SY0-701 practice questions 481–490

1. Question 481 · 607 in bank

   A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in. Which of the following examples best describes the purpose of this script?

   • AResource scaling
   • BPolicy enumeration
   • CBaseline enforcement
   • DGuard rails implementation

   Show answer

   Answer: C

   Explanation

   The correct answer is: C. Baseline enforcement Explanation: Baseline enforcement refers to ensuring that systems comply with a predefined set of standards or configurations. In this case, the script validates the OS version, patch levels, and installed applications against a baseline to ensure consistency and security across all systems. Resource scaling (A) involves adjusting system resources (e.g., CPU, memory) based on demand, which is unrelated to the script's purpose. Policy enumeration (B) refers to listing or identifying policies, but the script is actively validating and enforcing compliance, not just enumerating policies. Guard rails implementation (D) typically involves setting boundaries or constraints to prevent unintended actions, which is not the primary purpose of this script.

   Source: Adapted from community discussion — Anyio

   Next question

2. Question 482 · 607 in bank

   A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well-known IoT device exploit. The analyst needs to review logs to identify the time of initial exploit. Which of the following logs should the analyst review first?

   • AEndpoint
   • BApplication
   • CFirewall
   • DNAC

   Show answer

   Answer: C

   Explanation

   The correct answer is: C. Firewall Explanation: Firewall logs are the most likely to provide information about the initial exploit, as firewalls monitor and log network traffic, including attempts to exploit vulnerabilities in IoT devices. These logs can show suspicious or unauthorized connections to the IoT device, which can help identify the time of the initial exploit. Endpoint logs (A) might provide details about the affected device, but they are less likely to capture the initial network-based exploit. Application logs (B) are specific to applications and may not be relevant if the exploit targeted the IoT device itself rather than an application running on it. NAC (Network Access Control) logs (D) focus on device authentication and network access, which may not directly reveal the time of the exploit. Thus, Firewall logs are the most appropriate starting point for identifying the time of the initial exploit.

   Source: Adapted from community discussion — Anyio

   Next question

3. Question 483 · 607 in bank

   A company’s gate access logs show multiple entries from an employee’s ID badge within a two-minute period. Which of the following is this an example of?

   • ARFID cloning
   • BSide-channel attack
   • CShoulder surfing
   • DTailgating

   Show answer

   Answer: A

   Explanation

   D. Tailgating: This refers to an unauthorized person physically following an authorized person through a secured entry point without using their own credentials. It would not produce multiple log entries from the same badge

   Source: Adapted from community discussion — PjoterK

   Next question

4. Question 484 · 607 in bank

   Which of the following most accurately describes the order in which a security engineer should implement secure baselines?

   • ADeploy, maintain, establish
   • BEstablish, maintain, deploy
   • CEstablish, deploy, maintain
   • DDeploy, establish, maintain

   Show answer

   Answer: C

   Explanation

   C. Establish, Deploy, Maintain Establish – First, the security engineer must define the secure baseline based on best practices, compliance requirements, and organizational needs. This includes: Configuring secure settings for operating systems, applications, and network devices. Following industry standards (e.g., CIS benchmarks, NIST, ISO 27001). Deploy – Once the baseline is established, it must be implemented across all systems. This includes: Applying configurations to production environments. Ensuring proper enforcement through automation (e.g., Group Policies, Ansible, SCCM). Maintain – Security is an ongoing process, so baselines must be regularly updated and monitored to address new threats. This includes: Patching vulnerabilities. Conducting compliance audits. Adjusting configurations based on evolving threats.

   Source: Adapted from community discussion — test_arrow

   Next question

5. Question 485 · 607 in bank

   A SOC analyst establishes a remote control session on an end user’s machine and discovers the following in a file: gmail.com[ENT]my.name@gmail.com[ENT]NoOneCanGuessThis123! [ENT]Hello Susan, it was great to see you the other day! Let’s plan a followup[BACKSPACE]follow-up meeting soon. Here is the link to register. [RTN][CTRL]c [CTRL]v [RTN]after[BACKSPACE]After you register give me a call on my cellphone. Which of the following actions should the SOC analyst perform first?

   • AAdvise the user to change passwords.
   • BReimage the end user’s machine.
   • CCheck the policy on personal email at work.
   • DCheck host firewall logs.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Advise the user to change passwords. Here's why: The file contains sensitive information, including an email address and a password ("NoOneCanGuessThis123!"), along with a suspicious message that includes commands like "[CTRL]c" and "[CTRL]v" (which may indicate attempts to copy/paste content, possibly in a malicious context). The immediate concern is the password being exposed. Given that the password appears in plaintext, the first action should be to advise the user to change their password—especially since it may be associated with a critical account (e.g., Gmail) that could be used for further attacks. It’s also important to ensure that the user is aware of the potential compromise and that the password isn't being used elsewhere.

   Source: Adapted from community discussion — 1eccfc0

   Next question

6. Question 486 · 607 in bank

   Which of the following would be the best way to block unknown programs from executing?

   • AAccess control list
   • BApplication allow list
   • CHost-based firewall
   • DDLP solution

   Show answer

   Answer: B

   Explanation

   An application allow list (also called whitelisting) restricts a system to only allow specific, pre-approved programs to run. Any program not on the allow list will be blocked from executing, making it highly effective at preventing unknown or unauthorized software from running on a system.

   Source: Adapted from community discussion — 4320d25

   Next question

7. Question 487 · 607 in bank

   Which of the following is a reason environmental variables are a concern when reviewing potential system vulnerabilities?

   • AThe contents of environmental variables could affect the scope and impact of an exploited vulnerability.
   • BIn-memory environmental variable values can be overwritten and used by attackers to insert malicious code.
   • CEnvironmental variables define cryptographic standards for the system and could create vulnerabilities if deprecated algorithms are used.
   • DEnvironmental variables will determine when updates are run and could mitigate the likelihood of vulnerability exploitation.

   Show answer

   Answer: A

   Explanation

   Environmental variables store information that can affect how software operates, such as file paths, user credentials, and runtime configurations. If improperly secured, these variables could provide an attacker with sensitive information or ways to manipulate the system, increasing the scope and impact of a vulnerability. Attackers exploiting vulnerabilities may access environmental variables to obtain sensitive data (e.g., API keys, database credentials, or paths to important files) or influence program behavior. For example, attackers might alter these variables to redirect data or compromise the system. This highlights the importance of controlling and securing environmental variables as part of the overall system security posture.

   Source: Adapted from community discussion — dbrowndiver

   Next question

8. Question 488 · 607 in bank

   A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA to comply with internal security policies. Which of the following should the security team recommend?

   • AIPSec with RADIUS
   • BRDP connection with LDAPS
   • CWeb proxy for all remote traffic
   • DJump server with 802.1X

   Show answer

   Answer: A

   Next question

9. Question 489 · 607 in bank

   An administrator must replace an expired SSL certificate. Which of the following does the administrator need to create the new SSL certificate?

   • ACSR
   • BOCSP
   • CKey
   • DCRL

   Show answer

   Answer: A

   Explanation

   The correct answer is A. CSR (Certificate Signing Request). To replace an expired SSL certificate, the administrator needs to generate a new SSL certificate, which involves creating a CSR. The CSR is a request sent to a Certificate Authority (CA) that includes information about the server and organization. The CA uses this information to create and sign a new SSL certificate.

   Source: Adapted from community discussion — 1eccfc0

   Next question

10. Question 490 · 607 in bank

    A systems administrator receives a text message from an unknown number claiming to be the Chief Executive Officer of the company. The message states an emergency situation requires a password reset. Which of the following threat vectors is being used?

    • ATyposquatting
    • BSmishing
    • CPretexting
    • DImpersonation

    Show answer

    Answer: B

    Explanation

    B. Smishing Why? Smishing (SMS Phishing) is a type of social engineering attack where an attacker sends fraudulent text messages (SMS) to trick the recipient into taking action, such as resetting a password or providing sensitive information. In this case, the attacker pretends to be the CEO and tries to manipulate the systems administrator into resetting a password, which could lead to unauthorized access. Why Not the Others? A. Typosquatting – This involves creating fake websites with misspelled domain names to trick users into visiting them, not SMS-based attacks. C. Pretexting – A broader social engineering technique where the attacker creates a fabricated scenario (pretext) to obtain information, but in this case, the attack method is specifically via SMS, making it smishing. D. Impersonation – While the attacker is pretending to be the CEO, the delivery method (SMS) classifies this as smishing rather than general impersonation.

    Source: Adapted from community discussion — test_arrow

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 481. 607 questions available.