SY0-701 Threats, Vulnerabilities, and Mitigations — Timed 30 Questions

Question 1

A security analyst reviews authentication logs and notices multiple failed login attempts using various usernames from a single IP address over several hours. Eventually, a successful login occurs using a username that had many failed attempts. The organization requires multi-factor authentication (MFA). Which type of attack is most likely indicated by this pattern?

30 minute time limit — choose an answer to begin.

Accepted Answer

Brute-force attack. The pattern of multiple failed login attempts using various usernames from a single IP address, followed by a successful login for a username that had many failed attempts, is characteristic of a brute-force attack. In a brute-force attack, the attacker systematically tries many passwords against a known or guessed username until success. The fact that the successful username had many prior failed attempts indicates the attacker attempted multiple passwords for that account. Credential stuffing typically uses stolen username/password pairs, usually one attempt per pair, and would not show many failed attempts for the same username. Password spraying uses one common password across many usernames, also not matching this pattern. The MFA requirement does not change the attack type; it only means the attacker would need to also possess the second factor.

Answer

Credential stuffing

Answer

Password spraying

Answer

Shoulder surfing

Question 2

A security analyst receives an alert from the email security gateway about a message sent to an employee. The email has an attachment named 'Invoice_Q4_2024.exe'. The employee claims they did not open the attachment, and the email appears to come from a known vendor's domain but the sender address has a slight typo. Which type of attack is most likely being attempted?

Accepted Answer

Spear phishing. The email is targeted at a specific employee and impersonates a known vendor to exploit a trusted business relationship. The use of a domain typo (domain spoofing) is a common spear phishing technique to trick the recipient into executing malware. While the lure ('Invoice_Q4_2024.exe') is not highly personalized, the impersonation of a known vendor constitutes targeting a specific organization, making spear phishing more likely than broad, unsolicited phishing.

Answer

Phishing

Answer

Smishing

Answer

Vishing

Question 3

A support portal lets users upload files and name them manually. During review, a tester submits a filename containing path traversal sequences, and logs later show the application trying to access files outside the intended upload folder. Which two changes best address the flaw? Select two.

Accepted Answer

Validate and canonicalize the filename on the server, then allow only approved name patterns.. Server-side canonicalization with an allowlist resolves traversal sequences such as `../` and rejects unsafe filenames. Assigning a server-generated random filename (e.g., a UUID) to the stored file and mapping the original name separately prevents user-supplied names from being used in the filesystem path, directly eliminating path traversal. Storing uploads outside the web root or denying execution would not stop traversal.

Answer

Increase the maximum upload size so the application can handle more files.

Answer

Add browser-side JavaScript validation to reject suspicious filenames.

Answer

Hide detailed error messages from end users only.

Question 4

A user's laptop suddenly shows encrypted .docx files, a ransom note, and the EDR console reports mass file renames and shadow copy deletion. The device is still online and connected to the corporate VPN. What is the best immediate action?

Accepted Answer

Quarantine the endpoint from the network through EDR or physical isolation.. The immediate priority in a confirmed ransomware incident is to contain the threat by isolating the compromised host from the network. The EDR console showing mass file renames and shadow copy deletion indicates active encryption and lateral movement risk. Quarantining via EDR or physically disconnecting the network cable stops the ransomware from encrypting additional shares or communicating with its C2 server, preserving evidence and preventing further damage.

Answer

Reboot the laptop into safe mode and attempt manual malware removal.

Answer

Restore the affected files from backup before taking any other action.

Answer

Tell the user to change their password and continue working from the same laptop.

Question 5

A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Accepted Answer

Isolate the affected server from the network through EDR or switch controls.. Both A and B are correct immediate containment steps. Isolating the affected server via EDR or switch controls stops the malware from spreading through SMB connections and prevents further encryption of network-accessible files. Disabling or resetting the compromised service account and revoking its active sessions removes the attacker's authentication capability and halts any ongoing malicious activity using that account. Recovery actions such as restoring from backup or deleting files should not be performed until the threat is contained, and dismissing the incident as a false positive is inappropriate.

Answer

Restore the server from backup before taking any containment action.

Answer

Delete the suspicious files from the server to stop the encryption process.

Answer

Inform users that the incident is likely a false positive and continue monitoring.

Question 6

An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.

Accepted Answer

Isolate the workstation from the network using EDR or NAC containment.. Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.

Answer

Immediately wipe and reimage the workstation before collecting anything else.

Answer

Power the workstation off immediately to stop the malware process.

Answer

Disable every user account in the finance department to prevent further compromise.

Question 7

A scan returns five findings. Which two should be remediated first based on real-world risk? Select two. A) Internet-facing SSO gateway, CVSS 8.8, public exploit code, and auth bypass impact. B) Internal print server, CVSS 9.8, no known exploit, isolated VLAN, no sensitive data. C) File server with regulated customer records, CVSS 6.5, active exploitation in the wild, reachable from VPN. D) Lab hypervisor, CVSS 7.5, no exploit, scheduled retirement next month, used only by testers. E) Dev wiki, CVSS 5.0, no exploit, no sensitive data.

Accepted Answer

Internet-facing SSO gateway with public exploit code and authentication-bypass impact.. The SSO gateway is internet-facing, has a CVSS 8.8 with public exploit code, and an authentication-bypass impact. This combination means an attacker can gain unauthorized access to all federated applications without credentials, representing a critical risk that must be remediated immediately. The file server contains regulated customer records, is actively exploited in the wild, and is reachable from the VPN, so the combination of sensitive data and active exploitation makes it a top priority despite a lower CVSS score. The other findings have compensating controls (e.g., isolated VLAN, no exploit, no sensitive data) that reduce real-world risk.

Answer

Internal print server on an isolated VLAN with no known exploit and no sensitive data.

Answer

Lab hypervisor that is scheduled for retirement next month and used only by testers.

Answer

Development wiki with low severity, no exploit, and no sensitive data.

Question 8

Threat intelligence reports a campaign that rotates domains daily and repacks the malware for each delivery. Analysts also observe the same TLS certificate fingerprint, the same mutex name, and the same JA3 client fingerprint across multiple samples. Which three indicators are most useful to prioritize for hunting or blocking? Select three.

Accepted Answer

The TLS certificate fingerprint reused by multiple samples.. The TLS certificate fingerprint is a reliable indicator because it is derived from the certificate's public key and metadata, which remain static even when the malware's domain or IP address changes. Similarly, the mutex name is a consistent artifact created by the malware on endpoints, and the JA3 client fingerprint is a static representation of the TLS client hello characteristics. Since these three indicators remain constant across samples despite domain rotation and repacking, they are the most useful for hunting or blocking. In contrast, the current domain name and public IP address are dynamic and change frequently, making them less reliable for persistent detection.

Answer

The current domain name used by the command-and-control server.

Answer

The public IP address currently hosting the malware sample.

Question 9

A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?

Accepted Answer

Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.. The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.

Answer

SQL injection, because the attacker is changing a field to access a different page.

Answer

Cross-site request forgery, because the browser is sending a forged request to the application.

Answer

Cross-site scripting, because the modified object exposes an internal admin page.

Question 10

An employee receives a text message from "IT Help" saying their account will be disabled unless they tap a link and enter a one-time code. Five minutes later, someone calls claiming to be from IT and asks the employee to read back the same code. Which two social engineering delivery methods are used? Select two.

Accepted Answer

Smishing. Smishing is correct because the initial contact is via SMS text message, which is the defining characteristic of smishing (SMS phishing). The attacker uses a text message to deliver a phishing lure, prompting the employee to tap a link and enter a one-time code. Vishing is correct because the subsequent voice call asking the employee to read back the code is a voice phishing (vishing) attempt.

Answer

Baiting

Answer

Whaling

Answer

Tailgating

Question 11

A small business web server still allows remote administration from the internet on port 3389, and the administrator password has never been changed from the vendor default. Which two issues should the security team prioritize first? Select two.

Accepted Answer

An exposed remote administration service. Port 3389 is used by Remote Desktop Protocol (RDP), which is a remote administration service. Exposing RDP directly to the internet is a critical vulnerability because it allows attackers to perform brute-force or credential-stuffing attacks against the service. This is a high-priority issue because it provides an attack vector that can lead to full system compromise. Additionally, the administrator password has never been changed from the vendor default, meaning default credentials are still in use. Default credentials are a critical vulnerability because attackers can easily guess or look up known default passwords, allowing them to gain unauthorized access without any brute-force effort. Together, exposed RDP and default credentials present a severe, immediate risk that must be addressed first.

Answer

A missing screen-lock timeout on nearby laptops

Answer

A lack of encrypted email attachments

Answer

An outdated printer driver on the finance network

Question 12

An accounts payable clerk receives an email that appears to continue an existing thread with a shipping vendor. The sender name, signature block, and invoice number all match a real open order, and the message asks the clerk to use a "new payment portal" and confirm bank details before 3 PM to avoid delayed shipment. The email contains no attachments and only one URL. Which attack type is most likely?

Accepted Answer

Spear phishing, because the email uses targeted business context and time pressure.. The email is a targeted phishing attempt using specific business context (existing thread, real invoice number, vendor impersonation) to trick the victim into clicking a link and entering bank details. This is classic spear phishing. Pretexting is a broader social engineering technique that involves creating a false scenario, but the attack vector here is the email with a URL, which makes it a phishing attack. The presence of a link and urgency are hallmarks of spear phishing, not pretexting alone.

Answer

Pretexting, because the attacker is impersonating a trusted vendor to create a believable reason for the request.

Answer

Smishing, because the attacker is using a text message to reach the victim.

Answer

Baiting, because the attacker is offering a portal link that appears helpful to the recipient.

Question 13

Based on the exhibit, which social engineering attack is most likely?

Accepted Answer

Vishing. The exhibit shows a voicemail message instructing the recipient to call a specific phone number to verify account activity. This is a classic vishing (voice phishing) attack, where the attacker uses a phone call or voicemail to trick the victim into providing sensitive information or calling a fraudulent number. Unlike phishing, which uses email or text, vishing relies on voice communication channels.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 14

Based on the exhibit, what type of malware is most likely present?

Accepted Answer

Logic bomb. The exhibit shows a script that checks for a specific employee name and, if the condition is met, deletes critical system files. This is a classic logic bomb: malicious code embedded in a legitimate program that executes when predefined conditions (e.g., a specific user, date, or event) are satisfied. Logic bombs do not self-replicate or continuously spy; they lie dormant until triggered.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 15

A customer portal has a form that submits a money-transfer request with the user’s existing session cookie. Security testing shows that if a user visits a malicious site while logged in, the portal will submit the transfer request without any additional verification. Which control would best reduce this risk?

Accepted Answer

Add a server-validated anti-CSRF token to each state-changing request. The described attack is a Cross-Site Request Forgery (CSRF), where a malicious site forces an authenticated user's browser to submit a state-changing request without the user's consent. Adding a server-validated anti-CSRF token ensures that each request includes a unique, unpredictable value tied to the user's session, which the server verifies before processing. This prevents the malicious site from forging a valid request because it cannot guess or obtain the token.

Answer

Replace the transfer form with a stored procedure

Answer

Enable input length limits on the transfer amount field

Answer

Turn on content security policy to block all script execution

Question 16

A scanner reports a critical vulnerability on an internal Linux server. The administrator confirms the vulnerable package is installed, but the affected feature is only enabled when an optional module is loaded, and that module is currently disabled. The server also requires downtime for patching. What is the best next step?

Accepted Answer

Verify whether the vulnerable function is reachable, then apply a compensating control or schedule remediation. Even though the vulnerable module is disabled, the administrator must first verify whether the vulnerable function is reachable through other means (e.g., via a different service or misconfiguration). If it is reachable, applying a compensating control (like a firewall rule or SELinux policy) can mitigate risk without immediate downtime, allowing patching to be scheduled. If it is unreachable, the vulnerability is not currently exploitable, but remediation should still be scheduled to eliminate the vulnerable package. This aligns with the principle of defense-in-depth and proper risk management.

Answer

Immediately accept the risk and leave the server unchanged

Answer

Mark the finding as a false positive and close the ticket

Answer

Remove the server from production immediately and rebuild it from scratch

Question 17

Several users on the same subnet report that their traffic to the default gateway is intermittently slow and sometimes reaches the wrong device. A packet capture shows ARP replies that map the gateway IP to a different MAC address. What attack is most likely occurring?

Accepted Answer

ARP spoofing, which poisons address resolution on the local network. ARP spoofing (also known as ARP poisoning) is the correct answer because the attacker sends forged ARP replies that associate the default gateway's IP address with the attacker's MAC address. This causes the victims' ARP caches to update with the false mapping, so traffic destined for the gateway is instead sent to the attacker, leading to intermittent connectivity and misrouted packets. The symptoms—slow traffic and reaching the wrong device—are classic indicators of a man-in-the-middle (MITM) attack via ARP cache poisoning. (Switches maintain MAC address tables, not ARP caches.)

Answer

DNS amplification, which overwhelms the target with reflected DNS traffic

Answer

Replay attack, which resends captured authentication data

Answer

Port scanning, which probes hosts for open services and ports

Question 18

During testing of a shopping portal, a POST request to /api/address/update succeeds even when the anti-CSRF token is removed. In a separate test, changing customerId=1842 to customerId=1843 in a GET request returns another user's invoice data. Which two vulnerabilities are present? Select two.

Accepted Answer

Cross-site request forgery is present because the state-changing request works without a valid anti-CSRF token.. The POST request to /api/address/update succeeds without the anti-CSRF token, which means the application does not validate the origin of the request. This allows an attacker to forge a cross-site request that changes the victim's address without their knowledge, a classic CSRF vulnerability. Separately, the GET request with a manipulated customerId returns another user's invoice, indicating the application fails to enforce access control on the object (IDOR/broken object level authorization).

Answer

SQL injection is present because the customerId value changes in the URL.

Answer

Cross-site scripting is present because the invoice data is returned in the browser.

Answer

Insecure deserialization is present because the request uses JSON-like parameters.

Question 19

A branch office reports intermittent failures reaching internal sites. DHCP logs show clients receiving leases from an unknown MAC address, and DNS responses for intranet.example resolve to an address owned by the same device. Which two attacks best match the evidence? Select two.

Accepted Answer

A rogue DHCP server is issuing unauthorized lease information.. The evidence shows two distinct attacks. First, DHCP logs showing clients receiving leases from an unknown MAC address indicate a rogue DHCP server on the network, which issues unauthorized IP configurations and can disrupt connectivity. Second, DNS responses for intranet.example resolving to an address owned by the same device indicate DNS spoofing or poisoning, where an attacker corrupts DNS resolution to redirect users to a malicious or unintended host. Together, these two attacks explain the intermittent failures and the shared ownership of the unauthorized DHCP server and DNS response address.

Answer

A SYN flood is exhausting the DHCP service.

Answer

A port scan is enumerating exposed services on the branch subnet.

Answer

Password spraying is attempting many logins with common passwords.

Question 20

A SOC analyst reviews a suspicious email about an overdue invoice. The display name matches a known supplier, but the envelope sender is from a free webmail domain, and the Reply-To address uses a look-alike domain with one swapped letter. The message also includes a company logo and a PDF attachment. Which two findings are the strongest indicators of a phishing attempt? Select two.

Accepted Answer

The display name matches the supplier, but the envelope sender is from a free webmail provider.. The envelope sender (the actual origin address in the SMTP MAIL FROM command) being from a free webmail domain while the display name matches a known supplier is a classic phishing red flag. Legitimate business invoices are almost never sent from free webmail providers like Gmail or Yahoo, as organizations use their own domains for official correspondence. This mismatch between the visible display name and actual sender address indicates spoofing. Additionally, the Reply-To address using a look-alike domain with one swapped letter is another strong indicator, as attackers often use typosquatted domains to appear legitimate while redirecting replies to an attacker-controlled mailbox.

Answer

The message was transmitted over TLS to the recipient's mail gateway.

Answer

The email contains a PDF invoice attachment with a normal business filename.

Answer

The message includes the supplier's logo and a standard-looking signature block.