SY0-701 Threats, Vulnerabilities, and Mitigations Practice Test 9 — 15 Questions

Question 1

Based on the exhibit, which malware type is most likely involved?

Accepted Answer

Ransomware, because files were encrypted and recovery options were intentionally removed.. The exhibit shows that files have been encrypted with a '.locked' extension and that recovery options like System Restore and Volume Shadow Copy have been removed or disabled. This is a classic indicator of ransomware, which encrypts user data and then demands payment for decryption, often deleting backup files to prevent recovery without the attacker's key.

Answer

Trojan, because the malware was likely disguised as a legitimate file.

Answer

Spyware, because the attacker is trying to monitor user activity quietly.

Answer

Rootkit, because the attacker is hiding from the operating system.

Question 2

A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?

Accepted Answer

World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.. The combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.

Answer

Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.

Answer

Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.

Answer

Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.

Question 3

Several employees receive a text message that says their payroll deposit failed and they must tap a link to verify account details. The link opens a fake login page. What type of attack is this?

Accepted Answer

Smishing. Smishing is a form of phishing that uses SMS (Short Message Service) text messages as the attack vector. In this scenario, the attacker sends a fraudulent text message claiming a payroll deposit failure and includes a link to a fake login page, which is the classic mechanism of smishing. The attack relies on social engineering via SMS to trick the recipient into revealing sensitive credentials.

Answer

Phishing

Answer

Pretexting

Answer

Baiting

Question 4

A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?

Accepted Answer

Fileless attack, because the malicious activity lives in memory and uses built-in tools.. The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.

Answer

Worm, because the host is making outbound connections to a remote system.

Answer

Spyware, because the host is communicating with an external IP address.

Answer

Rootkit, because the system tools are being hidden from the user.

Question 5

After a user installs a free PDF converter from an unofficial site, the browser homepage changes, the endpoint protection agent stops launching, and the system begins making periodic outbound connections to the same unfamiliar IP address. No exploit was used during installation, and the installer appeared legitimate. What type of malware best matches this behavior?

Accepted Answer

Trojan, because it masquerades as useful software while delivering hidden malicious functionality.. B is correct because the software masquerades as a legitimate PDF converter while secretly performing malicious actions—changing the browser homepage, disabling endpoint protection, and making unauthorized outbound connections. This is the classic definition of a Trojan horse: it appears useful but contains hidden, harmful functionality. The lack of an exploit and the user's voluntary installation further confirm it is a Trojan, not a self-replicating worm or a kernel-hiding rootkit.

Answer

Worm, because the infection is spreading automatically across the network.

Answer

Rootkit, because the attacker must have hidden files in the kernel.

Answer

Spyware, because the main symptom is that the browser homepage changed.

Question 6

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Spear phishing, because the email is tailored to a specific employee and business context.. Spear phishing involves crafting a message that is personalized to a specific individual or role within an organization, often referencing internal processes or names to increase credibility. In the exhibit, the email is addressed to a specific employee and mentions a legitimate-sounding business context (e.g., an internal document or procedure), which is the hallmark of spear phishing rather than a generic blast.

Answer

Phishing, because the message is a broad email that tries to trick the recipient.

Answer

Vishing, because the attacker is using a phone call to pressure the victim.

Answer

Baiting, because the attacker is offering a document that the user wants to open.

Question 7

EDR on a workstation shows winword.exe spawning powershell.exe with hidden, no-profile, and encoded arguments. No new executable is written to disk. Minutes later, a scheduled task creation is blocked, but the same host continues making HTTPS requests to a cloud IP address. Which malware category best fits this behavior?

Accepted Answer

Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.. The attack uses legitimate tools (winword.exe spawning powershell.exe) with hidden, no-profile, and encoded arguments to execute a payload entirely in memory, never writing a new executable to disk. This is the hallmark of a fileless attack, which relies on in-memory execution and living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection. The subsequent scheduled task creation block and persistent HTTPS connections to a cloud IP further indicate a fileless malware that establishes command-and-control (C2) without dropping files.

Answer

Trojan, because the malicious activity likely started from a user-opening event.

Answer

Worm, because the host is making repeated outbound network connections.

Answer

Rootkit, because the process is using hidden commands and network connections.

Question 8

A file server suddenly renames documents with a new extension and displays a note demanding payment in cryptocurrency to restore access. What type of malware is most likely involved?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files on a system, making them inaccessible, and then demand a ransom—typically in cryptocurrency—to restore access. The sudden renaming of documents with a new extension is a hallmark of ransomware encryption, as it appends a custom extension to indicate the files have been locked. The displayed note demanding payment confirms the extortion motive, which is unique to ransomware among the given options.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 9

Users in a warehouse report an SMS claiming a missed delivery. The link opens a login page that closely matches the company portal, and several users later receive unauthorized password reset emails. What attack is most likely?

Accepted Answer

Smishing, because the malicious lure is delivered through text messaging.. The attack is smishing because the initial lure is delivered via SMS (Short Message Service), directing victims to a fraudulent login page. This aligns with the definition of smishing, a form of phishing that uses text messages to trick recipients into revealing sensitive information. The subsequent unauthorized password reset emails confirm credential compromise, which is the typical goal of smishing attacks.

Answer

Vishing, because the attackers are likely trying to get a callback from the victims.

Answer

Spear phishing, because the message appears customized for warehouse employees.

Answer

Baiting, because the fake delivery notice tempts users to click for a reward.

Question 10

During a conference, several employees connect to a wireless network named the same as the hotel's guest Wi-Fi. Shortly after connecting, they receive certificate warnings when accessing the company portal, and packet capture shows a nearby laptop advertising the same SSID and relaying traffic. What type of attack is most likely?

Accepted Answer

Rogue access point or evil twin attack, because a fake wireless network impersonates a legitimate one.. The attack described is an evil twin (a type of rogue access point) because the attacker sets up a laptop broadcasting the same SSID as the hotel's legitimate guest Wi-Fi. When employees connect to this fake network, the attacker can intercept traffic and present a fraudulent certificate for the company portal, triggering certificate warnings. The packet capture confirming the laptop is relaying traffic proves it is acting as a man-in-the-middle, not merely a passive listener.

Answer

Replay attack, because previously captured wireless frames are being resent to the network.

Answer

DNS poisoning, because users are being sent to the wrong website through altered name resolution.

Answer

Denial of service, because users are simply unable to connect reliably.

Question 11

A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?

Accepted Answer

Fileless attack, because the malicious activity is operating primarily in memory and using native tools.. The attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.

Answer

Ransomware, because the user opened an email attachment.

Answer

Worm, because PowerShell is a common scripting tool.

Answer

Rootkit, because the attacker is hiding the process from normal tools.

Question 12

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 13

A web login form returns access after a tester enters `' OR '1'='1'--` into the username field. What type of attack is this?

Accepted Answer

SQL injection. The input `' OR '1'='1'--` is a classic SQL injection payload that manipulates the SQL query logic. By injecting a single quote to break out of the string context, the `OR '1'='1'` condition makes the WHERE clause always true, and the `--` comments out the rest of the query. This bypasses authentication because the database returns a valid row, granting access without a correct password.

Answer

Cross-site scripting

Answer

Session hijacking

Answer

Insecure deserialization

Question 14

An accounts payable clerk receives an email that continues a real vendor conversation from last week. The sender domain is only one character different from the vendor's real address. The message says the invoice is overdue and asks the clerk to update the payment account before the end of the day. What is the best next action?

Accepted Answer

Verify the request using a known phone number or portal from previous records before taking action.. The email exhibits classic signs of a business email compromise (BEC) attack: a spoofed sender domain (typosquatting) and urgent payment redirection. The best next action is to verify the request out-of-band using a trusted phone number or portal from previous records, as this bypasses any compromised email channels and confirms the legitimacy of the request before any financial loss occurs.

Answer

Reply to the email asking for confirmation of the new bank details.

Answer

Forward the email to the vendor's entire contact list to warn them immediately.

Answer

Open the attached invoice to check whether the payment information matches past records.

Question 15

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

Accepted Answer

Trojan. The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Answer

Worm

Answer

Rootkit

Answer

Ransomware