SY0-701 practice questions 311–320

1. Question 311 · 607 in bank

   Which of the following definitions best describes the concept of log correlation?

   • ACombining relevant logs from multiple sources into one location
   • BSearching and processing data to identify patterns of malicious activity
   • CMaking a record of the events that occur in the system
   • DAnalyzing the log files of the system components

   Show answer

   Answer: B

   Explanation

   Log correlation involves analyzing log data from multiple sources to identify patterns, trends, or events that may indicate malicious activity or security incidents. By correlating logs from different devices or systems (e.g., firewalls, servers, intrusion detection systems), security analysts can detect complex threats that might be missed when looking at logs in isolation. This helps to identify attacks that involve multiple steps or components, such as a coordinated intrusion attempt, or to detect abnormal behavior patterns that are indicative of a security breach

   Source: Adapted from community discussion — Fourgehan

   Next question

2. Question 312 · 607 in bank

   An enterprise security team is researching a new security architecture to better protect the company’s networks and applications against the latest cyberthreats. The company has a fully remote workforce. The solution should be highly redundant and enable users to connect to a VPN with an integrated, software-based firewall. Which of the following solutions meets these requirements?

   • AIPS
   • BSIEM
   • CSASE
   • DCASB

   Show answer

   Answer: C

   Explanation

   C. SASE (Secure Access Service Edge) Explanation: SASE is a cloud-based security architecture that integrates networking and security services, making it ideal for enterprises with a fully remote workforce. It combines VPN, software-defined networking (SD-WAN), firewall-as-a-service (FWaaS), zero-trust access, and cloud security into a single, scalable solution. Key benefits that align with the requirements: ✔ Highly redundant – SASE operates in the cloud with multiple points of presence (PoPs), ensuring availability. ✔ Integrated VPN – Secure remote access is a core feature of SASE, often replacing traditional VPNs with Zero Trust Network Access (ZTNA). ✔ Software-based firewall – SASE includes Firewall-as-a-Service (FWaaS), which integrates security policies without requiring on-premises hardware. ✔ Protection against latest cyberthreats – Uses secure web gateways (SWG), cloud access security brokers (CASB), and data loss prevention (DLP) to enforce security policies across all users and devices.

   Source: Adapted from community discussion — test_arrow

   Next question

3. Question 313 · 607 in bank

   Which of the following is the best way to validate the integrity and availability of a disaster recovery site?

   • ALead a simulated failover.
   • BConduct a tabletop exercise.
   • CPeriodically test the generators.
   • DDevelop requirements for database encryption.

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Lead a simulated failover. Explanation: A simulated failover is the best way to validate the integrity and availability of a disaster recovery (DR) site. This involves performing a controlled test where the operations of the primary site are intentionally interrupted (e.g., simulating a failure), and the DR site is activated to take over the workload. This ensures that the DR site is capable of handling operations as expected, providing both availability (ensuring services can continue in the event of a failure) and integrity (confirming the site has the correct, intact data and configurations).

   Source: Adapted from community discussion — jbmac

   Next question

4. Question 314 · 607 in bank

   Which of the following allows an exploit to go undetected by the operating system?

   • AFirmware vulnerabilities
   • BSide loading
   • CMemory injection
   • DEncrypted payloads

   Show answer

   Answer: C

   Explanation

   The correct answer is: C. Memory injection Explanation: Memory injection involves injecting malicious code or data into the memory of a running process or the operating system itself. This type of exploit allows the attacker to bypass traditional detection methods, as the malicious code is executed directly in memory and does not necessarily touch the file system. Since it is executed in memory, it can evade detection by antivirus software or other file-based security measures, allowing the exploit to go undetected by the operating system.

   Source: Adapted from community discussion — jbmac

   Next question

5. Question 315 · 607 in bank

   A malicious insider from the marketing team alters records and transfers company funds to a personal account. Which of the following methods would be the best way to secure company records in the future?

   • APermission restrictions
   • BHashing
   • CInput validation
   • DAccess control list

   Show answer

   Answer: A

   Explanation

   Permission restrictions are a security mechanism that limits what actions users or groups can perform on data or systems. By implementing strict permission restrictions, the company can ensure that only authorized personnel have access to sensitive records and financial systems, minimizing the risk of insider threats

   Source: Adapted from community discussion — Fourgehan

   Next question

6. Question 316 · 607 in bank

   An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best achieve the objective?

   • ARed teaming
   • BPenetration testing
   • CIndependent audit
   • DVulnerability assessment

   Show answer

   Answer: C

   Explanation

   An independent audit is conducted by a third-party organization or qualified external auditors to evaluate and verify that the organization’s controls are properly designed and operating effectively. It provides assurance to stakeholders (e.g., clients, regulators, or internal management) about the organization's adherence to standards, policies, or regulations

   Source: Adapted from community discussion — Fourgehan

   Next question

7. Question 317 · 607 in bank

   A systems administrator successfully configures VPN access to a cloud environment. Which of the following capabilities should the administrator use to best facilitate remote administration?

   • AA jump host in the shared services security zone
   • BAn SSH server within the corporate LAN
   • CA reverse proxy on the firewall
   • DAn MDM solution with conditional access

   Show answer

   Answer: A

   Explanation

   A jump host (or bastion host) is a highly secured server located in a controlled security zone (e.g., the shared services security zone) designed to facilitate secure remote access to a cloud or internal environment. Administrators connect to the jump host first, and from there, they can securely access other systems within the environment. This setup provides an additional layer of security, such as monitoring and access controls, for remote administration

   Source: Adapted from community discussion — Fourgehan

   Next question

8. Question 318 · 607 in bank

   Which of the following best describes the concept of information being stored outside of its country of origin while still being subject to the laws and requirements of the country of origin?

   • AData sovereignty
   • BGeolocation
   • CIntellectual property
   • DGeographic restrictions

   Show answer

   Answer: A

   Explanation

   Data sovereignty refers to the concept that information stored in a different country is still subject to the laws and regulations of its country of origin. This is particularly relevant in contexts like cloud computing, where data might be stored in servers located in different jurisdictions, yet the legal obligations of the originating country (e.g., GDPR in Europe) still apply

   Source: Adapted from community discussion — Fourgehan

   Next question

9. Question 319 · 607 in bank

   Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

   • AClient
   • BThird-party vendor
   • CCloud provider
   • DDBA

   Show answer

   Answer: A

   Explanation

   Client: In the shared responsibility model, the client, or cloud customer, is responsible for securing their data and applications running on the cloud infrastructure. This includes configuring security settings, implementing access controls, and managing user permissions for their resources. However, the specific responsibility for securing the company's database in an Infrastructure as a Service (IaaS) model depends on the division of responsibilities outlined in the model. Given the options provided and the context of the shared responsibility model for a cloud environment, the most appropriate role responsible for securing the company's database in an IaaS model would be Client. The client is typically responsible for securing their data and applications, including databases, within the cloud infrastructure. However, the DBA would also play a significant role in implementing database security measures within the IaaS environment, working in collaboration with the client's security team.

   Source: Adapted from community discussion — metzen227

   Next question

10. Question 320 · 607 in bank

    An audit reveals that cardholder database logs are exposing account numbers inappropriately. Which of the following mechanisms would help limit the impact of this error?

    • ASegmentation
    • BHashing
    • CJournaling
    • DMasking

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 311. 607 questions available.