SY0-701 Practice Exam: 865 Questions with Explanations

1. A security team wants to detect data theft by planting a fake spreadsheet containing fabricated customer records on a file share. Any access to this file should trigger an alert. Which deception technique is being used?

1. A honeynet, because it emulates an entire network of decoys
2. A honeyfile, because it is a decoy file designed to attract unauthorized access
3. A honeypot, because it is a full decoy operating system
4. A firewall, because it filters access to the file share

2. A server runs file integrity monitoring software that alerts administrators whenever a critical operating system file is modified outside of a maintenance window. Which control type is this monitoring?

1. Preventive, because it blocks changes to system files
2. Detective, because it identifies unexpected changes to monitored files
3. Corrective, because it restores the changed files automatically
4. Directive, because it documents the file baseline policy

3. What is the primary purpose of a Trusted Platform Module (TPM) in a laptop?

1. Hardware-based key storage, sealed storage, and measured boot for platform integrity
2. Acting as a network firewall for the laptop
3. Issuing TLS certificates to public websites
4. Storing the user's browser passwords

4. In a properly designed CA hierarchy, which statement is true?

1. The root CA issues end-entity certificates directly every day
2. The root CA is kept offline and delegates issuance to intermediate CAs
3. The registration authority issues certificates directly to users
4. A single-tier CA with the root kept online is best practice

5. A compromised web server is cleaned and rebuilt, but the attacker returns two weeks later through an undocumented administrator account created during the original breach. The attacker MOST likely left a:

1. Worm
2. Logic bomb
3. Fileless malware implant that survives reboots
4. Backdoor

6. An accounts-payable clerk receives an email that appears to come from a known vendor. It references an actual invoice number from last month, uses the vendor's real logo and signature block, and asks the clerk to remit payment today to updated bank details. Which attack is this?

1. Whaling
2. Spear phishing
3. Typosquatting
4. Smishing

7. Which of the following is the MOST effective defense against SQL injection?

1. Parameterized queries (prepared statements)
2. Client-side input length limits
3. Hiding database error messages
4. Blocking the word SELECT at the firewall

8. A security engineer discovers the company's DNS servers answer recursive queries from any internet host. Which action BEST reduces the risk that these servers are abused in amplification attacks?

1. Deploying DNSSEC on the authoritative zones
2. Increasing the TTL on all DNS records
3. Blocking all inbound port 53 traffic at the perimeter
4. Restricting recursion to internal clients and enabling response rate limiting

9. A web application concatenates user input directly into database queries without checking it. Which vulnerability class does this represent at its root?

1. Broken authentication
2. Security misconfiguration
3. Improper input validation
4. Use of vulnerable components

10. After deploying an emergency patch for a critical vulnerability, what is the BEST way to validate that the remediation worked?

1. Close the ticket as soon as the patch package finishes deploying
2. Wait for the next quarterly vulnerability scan
3. Ask the system owner whether the system seems to run faster
4. Run a targeted follow-up vulnerability scan against the host

11. An organization wants a single enforcement point that can apply data loss prevention and access policies to all of its employees' sanctioned and unsanctioned SaaS applications. Which technology BEST meets this need?

1. A cloud access security broker (CASB)
2. A hardware security module (HSM)
3. A network intrusion prevention system
4. A traditional perimeter firewall

12. A security assessment flags a fleet of smart cameras as a high risk. The cameras ship with a documented default admin password that cannot be changed. Which risk does this present?

1. The cameras transmit video over unencrypted HTTP, exposing footage to eavesdropping on the network
2. The cameras' firmware is no longer supported by the vendor, so known vulnerabilities cannot be patched
3. The cameras are assigned publicly routable IP addresses, making them directly reachable from the internet
4. The devices use well-documented default credentials that cannot be changed

13. Two manufacturing plants need their industrial control networks to exchange monitoring data continuously. The security policy requires the traffic to be encrypted, but plant devices cannot run VPN client software. Which solution meets these requirements?

1. Require each device to establish its own TLS VPN session
2. Open the plant firewalls to allow unencrypted control traffic
3. Deploy a site-to-site IPsec VPN between the plants' gateway firewalls
4. Email the monitoring data as encrypted attachments

14. A web farm's application servers are CPU-saturated, and profiling shows TLS encryption is consuming most of the cycles. Which load balancer feature BEST relieves the backend servers?

1. Add more backend servers to the farm so the TLS processing load is spread across additional systems
2. Move TLS termination to the database servers, which have spare CPU capacity during business hours
3. Disable TLS encryption entirely so no server in the farm spends cycles on cryptography
4. SSL/TLS offloading at the load balancer, terminating client encryption there and using plain HTTP to backends over the trusted internal network

15. A payment processor must store cardholder data so that a database breach reveals nothing usable, yet authorized systems can still retrieve original values. The architect chooses tokenization over encryption primarily because...

1. Tokens have no mathematical relationship to the original values, reducing the scope of systems that handle sensitive data
2. Tokenization is always faster than any encryption algorithm
3. Tokens can be cracked more easily to aid forensic analysis
4. Tokenization removes the need for access controls

16. An administrator regularly restores a random backup set to an isolated system to confirm it works. This practice is best described as...

1. Backup encryption
2. Backup compression
3. Backup deduplication
4. Verification through test restores

17. A team shares one 'admin' login for a network appliance. What is the primary security problem?

1. Password complexity requirements cannot be enforced reliably on a shared credential
2. The account cannot be protected with multi-factor authentication
3. Actions cannot be attributed to an individual, destroying accountability
4. Password rotation policies become difficult to enforce without disrupting the whole team

18. At 3:00 AM the SIEM generates a critical alert for data exfiltration from a database server. What should the analyst do FIRST?

1. Shut down the database server immediately
2. Call law enforcement to report a breach
3. Validate the alert against raw logs to rule out a false positive
4. Delete the alert and retune the rule

19. A vulnerability scanner runs nightly and generates 500 SIEM alerts each run, drowning out real alerts. What should the analyst do?

1. Delete the scanner
2. Turn off the SIEM
3. Ignore all future alerts
4. Tune the SIEM correlation rule to whitelist or suppress the scanner's known-benign traffic

20. The chain of custody is primarily used to:

1. Prioritize security alerts based on their severity and impact
2. Identify the attack vector used during the initial compromise
3. Speed up system recovery after the incident is contained
4. Document who handled evidence and when, preserving its admissibility

21. Which metric is MOST useful to an IR team assessing how long an attacker operated undetected?

1. Dwell time (time from initial compromise to detection)
2. The number of office printers
3. Total disk capacity
4. Average office temperature

22. A call center uses shared workstations where agents rotate every few hours. Agents sometimes walk away without logging out. Which session control best protects the unattended sessions?

1. Disable screen locks so agents can work faster
2. Set an automatic screen lock after 5 minutes of inactivity
3. Tape each agent's password to the monitor for convenience
4. Share one user account among all agents

23. How should WSUS approvals be structured to balance timely patching with the risk of a faulty update?

1. Auto-approve all updates for every system immediately
2. Disable automatic updates entirely
3. Use update rings: pilot group first, then production
4. Manual updates only, performed one machine at a time

24. An organization uses geofencing on its MDM platform. What capability does this provide?

1. Tracking device battery levels across regions
2. Encrypting email attachments automatically
3. Blocking all third-party applications
4. Enforcing policies based on the device's physical location

25. The primary purpose of the PCI-DSS is to:

1. Mandate a specific encryption algorithm for all industries
2. Protect cardholder data and reduce payment card fraud
3. Require all companies to undergo annual financial audits
4. Standardize password lengths across all operating systems

26. A compliance officer discovers that required access reviews have not been performed for six months. What is the BEST next step?

1. Hide the finding to avoid trouble
2. Delete the access logs
3. Wait until the external audit to mention it
4. Document the gap, report it to management, and schedule the overdue reviews

27. A company decides that the cost of fixing a low-rated vulnerability exceeds its benefit. What is the correct risk response?

1. Removing the vulnerability from the risk register since it will not be fixed
2. Buying insurance
3. Formal documented acceptance by the risk owner, acknowledging residual risk
4. Accepting the risk informally without documentation, since the rating is low

28. How often should an organization perform risk assessments?

1. On a regular schedule and after significant changes to systems, threats, or business processes
2. Once at company founding
3. Only after a breach
4. Every ten years

29. A bank wants to test how its SOC analysts detect and respond to a stealthy, multi-week intrusion, giving the testers only the limited information a real external attacker would have. Which engagement best fits?

1. A quarterly unauthenticated vulnerability scan of the public-facing IP range, performed to satisfy audit requirements
2. A compliance audit reviewing the SOC's policies and procedures against a security framework
3. Unknown-environment (black-box) penetration test, possibly as a red team exercise
4. A known-environment review of the SIEM detection rules to find logic errors

30. A CISO has budget for only two of five proposed controls. How should she choose?

1. Fund the controls that reduce the most risk per dollar spent
2. Fund the two most expensive controls
3. Fund the controls the vendors recommend most
4. Split the budget equally among all five