SY0-701 Threats, Vulnerabilities, and Mitigations — Timed 10 Questions

Question 1

A security analyst reviews authentication logs and notices multiple failed login attempts using various usernames from a single IP address over several hours. Eventually, a successful login occurs using a username that had many failed attempts. The organization requires multi-factor authentication (MFA). Which type of attack is most likely indicated by this pattern?

10 minute time limit — choose an answer to begin.

Accepted Answer

Brute-force attack. The pattern of multiple failed login attempts using various usernames from a single IP address, followed by a successful login for a username that had many failed attempts, is characteristic of a brute-force attack. In a brute-force attack, the attacker systematically tries many passwords against a known or guessed username until success. The fact that the successful username had many prior failed attempts indicates the attacker attempted multiple passwords for that account. Credential stuffing typically uses stolen username/password pairs, usually one attempt per pair, and would not show many failed attempts for the same username. Password spraying uses one common password across many usernames, also not matching this pattern. The MFA requirement does not change the attack type; it only means the attacker would need to also possess the second factor.

Answer

Credential stuffing

Answer

Password spraying

Answer

Shoulder surfing

Question 2

A security analyst receives an alert from the email security gateway about a message sent to an employee. The email has an attachment named 'Invoice_Q4_2024.exe'. The employee claims they did not open the attachment, and the email appears to come from a known vendor's domain but the sender address has a slight typo. Which type of attack is most likely being attempted?

Accepted Answer

Spear phishing. The email is targeted at a specific employee and impersonates a known vendor to exploit a trusted business relationship. The use of a domain typo (domain spoofing) is a common spear phishing technique to trick the recipient into executing malware. While the lure ('Invoice_Q4_2024.exe') is not highly personalized, the impersonation of a known vendor constitutes targeting a specific organization, making spear phishing more likely than broad, unsolicited phishing.

Answer

Phishing

Answer

Smishing

Answer

Vishing

Question 3

A support portal lets users upload files and name them manually. During review, a tester submits a filename containing path traversal sequences, and logs later show the application trying to access files outside the intended upload folder. Which two changes best address the flaw? Select two.

Accepted Answer

Validate and canonicalize the filename on the server, then allow only approved name patterns.. Server-side canonicalization with an allowlist resolves traversal sequences such as `../` and rejects unsafe filenames. Assigning a server-generated random filename (e.g., a UUID) to the stored file and mapping the original name separately prevents user-supplied names from being used in the filesystem path, directly eliminating path traversal. Storing uploads outside the web root or denying execution would not stop traversal.

Answer

Increase the maximum upload size so the application can handle more files.

Answer

Add browser-side JavaScript validation to reject suspicious filenames.

Answer

Hide detailed error messages from end users only.

Question 4

A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Accepted Answer

Isolate the affected server from the network through EDR or switch controls.. Both A and B are correct immediate containment steps. Isolating the affected server via EDR or switch controls stops the malware from spreading through SMB connections and prevents further encryption of network-accessible files. Disabling or resetting the compromised service account and revoking its active sessions removes the attacker's authentication capability and halts any ongoing malicious activity using that account. Recovery actions such as restoring from backup or deleting files should not be performed until the threat is contained, and dismissing the incident as a false positive is inappropriate.

Answer

Restore the server from backup before taking any containment action.

Answer

Delete the suspicious files from the server to stop the encryption process.

Answer

Inform users that the incident is likely a false positive and continue monitoring.

Question 5

A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?

Accepted Answer

A critical flaw on an internet-facing VPN appliance with known exploit code. The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.

Answer

A low-severity finding on an internal test server with no network access

Answer

A cosmetic configuration warning on a printer management interface

Answer

A medium-severity issue on a device that is powered off and not in service

Question 6

A scan returns five findings. Which two should be remediated first based on real-world risk? Select two. A) Internet-facing SSO gateway, CVSS 8.8, public exploit code, and auth bypass impact. B) Internal print server, CVSS 9.8, no known exploit, isolated VLAN, no sensitive data. C) File server with regulated customer records, CVSS 6.5, active exploitation in the wild, reachable from VPN. D) Lab hypervisor, CVSS 7.5, no exploit, scheduled retirement next month, used only by testers. E) Dev wiki, CVSS 5.0, no exploit, no sensitive data.

Accepted Answer

Internet-facing SSO gateway with public exploit code and authentication-bypass impact.. The SSO gateway is internet-facing, has a CVSS 8.8 with public exploit code, and an authentication-bypass impact. This combination means an attacker can gain unauthorized access to all federated applications without credentials, representing a critical risk that must be remediated immediately. The file server contains regulated customer records, is actively exploited in the wild, and is reachable from the VPN, so the combination of sensitive data and active exploitation makes it a top priority despite a lower CVSS score. The other findings have compensating controls (e.g., isolated VLAN, no exploit, no sensitive data) that reduce real-world risk.

Answer

Internal print server on an isolated VLAN with no known exploit and no sensitive data.

Answer

Lab hypervisor that is scheduled for retirement next month and used only by testers.

Answer

Development wiki with low severity, no exploit, and no sensitive data.

Question 7

Threat intelligence reports a campaign that rotates domains daily and repacks the malware for each delivery. Analysts also observe the same TLS certificate fingerprint, the same mutex name, and the same JA3 client fingerprint across multiple samples. Which three indicators are most useful to prioritize for hunting or blocking? Select three.

Accepted Answer

The TLS certificate fingerprint reused by multiple samples.. The TLS certificate fingerprint is a reliable indicator because it is derived from the certificate's public key and metadata, which remain static even when the malware's domain or IP address changes. Similarly, the mutex name is a consistent artifact created by the malware on endpoints, and the JA3 client fingerprint is a static representation of the TLS client hello characteristics. Since these three indicators remain constant across samples despite domain rotation and repacking, they are the most useful for hunting or blocking. In contrast, the current domain name and public IP address are dynamic and change frequently, making them less reliable for persistent detection.

Answer

The current domain name used by the command-and-control server.

Answer

The public IP address currently hosting the malware sample.

Question 8

An employee receives a text message from "IT Help" saying their account will be disabled unless they tap a link and enter a one-time code. Five minutes later, someone calls claiming to be from IT and asks the employee to read back the same code. Which two social engineering delivery methods are used? Select two.

Accepted Answer

Smishing. Smishing is correct because the initial contact is via SMS text message, which is the defining characteristic of smishing (SMS phishing). The attacker uses a text message to deliver a phishing lure, prompting the employee to tap a link and enter a one-time code. Vishing is correct because the subsequent voice call asking the employee to read back the code is a voice phishing (vishing) attempt.

Answer

Baiting

Answer

Whaling

Answer

Tailgating

Question 9

A small business web server still allows remote administration from the internet on port 3389, and the administrator password has never been changed from the vendor default. Which two issues should the security team prioritize first? Select two.

Accepted Answer

An exposed remote administration service. Port 3389 is used by Remote Desktop Protocol (RDP), which is a remote administration service. Exposing RDP directly to the internet is a critical vulnerability because it allows attackers to perform brute-force or credential-stuffing attacks against the service. This is a high-priority issue because it provides an attack vector that can lead to full system compromise. Additionally, the administrator password has never been changed from the vendor default, meaning default credentials are still in use. Default credentials are a critical vulnerability because attackers can easily guess or look up known default passwords, allowing them to gain unauthorized access without any brute-force effort. Together, exposed RDP and default credentials present a severe, immediate risk that must be addressed first.

Answer

A missing screen-lock timeout on nearby laptops

Answer

A lack of encrypted email attachments

Answer

An outdated printer driver on the finance network

Question 10

An accounts payable clerk receives an email that appears to continue an existing thread with a shipping vendor. The sender name, signature block, and invoice number all match a real open order, and the message asks the clerk to use a "new payment portal" and confirm bank details before 3 PM to avoid delayed shipment. The email contains no attachments and only one URL. Which attack type is most likely?

Accepted Answer

Spear phishing, because the email uses targeted business context and time pressure.. The email is a targeted phishing attempt using specific business context (existing thread, real invoice number, vendor impersonation) to trick the victim into clicking a link and entering bank details. This is classic spear phishing. Pretexting is a broader social engineering technique that involves creating a false scenario, but the attack vector here is the email with a URL, which makes it a phishing attack. The presence of a link and urgency are hallmarks of spear phishing, not pretexting alone.

Answer

Pretexting, because the attacker is impersonating a trusted vendor to create a believable reason for the request.

Answer

Smishing, because the attacker is using a text message to reach the victim.

Answer

Baiting, because the attacker is offering a portal link that appears helpful to the recipient.