SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remove all backup jobs until the scan is cleared.

  Why it's wrong here

  Removing backup jobs temporarily would not alter the SMB protocol behavior or the share's access control list, so the reported signing and anonymous-access findings would remain untouched. Worse, halting backups directly undermines the availability and recoverability of the payroll data, increasing the risk of permanent data loss if a separate incident occurs during the remediation window. This action is both ineffective and operationally harmful.

• ✗

  Disable the file server and rebuild it from scratch immediately.

  Why it's wrong here

  A full immediate rebuild is disproportionately disruptive for a configuration-level finding, as it forces downtime for all users and requires approving a change that could have been avoided with a targeted SMB policy adjustment. Rebuilding the server from scratch also does not guarantee the vulnerability is eliminated unless the same insecure SMB settings, such as disabled signing and anonymous shares, are explicitly corrected in the new build. The best practice is to apply the principle of least change: remediate the specific misconfiguration instead of replacing the entire system.

• ✓

  Enable SMB signing and remove anonymous access to the share.

  Why this is correct

  This is the best targeted remediation because it directly addresses both weaknesses identified by the scan. SMB signing helps protect integrity for SMB traffic, and removing anonymous read access prevents unauthorized users from viewing sensitive payroll data. Together, these changes reduce exposure without taking the entire server offline. In vulnerability management, the best choice is often a precise configuration fix that closes the finding while preserving business continuity and avoiding more disruptive action than necessary.

• ✗

  Increase the directory quota so the share cannot overflow.

  Why it's wrong here

  Increasing the directory quota only alters the maximum amount of data the share can store, which has no effect on how SMB authenticates sessions or whether anonymous users are permitted to read files. It might even be counterproductive because expanding the quota could encourage storing more sensitive payroll data, while the actual vulnerability is the anonymous read access that exposes files regardless of the share size. This misinterprets the scan finding as a capacity issue rather than a security configuration issue.