SY0-701 practice questions 201–210

1. Question 201 · 607 in bank

   A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?

   • APIN
   • BHardware token
   • CUser ID
   • DSMS

   Show answer

   Answer: A

   Explanation

   A. PIN Here’s why: PIN (Personal Identification Number): When using a smart card, the smart card itself serves as one factor (something you have), and the PIN entered to access the smart card provides the second factor (something you know). This combination of something you have (the smart card) and something you know (the PIN) constitutes MFA. The other options are not directly related to the authentication factor provided by the smart card: -Hardware token: This could be another factor for MFA but is not used in conjunction with a smart card; instead, it’s a standalone factor. -User ID: This is usually a username and not a factor in MFA. -SMS: This can be used as an additional factor in some MFA setups but is not directly related to smart cards. It represents a different method of delivering a second factor, such as a one-time passcode sent via text message.

   Source: Adapted from community discussion — baronvon

   Next question

2. Question 202 · 607 in bank

   A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems. Which of the following solutions should most likely be utilized?

   • ATACACS+
   • BSAML
   • CAn SSO platform
   • DRole-based access control
   • EPAM software

   Show answer

   Answer: E

   Explanation

   E. PAM Software PAM software helps manage and secure privileged accounts and access credentials. It allows admins to grant temporary, controlled access to critical systems without sharing passwords directly. PAM software can track, monitor and log all activities performed by the consultant.

   Source: Adapted from community discussion — a4e15bd

   Next question

3. Question 203 · 607 in bank

   A newly implemented wireless network is designed so that visitors can connect to the wireless network for business activities. The legal department is concerned that visitors might connect to the network and perform illicit activities. Which of me following should the security team implement to address this concern?

   • AConfigure a RADIUS server to manage device authentication.
   • BUse 802.1X on all devices connecting to wireless.
   • CAdd a guest captive portal requiring visitors to accept terms and conditions.
   • DAllow for new devices to be connected via WPS.

   Show answer

   Answer: C

   Explanation

   C Users logging into captive portal and accepting the terms and conditions before gaining access should address the concern raise by legal department.

   Source: Adapted from community discussion — a4e15bd

   Next question

4. Question 204 · 607 in bank

   Which of the following data roles is responsible for identifying risks and appropriate access to data?

   • AOwner
   • BCustodian
   • CSteward
   • DController

   Show answer

   Answer: A

   Explanation

   Owner: The data owner is responsible for identifying risks associated with the data and determining who has appropriate access to it. Owners make decisions about data classification, access controls, and usage policies. Custodian: Data custodians are responsible for the day-to-day maintenance and protection of data based on the rules set by the owner. They implement access controls, backup procedures, and security measures but do not decide who should access the data. The data owner is ultimately accountable for the security and access decisions related to the data. They evaluate risks and establish the appropriate access controls to protect it. While Custodian is an important role in data management, it is not primarily responsible for identifying risks and determining appropriate access to data.

   Source: Adapted from community discussion — 9149f41

   Next question

5. Question 205 · 607 in bank

   Select 2

   Which of the following physical controls can be used to both detect and deter? (Choose two.)

   • ALighting
   • BFencing
   • CSignage
   • DSensor
   • EBollard
   • FLock

   Show answer

   Answer: AD

   Explanation

   Lighting will illuminate the area, detect people attempting to be under the cover of night, and deter them from committing unwanted acts. Furthermore, a sensor will detect movement in an area, and sensors that are visible can ward off any potential bad actors.

   Source: Adapted from community discussion — TrebleSmith

   Next question

6. Question 206 · 607 in bank

   A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information. Which of the following should the bank use to ensure accessibility during peak usage times?

   • ALoad balancer
   • BCloud backups
   • CGeographic dispersal
   • DDisk multipathing

   Show answer

   Answer: A

   Explanation

   A. Load balancer A load balancer is the most appropriate solution to ensure accessibility of a business-critical application during peak usage times. It distributes incoming network traffic across multiple servers, optimizing resource utilization, maximizing throughput, minimizing response time, and avoiding overload on any single server. This is particularly crucial for a multinational bank's customer-facing application during high-traffic periods.

   Source: Adapted from community discussion — pokii1992

   Next question

7. Question 207 · 607 in bank

   The author of a software package is concerned about bad actors repackaging and inserting malware into the software. The software download is hosted on a website, and the author exclusively controls the website's contents. Which of the following techniques would best ensure the software's integrity?

   • AInput validation
   • BCode signing
   • CSecure cookies
   • DFuzzing

   Show answer

   Answer: B

   Explanation

   B. Code Signing Code signing helps ensure the integrity and authenticity of your software package. It prevents bad actors from successfully repackaging your software with malware, as the digital signature would no longer match. Users can verify that the software comes from you and hasn't been tampered with since you signed it, increasing trust and security.

   Source: Adapted from community discussion — pokii1992

   Next question

8. Question 208 · 607 in bank

   A third-party vendor is moving a particular application to the end-of-life stage at the end of the current year. Which of the following is the most critical risk if the company chooses to continue running the application?

   • ALack of security updates
   • BLack of new features
   • CLack of support
   • DLack of source code access

   Show answer

   Answer: A

   Next question

9. Question 209 · 607 in bank

   A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption settings. Which of the following would be best to use to validate this finding?

   • AWireshark
   • Bnetcat
   • CNessus
   • DNmap

   Show answer

   Answer: A

   Next question

10. Question 210 · 607 in bank

    A development team is launching a new public-facing web product. The Chief Information Security Officer has asked that the product be protected from attackers who use malformed or invalid inputs to destabilize the system. Which of the following practices should the development team implement?

    • AFuzzing
    • BContinuous deployment
    • CStatic code analysis
    • DManual peer review

    Show answer

    Answer: A

    Explanation

    Fuzzing, or fuzz testing, is an automated software testing technique that involves inputting random, unexpected, or invalid data into a program to identify vulnerabilities. The goal is to discover bugs, crashes, or security issues by monitoring how the program responds to these inputs. Fuzzing is particularly effective for testing software that processes structured data, such as file formats or network protocols.

    Source: Adapted from community discussion — dhewa

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 201. 607 questions available.