SY0-701 practice questions 421–430

1. Question 421 · 607 in bank

   A company is implementing a policy to allow employees to use their personal equipment for work. However, the company wants to ensure that only company-approved applications can be installed. Which of the following addresses this concern?

   • AMDM
   • BContainerization
   • CDLP
   • DFIM

   Show answer

   Answer: A

   Explanation

   A. MDM (Mobile Device Management) Explanation: MDM solutions allow organizations to enforce application policies on personal devices (as part of a BYOD policy). With MDM, the company can ensure that only approved applications are installed and used for work purposes. MDM provides application control, policy enforcement, and device monitoring to maintain security while allowing personal devices. Why not the other options? B. Containerization: While it isolates work applications and data from personal ones, it does not inherently restrict which apps can be installed on the device as a whole. C. DLP (Data Loss Prevention): Focuses on preventing unauthorized access or transmission of sensitive data, but it does not control application installations. D. FIM (File Integrity Monitoring): Tracks and monitors changes to files or systems for security purposes but is unrelated to application management.

   Source: Adapted from community discussion — Anyio

   Next question

2. Question 422 · 607 in bank

   An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit. Which of the following types of controls is the analyst implementing?

   • ACompensating
   • BDetective
   • COperational
   • DPhysical

   Show answer

   Answer: A

   Explanation

   A compensating control is a security measure implemented to mitigate risk when the primary control (such as a patch for a zero-day exploit) is not available or cannot be applied immediately.

   Source: Adapted from community discussion — ojones888

   Next question

3. Question 423 · 607 in bank

   A penetration test has demonstrated that domain administrator accounts were vulnerable to pass-the-hash attacks. Which of the following would have been the best strategy to prevent the threat actor from using domain administrator accounts?

   • AAudit each domain administrator account weekly for password compliance.
   • BImplement a privileged access management solution.
   • CCreate IDS policies to monitor domain controller access.
   • DUse Group Policy to enforce password expiration.

   Show answer

   Answer: B

   Explanation

   B. Implement a privileged access management solution. Explanation: A privileged access management (PAM) solution minimizes the risk of pass-the-hash attacks by enforcing stricter controls on privileged accounts, such as domain administrators. PAM solutions include features like just-in-time access, session monitoring, credential vaulting, and isolating privileged credentials, ensuring that attackers cannot easily exploit administrative credentials. Why not the other options? A. Audit each domain administrator account weekly for password compliance: While auditing is good practice, it does not directly prevent pass-the-hash attacks because the attack uses hashed credentials, not passwords themselves. C. Create IDS policies to monitor domain controller access: Monitoring is helpful for detection, but it does not prevent the attack. Pass-the-hash attacks exploit credential reuse, which monitoring alone cannot stop.

   Source: Adapted from community discussion — Anyio

   Next question

4. Question 424 · 607 in bank

   Which of the following is an example of memory injection?

   • ATwo processes access the same variable, allowing one to cause a privilege escalation.
   • BA process receives an unexpected amount of data, which causes malicious code to be executed.
   • CMalicious code is copied to the allocated space of an already running process.
   • DAn executable is overwritten on the disk, and malicious code runs the next time it is executed.

   Show answer

   Answer: C

   Explanation

   C. Malicious code is copied to the allocated space of an already running process. Explanation: Memory injection occurs when malicious code is directly injected into the memory space of an already running process. This type of attack bypasses the need to write malicious code to disk, making it harder to detect with traditional file-based antivirus solutions. Examples include DLL injection or process hollowing. Why not the other options? A. Two processes access the same variable, allowing one to cause a privilege escalation: This describes a race condition, not memory injection. B. A process receives an unexpected amount of data, which causes malicious code to be executed: This describes a buffer overflow, which is a precursor to injection attacks but not memory injection itself.

   Source: Adapted from community discussion — Anyio

   Next question

5. Question 425 · 607 in bank

   A security administrator is implementing encryption on all hard drives in an organization. Which of the following security concepts is the administrator applying?

   • AIntegrity
   • BAuthentication
   • CZero Trust
   • DConfidentiality

   Show answer

   Answer: D

   Explanation

   By implementing encryption on all hard drives, the security administrator is ensuring that data stored on the drives remains confidential. Encryption protects data from unauthorized access by converting it into a secure format that can only be read by someone with the appropriate decryption key.

   Source: Adapted from community discussion — 1f2b013

   Next question

6. Question 426 · 607 in bank

   An administrator has configured a quarantine subnet for all guest devices that connect to the network. Which of the following would be best for the security team to perform before allowing access to corporate resources?

   • ADevice fingerprinting
   • BCompliance attestation
   • CPenetration test
   • DApplication vulnerability test

   Show answer

   Answer: B

   Explanation

   Before allowing guest devices access to corporate resources, the security team should perform compliance attestation. Compliance attestation involves verifying that the guest device meets the organization's security policies and standards. This typically includes checks such as: Antivirus software: Is antivirus software installed and updated? Firewall: Is a firewall enabled and configured correctly? Operating system updates: Is the operating system up-to-date with the latest security patches? Other security controls: Does the device meet other security requirements, such as strong passwords and encryption? By performing compliance attestation, the security team can ensure that guest devices do not pose a significant security risk to the corporate network before granting them access to critical resources.

   Source: Adapted from community discussion — ProudFather

   Next question

7. Question 427 · 607 in bank

   A customer has a contract with a CSP and wants to identify which controls should be implemented in the IaaS enclave. Which of the following is most likely to contain this information?

   • AStatement of work
   • BResponsibility matrix
   • CService-level agreement
   • DMaster service agreement

   Show answer

   Answer: B

   Explanation

   B. Responsibility matrix Explanation: A responsibility matrix outlines which party (the customer or the cloud service provider) is responsible for implementing specific controls in a cloud environment, such as in an IaaS (Infrastructure as a Service) enclave. It is a key component in determining the division of responsibilities for security, compliance, and operational tasks. Why not the other options? A. Statement of work: A statement of work (SOW) defines the scope of a project, deliverables, and timelines but does not specifically address control implementation responsibilities. C. Service-level agreement: A service-level agreement (SLA) focuses on performance metrics (e.g., uptime, availability) but does not detail security control responsibilities.

   Source: Adapted from community discussion — Anyio

   Next question

8. Question 428 · 607 in bank

   A Chief Information Security Officer is developing procedures to guide detective and corrective activities associated with common threats, including phishing, social engineering, and business email compromise. Which of the following documents would be most relevant to revise as part of this process?

   • ASDLC
   • BIRP
   • CBCP
   • DAUP

   Show answer

   Answer: B

   Next question

9. Question 429 · 607 in bank

   Which of the following testing techniques uses both defensive and offensive testing methodologies with developers to securely build key applications and software?

   • ABlue
   • BYellow
   • CRed
   • DGreen

   Show answer

   Answer: B

   Explanation

   B. Yellow Explanation: The Yellow Team is a relatively newer concept in cybersecurity testing that combines both defensive (Blue Team) and offensive (Red Team) methodologies. This team works with developers to securely build key applications and software by integrating security practices throughout the development lifecycle, also known as Secure Development Lifecycle (SDLC). Their focus is on proactively addressing vulnerabilities while also testing the application for security flaws from an attacker's perspective. Why not the other options? C. Red Team: The Red Team conducts offensive testing by simulating real-world attacks to identify vulnerabilities and weaknesses. They don't directly engage with developers to build secure applications; they focus on penetration testing and exploitation.

   Source: Adapted from community discussion — Anyio

   Next question

10. Question 430 · 607 in bank

    While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

    • ADocumenting the new policy in a change request and submitting the request to change management
    • BTesting the policy in a non-production environment before enabling the policy in the production network
    • CDisabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy
    • DIncluding an “allow any” policy above the “deny any” policy

    Show answer

    Answer: B

    Explanation

    Frankly it should be both A and B. Submitting it to change management does not prevent the issue if it isn't caught by change management, and testing it in non-prod would but also shouldn't be done without a request to change management. It's a different question than the previous one regarding change management: Yes the technician SHOULD put in a change management request first, but that's not the question, the question is what would prevent it and the change management request does not prevent an issue, rather it lets everyone know what is happening and provides a backout plan if issues come up. That still does not PREVENT the issue though so /shrug

    Source: Adapted from community discussion — Examplary

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 421. 607 questions available.