SY0-701 practice questions 331–340

1. Question 331 · 607 in bank

   A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?

   • AMSA
   • BSLA
   • CBPA
   • DSOW

   Show answer

   Answer: D

   Explanation

   The company should provide the client with a Statement of Work (SOW). A Statement of Work is a document that outlines the details of a project, including the scope, deliverables, timeline, and cost. It is used to ensure that both the client and the service provider have a clear understanding of the project's requirements and expectations. - MSA (Master Service Agreement) An overarching contract that defines the terms and conditions under which services will be provided. - SLA (Service Level Agreement) A contract that defines the level of service expected from the service provider. - BPA (Business Partnership Agreement) An agreement that defines the relationship and responsibilities between business partners. Therefore, the correct answer is: D. SOW

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

2. Question 332 · 607 in bank

   Which of the following objectives is best achieved by a tabletop exercise?

   • AFamiliarizing participants with the incident response process
   • BDeciding red and blue team rules of engagement
   • CQuickly determining the impact of an actual security breach
   • DConducting multiple security investigations in parallel

   Show answer

   Answer: A

   Next question

3. Question 333 · 607 in bank

   The private key for a website was stolen, and a new certificate has been issued. Which of the following needs to be updated next?

   • ASCEP
   • BCRL
   • COCSP
   • DCSR

   Show answer

   Answer: B

   Explanation

   When a private key for a website is stolen, the certificate associated with that key is considered compromised. The next important step is to update the Certificate Revocation List (CRL) to include the old certificate so that clients and browsers know that it should no longer be trusted.

   Source: Adapted from community discussion — 4617f0b

   Next question

4. Question 334 · 607 in bank

   Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior within an organization?

   • AAUP
   • BSLA
   • CEULA
   • DMOA

   Show answer

   Answer: A

   Explanation

   AUP is the most appropriate document for establishing and communicating expectations associated with integrity and ethical behavior within an organization.

   Source: Adapted from community discussion — Mitch717

   Next question

5. Question 335 · 607 in bank

   Which of the following explains how to determine the global regulations that data is subject to regardless of the country where the data is stored?

   • AGeographic dispersion
   • BData sovereignty
   • CGeographic restrictions
   • DData segmentation

   Show answer

   Answer: B

   Next question

6. Question 336 · 607 in bank

   Select 2

   An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, which could allow attackers to access customer payment information. Which of the following mitigation strategies would be most effective for preventing an attack on the organization's web servers? (Choose two.)

   • ARegularly updating server software and patches
   • BImplementing strong password policies
   • CEncrypting sensitive data at rest and in transit
   • DUtilizing a web-application firewall
   • EPerforming regular vulnerability scans
   • FRemoving payment information from the servers

   Show answer

   Answer: AD

   Explanation

   A. Regularly updating server software and patches (Keeping server software and any associated components up to date is essential in preventing known vulnerabilities from being exploited. This includes updating the web server, libraries, frameworks, and other software that could be vulnerable to attack, including JavaScript injection vulnerabilities) D. Utilizing a web-application firewall (A WAF is specifically designed to filter, monitor, and block malicious traffic directed at a web application. It can detect and block a wide range of attacks, including JavaScript injection, cross-site scripting (XSS), and other common web-based threats)

   Source: Adapted from community discussion — Fourgehan

   Next question

7. Question 337 · 607 in bank

   Which of the following tools is best for logging and monitoring in a cloud environment?

   • AIPS
   • BFIM
   • CNAC
   • DSIEM

   Show answer

   Answer: D

   Explanation

   A SIEM system is designed to collect, analyze, and correlate security-related data from various sources, such as logs, network traffic, and user activities, in real-time. This is critical for monitoring and detecting security incidents in a cloud environment

   Source: Adapted from community discussion — Fourgehan

   Next question

8. Question 338 · 607 in bank

   During a SQL update of a database, a temporary field that was created was replaced by an attacker in order to allow access to the system. Which of the following best describes this type of vulnerability?

   • ARace condition
   • BMemory injection
   • CMalicious update
   • DSide loading

   Show answer

   Answer: C

   Explanation

   A malicious update refers to an attacker modifying a database or system during an update operation to introduce malicious changes.

   Source: Adapted from community discussion — chasingsummer

   Next question

9. Question 339 · 607 in bank

   A group of developers has a shared backup account to access the source code repository. Which of the following is best way to secure the backup account if there is an SSO failure?

   • ARAS
   • BEAP
   • CSAML
   • DPAM

   Show answer

   Answer: D

   Explanation

   D. PAM (Privileged Access Management) Explanation: PAM (Privileged Access Management) is a security solution designed to manage and control access to privileged accounts, such as shared accounts for administrative purposes or critical systems like a source code repository.

   Source: Adapted from community discussion — Segunmx

   Next question

10. Question 340 · 607 in bank

    Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?

    • APreservation
    • BE-discovery
    • CAcquisition
    • DContainment

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 331. 607 questions available.