SY0-701 practice questions 211–220

1. Question 211 · 607 in bank

   Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

   • ARisk tolerance
   • BRisk transfer
   • CRisk register
   • DRisk analysis

   Show answer

   Answer: C

   Explanation

   C. Risk register A risk register is a tool commonly used in risk management that records details of all identified risks, including descriptions, responsible parties, risk categories, likelihood and impact, mitigation measures, and thresholds for action. It serves as a central repository for all information about risks, making it easier to manage and track them.

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

2. Question 212 · 607 in bank

   During an annual review of the system design, an engineer identified a few issues with the currently released design. Which of the following should be performed next according to best practices?

   • ARisk management process
   • BProduct design process
   • CDesign review process
   • DChange control process

   Show answer

   Answer: D

   Explanation

   According to best practices, after identifying issues with the currently released design during an annual review, the next step should be: D. Change control process: The change control process ensures that any modifications to the design are systematically evaluated, approved, and documented. This helps in maintaining the integrity of the system and ensures that changes are implemented in a controlled and coordinated manner.

   Source: Adapted from community discussion — RoRoRoYourBoat

   Next question

3. Question 213 · 607 in bank

   Which of the following is best to use when determining the severity of a vulnerability?

   • ACVE
   • BOSINT
   • CSOAR
   • DCVSS

   Show answer

   Answer: D

   Next question

4. Question 214 · 607 in bank

   An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following: PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327 Which of the following best describes how the attacker gained access to the hardened PC?

   • AThe attacker created fileless malware that was hosted by the banking platform.
   • BThe attacker performed a pass-the-hash attack using a shared support account.
   • CThe attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
   • DThe attacker socially engineered the accountant into performing bad transfers.

   Show answer

   Answer: B

   Explanation

   Mimikatz is an open-source tool that allows users to view and extract credentials stored on a Windows system. It can extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. Answer (B)

   Source: Adapted from community discussion — Muhammad_Umair

   Next question

5. Question 215 · 607 in bank

   Which of the following is the best resource to consult for information on the most common application exploitation methods?

   • AOWASP
   • BSTIX
   • COVAL
   • DThreat intelligence feed
   • ECommon Vulnerabilities and Exposures

   Show answer

   Answer: A

   Explanation

   OWASP (Open Web Application Security Project). OWASP provides extensive resources, guidelines, and tools related to web application security, including the OWASP Top 10, which lists the most critical security risks to web applications.

   Source: Adapted from community discussion — FrozenCarrot

   Next question

6. Question 216 · 607 in bank

   A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:

   

   Which of the following attack techniques was most likely used?

   • ADetermining the organization's ISP-assigned address space
   • BBypassing the organization's DNS sinkholing
   • CFootprinting the internal network
   • DAttempting to achieve initial access to the DNS server
   • EExfiltrating data from fshare.int.complia.org

   Show answer

   Answer: C

   Explanation

   C. Footprinting the internal network Explanation: The AXFR request is typically used by attackers to obtain a complete list of DNS records, which can reveal internal IP addresses and hostnames, thereby providing a detailed map of the internal network. This information can then be used for further attacks, such as identifying critical systems or planning network intrusions.

   Source: Adapted from community discussion — cri88

   Next question

7. Question 217 · 607 in bank

   Select 2

   A security analyst at an organization observed several user logins from outside the organization's network. The analyst determined that these logins were not performed by individuals within the organization. Which of the following recommendations would reduce the likelihood of future attacks? (Choose two.)

   • ADisciplinary actions for users
   • BConditional access policies
   • CMore regular account audits
   • DImplementation of additional authentication factors
   • EEnforcement of content filtering policies
   • FA review of user account permissions

   Show answer

   Answer: BD

   Explanation

   B. Conditional access policies D. Implementation of additional authentication factors Explanation: B. Conditional access policies: Implementing conditional access policies can restrict access based on certain conditions, such as geographical location, device compliance, or risk level. This would help prevent unauthorized logins from outside the organization’s network. D. Implementation of additional authentication factors: Adding multi-factor authentication (MFA) provides an extra layer of security, making it much harder for unauthorized individuals to gain access even if they have the correct credentials.

   Source: Adapted from community discussion — cri88

   Next question

8. Question 218 · 607 in bank

   Select 2

   A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place. Which of the following would be best to set up? (Choose two.)

   • ANIDS
   • BHoneypot
   • CCertificate revocation list
   • DHIPS
   • EWAF
   • FSIEM

   Show answer

   Answer: AE

   Explanation

   E. WAF (Web Application Firewall) A. NIDS (Network Intrusion Detection System) Explanation: E. WAF (Web Application Firewall): A WAF specifically protects web applications by filtering and monitoring HTTP/HTTPS traffic between a web application and the internet. It can help detect and block attacks targeting the web application, such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. A. NIDS (Network Intrusion Detection System): NIDS monitors network traffic for suspicious activity and potential threats. Deploying NIDS can help detect malicious activity at the network level, including attempts to exploit vulnerabilities over port 443. These two options would significantly enhance the security of the web application by providing both application-level protection (WAF) and network-level monitoring (NIDS).

   Source: Adapted from community discussion — cri88

   Next question

9. Question 219 · 607 in bank

   A systems administrator would like to create a point-in-time backup of a virtual machine. Which of the following should the administrator use?

   • AReplication
   • BSimulation
   • CSnapshot
   • DContainerization

   Show answer

   Answer: C

   Next question

10. Question 220 · 607 in bank

    A security administrator notices numerous unused, non-compliant desktops are connected to the network. Which of the following actions would the administrator most likely recommend to the management team?

    • AMonitoring
    • BDecommissioning
    • CPatching
    • DIsolating

    Show answer

    Answer: B

    Explanation

    Decommissioning unused and non-compliant desktops will reduce security risks by removing potential points of vulnerability from the network. This action helps to ensure that only compliant and necessary devices are connected, maintaining the integrity and security of the network.

    Source: Adapted from community discussion — qacollin

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 211. 607 questions available.