SY0-701 Threats, Vulnerabilities, and Mitigations Practice Questions

Explanation: The pattern of multiple failed login attempts using various usernames from a single IP address, followed by a successful login for a username that had many failed attempts, is characteristic of a brute-force attack. In a brute-force attack, the attacker systematically tries many passwords against a known or guessed username until success. The fact that the successful username had many prior failed attempts indicates the attacker attempted multiple passwords for that account. Credential stuffing typically uses stolen username/password pairs, usually one attempt per pair, and would not show many failed attempts for the same username. Password spraying uses one common password across many usernames, also not matching this pattern. The MFA requirement does not change the attack type; it only means the attacker would need to also possess the second factor.

Explanation: The email is targeted at a specific employee and impersonates a known vendor to exploit a trusted business relationship. The use of a domain typo (domain spoofing) is a common spear phishing technique to trick the recipient into executing malware. While the lure ('Invoice_Q4_2024.exe') is not highly personalized, the impersonation of a known vendor constitutes targeting a specific organization, making spear phishing more likely than broad, unsolicited phishing.

Explanation: Server-side canonicalization with an allowlist resolves traversal sequences such as `../` and rejects unsafe filenames. Assigning a server-generated random filename (e.g., a UUID) to the stored file and mapping the original name separately prevents user-supplied names from being used in the filesystem path, directly eliminating path traversal. Storing uploads outside the web root or denying execution would not stop traversal.

Explanation: Both A and B are correct immediate containment steps. Isolating the affected server via EDR or switch controls stops the malware from spreading through SMB connections and prevents further encryption of network-accessible files. Disabling or resetting the compromised service account and revoking its active sessions removes the attacker's authentication capability and halts any ongoing malicious activity using that account. Recovery actions such as restoring from backup or deleting files should not be performed until the threat is contained, and dismissing the incident as a false positive is inappropriate.

Explanation: The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.