SY0-701 Practice Questions

Question 1

After installing a free PDF-to-Word utility from an unofficial website, a user's laptop starts sending data to an unknown server and the security agent is disabled. Which malware type best fits?

Accepted Answer

Trojan. A Trojan is malware disguised as legitimate software, such as a free PDF-to-Word utility, that performs malicious actions without the user's knowledge. In this scenario, the Trojan exfiltrates data to an unknown server and disables the security agent, which are classic Trojan behaviors—unlike self-replicating worms or passive spyware. The user's intentional download from an unofficial website is the typical infection vector for Trojans.

Answer

Worm

Answer

Spyware

Answer

Rootkit

Question 2

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

Accepted Answer

Investigate the user's recent activity and check for signs of process hollowing or DLL injection.. The EDR alert indicates a legitimate process (Updater.exe) modifying a critical persistence registry key (Run). Even with a known good hash, the process could be compromised via process hollowing or DLL injection, where malicious code runs under the guise of a trusted executable. Investigating user activity and checking for these attack techniques is the appropriate next step to confirm whether the behavior is benign or indicative of a threat.

Answer

Disable the software updater immediately to prevent further registry modifications.

Answer

Create an exception rule in the EDR to suppress future alerts for this process.

Answer

Isolate the workstation from the network and reimage the system immediately.

Question 3

A vendor-supported legacy application can run only with a deprecated browser plug-in on two engineering workstations for 30 days while a replacement is tested. Management wants to allow the exception without weakening the security program. What is the best action?

Accepted Answer

Document a time-bound exception, record the risk, apply compensating controls, and schedule review before expiration.. It follows the formal exception process required by a mature security program: documenting the exception with a specific time bound (30 days), recording the associated risk, applying compensating controls (such as network segmentation or host-based firewall rules to isolate the deprecated plug-in), and scheduling a review before expiration ensures the risk is managed and the exception does not become permanent. This aligns with the SY0-701 objective of implementing risk management processes, where time-bound exceptions with compensating controls are the standard way to handle legacy dependencies without weakening the overall security posture.

Answer

Approve the exception informally by email and revisit it if problems appear.

Answer

Disable all monitoring on the workstations so the application will function normally.

Answer

Publish the exception as a permanent guideline so other teams can follow it.

Question 4

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 5

A vulnerability scan finds two issues: a critical deserialization flaw on a non-production lab server behind a VPN, and a high-severity privilege escalation flaw on the production jump server that administrators use to reach the rest of the environment. Which should be remediated first?

Accepted Answer

The jump server flaw, because it affects a production administrative access point. The jump server flaw must be remediated first because it is a high-severity privilege escalation vulnerability on a production system that administrators use as a gateway to the entire environment. Compromise of this jump server would give an attacker administrative access to all connected production systems, making the business impact far greater than the critical deserialization flaw on an isolated non-production lab server. In risk-based prioritization, severity alone is insufficient; the asset's role, exposure, and potential blast radius must be considered.

Answer

The lab server flaw, because critical severity always comes first

Answer

Neither issue, because VPN access reduces the need for urgent remediation

Answer

The lab server flaw, because non-production systems are always easier to patch later

Question 6

A report generator accepts a user-supplied report name and then passes it into a shell command to convert a file. During testing, a malicious value causes the server to run an unexpected system command. Which two changes best mitigate this issue while keeping the feature usable? Select two.

Accepted Answer

Replace shell command concatenation with a parameterized API or safe library call.. Replacing shell command concatenation with a parameterized API or safe library call prevents command injection by ensuring user input is treated as data, not executable code. This is the most effective mitigation because it eliminates the injection vector entirely, rather than trying to sanitize or validate input that may still be passed to a shell interpreter.

Answer

HTML-encode the report name before inserting it into the shell command.

Answer

Switch the feature from POST to GET so the values are easier to inspect.

Answer

Hide the server error messages so attackers cannot see the failure details.

Question 7

An IDS raises an alert for a possible SQL injection attack against an internal reporting portal. The web server logs show the source IP belongs to the company's vulnerability scanner, and the requests match the scanner's normal test pattern. What is the most appropriate analyst action?

Accepted Answer

Mark the alert as a likely false positive after verifying the scanner schedule and source IP.. The IDS alert matches the known behavior of the company's vulnerability scanner, which is a legitimate and scheduled security tool. Verifying the scanner schedule and source IP confirms the traffic is authorized, making the alert a false positive. Analysts should correlate IDS alerts with asset inventories and change management records to avoid unnecessary incident response actions.

Answer

Treat the alert as a confirmed breach and begin password resets for all portal users.

Answer

Block the scanner IP permanently to prevent future alerts from the same host.

Answer

Quarantine the reporting server because IDS alerts always indicate active exploitation.

Question 8

A SOC analyst receives an alert from the VPN appliance and identity platform. In the last 10 minutes, a user account had 14 failed VPN logons from one country, then one successful login from a different country. The user calls the help desk and says they have not used their account today. What should the analyst do first?

Accepted Answer

Disable the user account and revoke active sessions or tokens while escalating the event as a suspected account compromise.. The combination of multiple failed logins from one country followed by a successful login from a different country, combined with the user's denial of activity, is a classic indicator of account compromise (e.g., credential stuffing or token theft). Disabling the account and revoking active sessions/tokens immediately stops the attacker's access, preventing further lateral movement or data exfiltration, while escalation ensures proper incident response. This aligns with the CompTIA incident response process: identification, containment, eradication, and recovery.

Answer

Block the foreign IP address at the firewall and wait for more alerts before acting.

Answer

Reset the user password and close the alert because the new password will stop the attack.

Answer

Reimage the user’s laptop immediately to remove any possible malware before taking other steps.

Question 9

An employee receives a text message saying their payroll account is locked and asks them to tap a link and enter a one-time passcode. What type of attack is this?

Accepted Answer

Smishing. Smishing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) that lures the recipient into tapping a link and entering a one-time passcode. Unlike generic phishing which uses email, smishing specifically exploits SMS trust and the limited screen real estate of mobile devices to bypass security awareness.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 10

After a user installs a free PDF converter from an unofficial website, the laptop starts making periodic outbound connections to an unknown server, the browser homepage changes, and a new program launches at logon. What is the most likely malware type?

Accepted Answer

Trojan. The user downloaded and installed a program that appears legitimate (a PDF converter) but performs malicious actions: making outbound connections, changing browser settings, and adding a startup program. This is the classic behavior of a Trojan horse, which disguises itself as useful software to trick users into installing it, then executes hidden malicious functions. Unlike worms, Trojans do not self-replicate, and unlike ransomware or rootkits, the described symptoms focus on unauthorized remote access and persistence rather than file encryption or deep OS concealment.

Answer

Worm

Answer

Rootkit

Answer

Ransomware

Question 11

Before contracting with a cloud-based payroll provider, the security team requests a security questionnaire, proof of controls, and an independent audit report. What activity is this?

Accepted Answer

Third-party due diligence, because the team is evaluating vendor risk before onboarding.. The security team's request for a security questionnaire, proof of controls, and an independent audit report before contracting with a cloud-based payroll provider is a classic example of third-party due diligence. This process evaluates the vendor's security posture, compliance, and risk level before onboarding, ensuring that sensitive payroll data is protected. It is a proactive risk management activity, not a reactive test or training exercise.

Answer

Business continuity testing, because the team is checking recovery procedures.

Answer

Security awareness training, because the vendor is being taught safe behavior.

Answer

Data classification, because the team is labeling the payroll data type.

Question 12

A security analyst in the SOC observes a sudden spike in failed authentication attempts from a single external IP address targeting multiple user accounts over the last 30 minutes. After confirming the logs are accurate, which of the following actions should the analyst take FIRST according to standard incident response procedures?

Accepted Answer

Escalate the incident to the incident response team.. According to standard incident response procedures (NIST SP 800-61), the first step after confirming an anomaly is to escalate the incident to the incident response team. This ensures that a coordinated, documented, and legally defensible response is initiated, rather than taking unilateral action that could destroy evidence or disrupt legitimate services. The SOC analyst's role is to detect and validate, not to independently execute containment measures without authorization.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Capture a memory dump of all affected servers.

Question 13

Based on the exhibit, what is the best-supported conclusion for the SOC analyst?

Accepted Answer

The host is likely using DNS tunneling or DNS-based command and control.. The exhibit shows a high volume of DNS queries to multiple unusual domains with long subdomain strings, which is a classic indicator of DNS tunneling or DNS-based command and control (C2). DNS tunneling encodes data in DNS queries and responses, allowing attackers to exfiltrate data or communicate with a C2 server while bypassing traditional network controls. The SOC analyst should recognize this pattern as anomalous DNS activity rather than normal web browsing.

Answer

The traffic is normal web browsing to a content delivery network.

Answer

The issue is most likely ARP spoofing on the local switch port.

Answer

The evidence most strongly indicates a password spraying campaign.

Question 14

A web form stores a user's comment and later displays it to other users. A tester submits and the script runs in the browser. What vulnerability is this?

Accepted Answer

Cross-site scripting. The tester's input is executed in the browser, which is the classic symptom of a stored (persistent) cross-site scripting (XSS) vulnerability. The web form fails to sanitize or encode user-supplied data before storing it and later rendering it in other users' browsers, allowing arbitrary JavaScript to run in the security context of the application's origin.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 15

A desktop engineering team asks for the document that specifies the exact minimum encryption setting, screen-lock timer, and password length for company laptops. Which type of document should they follow?

Accepted Answer

Standard, because it defines mandatory uniform requirements for a specific control baseline.. A standard defines mandatory, uniform technical requirements for a specific control baseline, such as exact encryption settings (e.g., AES-256), screen-lock timer (e.g., 15 minutes), and password length (e.g., 14 characters). Unlike a policy, which states high-level intent, a standard provides the precise, enforceable configuration that the desktop engineering team must implement on company laptops.

Answer

Policy, because it states the organization's general intent and high-level direction.

Answer

Procedure, because it gives the organization-wide security purpose statement.

Answer

Guideline, because it provides optional suggestions that every laptop must obey.

Security+ SY0-701 practice test

Three ways to study

Study SY0-701 by domain

Study SY0-701 by topic

General Security Concepts practice questions

Threats, Vulnerabilities, and Mitigations practice questions

Security Architecture practice questions

Security Operations practice questions

Security Program Management and Oversight practice questions

Security+ social engineering questions

Security+ cryptography practice questions

Security+ IAM questions

Security+ risk management questions

Security+ incident response questions

Security+ malware questions

Security+ vulnerability management questions

Top SY0-701 questions

Security+ SY0-701 practice questions

How to use these SY0-701 questions

Quick answer