SY0-701 Timed Practice Test 3 — 10 Questions

Question 1

A user receives an SMS from 'IT Service Desk' saying their MFA enrollment expires today and includes a shortened link. Five minutes later, the user gets a phone call from the same number asking them to read back the code shown in the authenticator app so the ticket can be closed. Which two attack channels are used in this campaign? Select two.

10 minute time limit — choose an answer to begin.

Accepted Answer

Smishing is used because the first lure arrives by text message.. The initial attack vector is an SMS message containing a shortened link, which is the definition of smishing (SMS phishing). The attacker uses this to create urgency and lure the victim into engaging with the MFA enrollment scam.

Answer

Email phishing is used because the attacker is requesting a login action.

Answer

Baiting is used because the attacker offers a free reward or device.

Answer

Tailgating is used because the attacker follows someone into a restricted area.

Question 2

Match each incident response action to its primary purpose during a suspected endpoint compromise.

Accepted Answer

Isolation: Preventing the spread of the incident to other systems.. Incident response actions are sequenced to contain, preserve, analyze, remove, and learn from the incident. Isolating prevents spread; volatile data capture is time-sensitive; imaging preserves evidence; log analysis reveals details; eradication cleans the system; lessons learned improve processes.

Answer

Isolation: Removing malicious files from the system.

Answer

Volatile Data Capture: Creating a forensic copy of the hard drive.

Question 3

A SIEM correlates the following: 17 failed logons against the same VPN account from one IP in 9 minutes, a successful login from that IP, creation of a new API token in the SaaS tenant, and a large export job started two minutes later. Which two interpretations are best supported? Select two.

Accepted Answer

The attacker is likely performing a brute-force password attack against a single account.. A is correct because 17 failed logons against a single VPN account from one IP in 9 minutes is a classic brute-force pattern—repeated authentication attempts targeting one username. The subsequent successful login, API token creation, and data export indicate the attacker gained access and then established persistence (via the token) to exfiltrate data, confirming the account was compromised.

Answer

The pattern is most consistent with password spraying across many accounts.

Answer

The events primarily indicate a volumetric denial-of-service attack.

Answer

Token creation proves the account password was never exposed.

Question 4

Management wants to ensure a file server backed up every night can actually be restored within a 4-hour recovery time objective after an incident. Which two actions best improve recovery confidence? Select two.

Accepted Answer

Perform scheduled restore tests to an isolated environment.. Performing scheduled restore tests to an isolated environment validates that the backup data is both readable and usable without risking corruption of the production environment. This directly confirms the ability to meet the 4-hour RTO by measuring actual restore times and identifying any issues with the backup process or media before a real incident occurs.

Answer

Increase retention to keep backups for two years without changing restore testing.

Answer

Move the backup repository onto the same always-mounted file share as production data.

Answer

Reduce the number of user permissions on the file server without changing backup design.

Question 5

Match each principle to the workplace scenario.

Accepted Answer

Least privilege: A user is granted only the permissions required for their job duties.. Least privilege restricts access to necessary functions; separation of duties prevents fraud; defense in depth layers security; need to know limits data access; accountability ties actions to individuals; fail safe maintains security during failures.

Answer

Separation of duties: A user is granted only the permissions required for their job duties.

Answer

Defense in depth: A security system that automatically fails open to allow egress.

Question 6

Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process?

Exhibit:
Payroll application roles:
- HR-Editor: can update employee records
- Payroll-Approver: can release payment batches
- Audit-Reader: can view reports only

Current assignment:
User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end."
Management wants to reduce the chance of one person creating and approving a fraudulent payment.

Accepted Answer

Split duties so record updates and payment approval require separate roles or separate accounts.. It enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.

Answer

Keep both roles assigned but require a manager to review the batch after payment completes.

Answer

Remove the audit role and let payroll staff self-review their own work to save time.

Answer

Use a single shared payroll account so the workflow never pauses for approvals.

Question 7

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

Accepted Answer

Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.. It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Answer

Open SSH directly to each switch on a public IP address and restrict access by source IP only.

Answer

Allow HTTPS management to each switch over the internet because the channel is encrypted.

Answer

Use Telnet inside the office and route home users through a split-tunnel VPN.

Question 8

During a workstation review, analysts find a process injecting into explorer.exe and reading keyboard and clipboard events. They also see repeated outbound HTTPS beacons to a domain registered two days ago. The host is not renaming files or displaying a ransom note. Which two findings are most consistent with spyware? Select two.

Accepted Answer

A process injects into explorer.exe and monitors keyboard and clipboard activity.. Process injection into a trusted system process like explorer.exe, combined with monitoring keyboard and clipboard events, is a classic spyware technique. Spyware aims to covertly capture sensitive user input (keystrokes and clipboard data) for exfiltration, without causing immediate system damage or displaying a ransom note.

Answer

User files are renamed with a new extension and a ransom note appears.

Answer

CPU usage spikes only during a scheduled operating system update.

Answer

The browser certificate store was refreshed after applying a patch.

Question 9

A security analyst at a financial firm detects an unusual spike in outbound network traffic from a database server that normally only communicates with internal web servers. The traffic is directed to numerous external IP addresses in various countries. According to established incident response procedures, what should be the analyst's immediate next step?

Accepted Answer

Disconnect the server from the network at the switch level.. Disconnecting the server at the switch level (e.g., shutting down the switch port or placing it in a quarantine VLAN) is the immediate containment step per incident response procedures. This stops the outbound data exfiltration without risking data loss or corruption that could occur from a hard power-off, and it preserves volatile memory evidence for forensic analysis.

Answer

Run a comprehensive antivirus scan on the server.

Answer

Notify the Chief Information Security Officer (CISO) of the incident.

Answer

Power off the server to prevent further damage.

Question 10

A SIEM alert shows a payroll administrator account signed in at 02:10 from a country the employee has never visited. The employee says they are on vacation at home and did not travel. What should the analyst do first?

Accepted Answer

Verify the login context with the user or manager and review recent authentication history.. The first step in incident response is to verify the alert's validity and gather context before taking action. The analyst should review the SIEM logs for authentication details (e.g., source IP, geolocation, timestamp) and confirm with the user or manager whether the login was expected. This aligns with the NIST SP 800-61 incident response process, which emphasizes triage and validation before containment.

Answer

Immediately disable the account and wait for the employee to return.

Answer

Close the alert as a false positive because the user is on vacation.

Answer

Reimage the user’s workstation before checking any logs.