SY0-701 practice questions 111–120

1. Question 111 · 607 in bank

   A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?

   • AEspionage
   • BData exfiltration
   • CNation-state attack
   • DShadow IT

   Show answer

   Answer: D

   Explanation

   The scenario described is: D. Shadow IT Shadow IT refers to the use of technology, systems, or services by employees without the approval or knowledge of the IT department. In this case, the research and development department is bypassing the company’s VPN, potentially using unauthorized methods to access company-related services and systems. This can pose security risks, as these systems may not adhere to the company’s security policies and protocols.

   Source: Adapted from community discussion — nillie

   Next question

2. Question 112 · 607 in bank

   Which of the following is used to add extra complexity before using a one-way data transformation algorithm?

   • AKey stretching
   • BData masking
   • CSteganography
   • DSalting

   Show answer

   Answer: D

   Explanation

   D. Salting Salting involves adding random data to the input of a one-way hash function to ensure that the same input will produce different hash values, thus making it more difficult for attackers to use precomputed hash tables (rainbow tables) to reverse engineer the original input.

   Source: Adapted from community discussion — lauren2wright

   Next question

3. Question 113 · 607 in bank

   A company’s web filter is configured to scan the URL for strings and deny access when matches are found. Which of the following search strings should an analyst employ to prohibit access to non-encrypted websites?

   • Aencryption=off
   • Bhttp://
   • Cwww.*.com
   • D:443

   Show answer

   Answer: B

   Explanation

   Blocking the string "http://" is the best way to prohibit access to non-encrypted websites. Non-encrypted websites use HTTP, while encrypted websites use HTTPS. This ensures only non-encrypted traffic is blocked without affecting encrypted websites. A. encryption=off: Not a consistent identifier for non-encrypted websites. C. www.*.com: Too broad, blocks both encrypted and non-encrypted websites. D. :443: Indicates HTTPS traffic, blocking it would deny access to encrypted websites.

   Source: Adapted from community discussion — SHADTECH123

   Next question

4. Question 114 · 607 in bank

   The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?

   • AShadow IT
   • BInsider threat
   • CData exfiltration
   • DService disruption

   Show answer

   Answer: A

   Explanation

   A. Shadow IT Shadow IT is when an employee uses information technology (IT) systems without the approval of an organization's IT department.

   Source: Adapted from community discussion — Dlove

   Next question

5. Question 115 · 607 in bank

   Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?

   • ATo track the status of patching installations
   • BTo find shadow IT cloud deployments
   • CTo continuously the monitor hardware inventory
   • DTo hunt for active attackers in the network

   Show answer

   Answer: A

   Explanation

   Answer A is correct: Daily vulnerability scans help ensure that all the endpoints are up to date with security patches and identify any vulnerabilities that may have been introduced due to unpatched software. This regular scanning helps in monitoring and verifying the effectiveness of patch management process.

   Source: Adapted from community discussion — a4e15bd

   Next question

6. Question 116 · 607 in bank

   Which of the following is classified as high availability in a cloud environment?

   • AAccess broker
   • BCloud HSM
   • CWAF
   • DLoad balancer

   Show answer

   Answer: D

   Explanation

   D Load balancer distributes incoming network traffic across multiple servers or instances ensuring that no single server becomes overwhelmed and helps maintain the availability of applications and services.

   Source: Adapted from community discussion — a4e15bd

   Next question

7. Question 117 · 607 in bank

   Which of the following security measures is required when using a cloud-based platform for IoT management?

   • AEncrypted connection
   • BFederated identity
   • CFirewall
   • DSingle sign-on

   Show answer

   Answer: A

   Explanation

   A IOT devices often transmit sensitive data over networks and encryption ensures that this data is securely transmitted and protected from interception or tampering.

   Source: Adapted from community discussion — a4e15bd

   Next question

8. Question 118 · 607 in bank

   Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

   • AUnidentified removable devices
   • BDefault network device credentials
   • CSpear phishing emails
   • DImpersonation of business units through typosquatting

   Show answer

   Answer: A

   Explanation

   A definitely describes a threat vector, as in for example using a USB to install malware to gain access to systems, or simply used to copy data.

   Source: Adapted from community discussion — ETQ

   Next question

9. Question 119 · 607 in bank

   Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?

   • AEncryption
   • BHashing
   • CMasking
   • DTokenization

   Show answer

   Answer: C

   Explanation

   Masking involves hiding sensitive information by replacing it with a specific character, such as an asterisk (*). In the case of credit card numbers, masking would typically involve displaying only the last four digits, while the rest of the numbers are replaced with asterisks. This allows for partial visibility of the card number while protecting the sensitive information.

   Source: Adapted from community discussion — ProudFather

   Next question

10. Question 120 · 607 in bank

    The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?

    • AFines
    • BReputational damage
    • CSanctions
    • DContractual implications

    Show answer

    Answer: A

    Explanation

    Fines: Under GDPR, fines can be substantial, reaching up to 4% of a company's global annual turnover. This makes them a very direct and immediate consequence of non-compliance, emphasizing the financial risk associated with it. Reputational damage: While this remains a significant concern, it may not be as immediately quantifiable as fines. Fines can serve as a concrete measure of the financial impact of non-compliance. Sanctions: Sanctions are typically imposed by governments as a result of serious violations of laws or international agreements. They are not directly related to data privacy compliance. Contractual implications: While non-compliance may have contractual implications, especially if there are specific data privacy clauses in contracts with customers or partners, it's not necessarily the most immediate or significant consequence.

    Source: Adapted from community discussion — Glacier88

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 111. 607 questions available.