SY0-701 practice questions 341–350

1. Question 341 · 607 in bank

   A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way to identify where the system data was exfiltrated from and what location the attacker sent the data to?

   • AAnalyze firewall and network logs for large amounts of outbound traffic to external IP addresses or domains.
   • BAnalyze IPS and IDS logs to find the IP addresses used by the attacker for reconnaissance scans.
   • CAnalyze endpoint and application logs to see whether file-sharing programs were running on the company systems.
   • DAnalyze external vulnerability scans and automated reports to identify the systems the attacker could have exploited a remote code vulnerability.

   Show answer

   Answer: A

   Explanation

   To efficiently identify the source of exfiltrated data and the attacker's destination: Firewall and network logs are the best tools for analyzing outbound traffic. They can reveal unusual data transfers, such as large amounts of traffic sent to external IPs or domains that do not match typical business activity. This method is highly efficient for pinpointing the source system and the exfiltration destination.

   Source: Adapted from community discussion — AriGarcia

   Next question

2. Question 342 · 607 in bank

   A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?

   • ASecure cookies
   • BVersion control
   • CInput validation
   • DCode signing

   Show answer

   Answer: C

   Explanation

   A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability? A. Secure cookies B. Version control C. Input validation D. Code signing

   Source: Adapted from community discussion — SHADTECH123

   Next question

3. Question 343 · 607 in bank

   Which of the following describes the procedures a penetration tester must follow while conducting a test?

   • ARules of engagement
   • BRules of acceptance
   • CRules of understanding
   • DRules of execution

   Show answer

   Answer: A

   Next question

4. Question 344 · 607 in bank

   A security analyst wants to better understand the behavior of users and devices in order to gain visibility into potential malicious activities. The analyst needs a control to detect when actions deviate from a common baseline. Which of the following should the analyst use?

   • AIntrusion prevention system
   • BSandbox
   • CEndpoint detection and response
   • DAntivirus

   Show answer

   Answer: C

   Next question

5. Question 345 · 607 in bank

   A legal department must maintain a backup from all devices that have been shredded and recycled by a third party. Which of the following best describes this requirement?

   • AData retention
   • BCertification
   • CSanitization
   • DDestruction

   Show answer

   Answer: A

   Explanation

   Data retention refers to the practice of preserving and storing data for a specified period to meet legal, regulatory, or business requirements. In this case, the legal department needs to maintain backups of data from devices that have been shredded and recycled, ensuring compliance with legal or organizational policies

   Source: Adapted from community discussion — Fourgehan

   Next question

6. Question 346 · 607 in bank

   Which of the following can be used to compromise a system that is running an RTOS?

   • ACross-site scripting
   • BMemory injection
   • CReplay attack
   • DRansomware

   Show answer

   Answer: B

   Explanation

   Memory injection is a technique that can be used to compromise a system running a real-time operating system (RTOS). By injecting malicious code into the memory of a running process, an attacker can gain unauthorized access to the system and its resources.

   Source: Adapted from community discussion — ProudFather

   Next question

7. Question 347 · 607 in bank

   Which of the following threat actors would most likely deface the website of a high-profile music group?

   • AUnskilled attacker
   • BOrganized crime
   • CNation-state
   • DInsider threat

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Unskilled attacker Explanation: Unskilled attackers (often referred to as script kiddies) are individuals with limited technical expertise who use pre-made tools or scripts to carry out attacks. Defacing a high-profile website, such as that of a music group, is a common activity for such attackers because it provides them with a sense of notoriety and is relatively easy to accomplish using publicly available tools. Organized crime (B) typically focuses on financial gain through activities like fraud, ransomware, or data theft, rather than defacing websites. Nation-state (C) actors are usually involved in espionage, sabotage, or cyber warfare targeting critical infrastructure or government systems, not high-profile music groups. Insider threat (D) refers to individuals within an organization who misuse their access, which is unlikely to be the case in this scenario.

   Source: Adapted from community discussion — Anyio

   Next question

8. Question 348 · 607 in bank

   A security architect wants to prevent employees from receiving malicious attachments by email. Which of the following functions should the chosen solution do?

   • AApply IP address reputation data.
   • BTap and monitor the email feed.
   • CScan email traffic inline.
   • DCheck SPF records.

   Show answer

   Answer: C

   Explanation

   C. Scan email traffic inline. Inline scanning is the most effective method to prevent malicious attachments from reaching employees' inboxes. By scanning emails in real-time, as they are being delivered, the security solution can identify and block malicious attachments before they reach the user's device. SPF records are used to verify the sender's identity, but they do not prevent malicious attachments

   Source: Adapted from community discussion — Cocopqr

   Next question

9. Question 349 · 607 in bank

   Which of the following activities is the first stage in the incident response process?

   • ADetection
   • BDeclaration
   • CContainment
   • DVerification

   Show answer

   Answer: A

   Explanation

   A. Detection Explanation: The first stage in the incident response process is Detection. This is the phase where an organization identifies that a security incident has occurred or is currently happening.

   Source: Adapted from community discussion — Segunmx

   Next question

10. Question 350 · 607 in bank

    Which of the following is the main consideration when a legacy system that is a critical part of a company's infrastructure cannot be replaced?

    • AResource provisioning
    • BCost
    • CSingle point of failure
    • DComplexity

    Show answer

    Answer: C

    Explanation

    When a legacy system is a critical part of a company's infrastructure and cannot be replaced, the main consideration is addressing the risk of it being a single point of failure (SPOF

    Source: Adapted from community discussion — Fourgehan

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 341. 607 questions available.