data to an unknown server and disables the security agent, which are classic Trojan behaviors—unlike self-replicating worms or passive spyware. The user's intentional download from an unofficial website is the typical infection vector for Trojans.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 10

A customer enters `` into a public forum signature field. Later, other users who view that signature see the script execute in their browsers. What attack is this?

Accepted Answer

Cross-site scripting. This is a classic stored cross-site scripting (XSS) attack. The malicious script is injected into a persistent data store (the forum signature field) and later served to other users without proper sanitization, causing the browser to execute the script in the context of the trusted site.

Answer

SQL injection

Answer

Session replay

Answer

Directory traversal

Question 11

A help desk technician receives an email that appears to come from the payroll provider. The message says the employee's direct deposit will be suspended unless they verify their account through a link. What type of attack is this?

Accepted Answer

Phishing. This is a classic phishing attack because the email impersonates a trusted entity (the payroll provider) and uses social engineering to trick the recipient into clicking a malicious link. Phishing specifically involves fraudulent electronic communications, such as email, to deceive victims into revealing sensitive information or installing malware. The attack vector here is email-based, which aligns directly with the definition of phishing in the SY0-701 domain of threats and vulnerabilities.

Answer

Baiting

Answer

Vishing

Answer

Pretexting

Question 12

An accounts payable specialist receives a reply inside an existing vendor email thread. The message uses the real invoice number, matches the vendor's usual tone, and asks the specialist to change payment instructions to a new bank account before the end of the day. The vendor later confirms its mailbox was compromised. What type of attack is most likely?

Accepted Answer

Business email compromise through conversation hijacking, because the attacker used a compromised mailbox to alter a trusted thread.. This is a business email compromise (BEC) attack specifically using conversation hijacking. The attacker gained access to the vendor's legitimate email account and inserted a fraudulent reply into an existing, trusted email thread, leveraging the compromised mailbox to bypass the specialist's suspicion. This differs from standard spear phishing because the attacker did not craft a new email from a spoofed address but instead hijacked an ongoing, authenticated conversation.

Answer

Spear phishing, because the attacker targeted one employee with a convincing message.

Answer

Baiting, because the attacker tried to tempt the user with urgency and financial pressure.

Answer

Vishing, because the attacker is trying to persuade the user to change banking details.

Question 13

A VPN concentrator shows that an authentication request from a user was accepted twice, even though the user insists they approved only one login. Packet analysis reveals that the second successful attempt reused the same authentication blob and arrived shortly after the first. Which attack is the best fit?

Accepted Answer

Replay attack, because a captured valid authentication message was resent to gain access again.. The scenario describes a captured authentication blob being reused to gain a second successful authentication. This is the hallmark of a replay attack, where an attacker intercepts a valid authentication message (e.g., a Kerberos TGT, RADIUS Access-Accept, or a VPN pre-shared key hash) and retransmits it to the VPN concentrator to impersonate the user. The VPN concentrator accepted the duplicate because it lacked proper replay protection mechanisms such as timestamps, sequence numbers, or one-time-use nonces.

Answer

ARP poisoning, because the attacker redirected traffic by altering local address resolution.

Answer

Phishing, because the user was tricked into entering credentials on a fake page.

Answer

Denial of service, because the attacker is overwhelming the VPN gateway with requests.

Question 14

A remote user's laptop begins launching a legitimate-looking "System Update" application at login. After the update window appears, the browser homepage changes, outbound traffic increases, and the user later reports that saved passwords are being used in unauthorized logins. Which malware type is the most likely primary infection?

Accepted Answer

Trojan, because it is disguised as a harmless utility while delivering malicious payloads.. Option B is correct because the malware is disguised as a legitimate 'System Update' application, which is the classic behavior of a Trojan. Trojans rely on social engineering to trick users into executing them, and once activated, they can deliver secondary payloads such as password stealers, browser hijackers, or backdoors. In this scenario, the Trojan likely installed a keylogger or credential harvester to exfiltrate saved passwords, changed browser settings via registry or configuration file manipulation, and increased outbound traffic to a command-and-control (C2) server.

Answer

Worm, because it is spreading automatically to nearby systems on the network.

Answer

Ransomware, because files would be encrypted and a payment demand would appear.

Answer

Rootkit, because the malware is hiding its own presence by modifying kernel behavior.

Question 15

A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?

Accepted Answer

Change the default credentials on the internal admin console and restrict access to only approved management hosts.. Option C is correct because the most immediate risk is that an attacker on the corporate VLAN can access the internal admin console using default credentials (admin/admin). This bypasses the firewall and allows full control of the application server. Even though OpenSSL has a backported fix, the default credentials represent an active, easily exploitable vulnerability that requires no additional exploit development.

Answer

Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.

Answer

Ignore the 8443 service, because the internet firewall already prevents external exposure.

Answer

Leave the console as-is and focus only on changing the bind address to 127.0.0.1.