SY0-701 practice questions 41–50

1. Question 41 · 607 in bank

   A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?

   • AHashing
   • BTokenization
   • CEncryption
   • DSegmentation

   Show answer

   Answer: C

   Explanation

   To ensure sensitive data at rest is rendered unreadable, the company will most likely use encryption. Encryption transforms the data into an unreadable format using an algorithm and a key, and only authorized parties with the correct decryption key can convert it back to its original readable form. This is the most effective way to protect data at rest from unauthorized access.

   Source: Adapted from community discussion — SHADTECH123

   Next question

2. Question 42 · 607 in bank

   A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?

   • AEnd of business
   • BEnd of testing
   • CEnd of support
   • DEnd of life

   Show answer

   Answer: D

   Explanation

   D. End of Life Here is why: End of support refers to when the manufacturer stops providing updates, patches and technical support for a product, but the product may still be use and it won't receive any further assistance or updates. End of Life: Refers to a stage where product is no longer sold, maintained or supported by manufacturer. This device is typically decommissioned or retired. End of support would only apply if the device was still in use but not longer receiving updates, in our scenario where decommissioning is involved, End of Life is the right answer.

   Source: Adapted from community discussion — a4e15bd

   Next question

3. Question 43 · 607 in bank

   A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?

   • AEncryption at rest
   • BMasking
   • CData classification
   • DPermission restrictions

   Show answer

   Answer: A

   Explanation

   When a laptop is stolen, encryption at rest ensures that the data remains secure and inaccessible to the thief, as they would need the decryption key to access the files. Data Protection: Encryption at rest provides a robust layer of security for sensitive data, making it a common requirement for organizations handling confidential information. The primary concern with stolen laptops is unauthorized access to the data stored on them. Encryption at rest is the most effective way to prevent data loss in this scenario, as it keeps the data secure even if the device falls into the wrong hands.

   Source: Adapted from community discussion — dbrowndiver

   Next question

4. Question 44 · 607 in bank

   A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

   • AConcurrent session usage
   • BSecure DNS cryptographic downgrade
   • COn-path resource consumption
   • DReflected denial of service

   Show answer

   Answer: D

   Explanation

   A reflected denial of service (DoS) attack occurs when an attacker sends forged requests to a server, causing the server to respond to the spoofed IP address (the target) with a large volume of traffic. In the context of DNS, this often involves DNS amplification attacks, where small DNS queries result in large responses being sent to the target. This matches the described symptoms of minimal resource usage on the DNS server but a flood of inbound traffic. The best description of the observed situation, where the DNS server is overwhelmed by inbound traffic with minimal DNS queries, is that it is experiencing a reflected denial of service attack. Therefore, the correct answer is: D. Reflected denial of service

   Source: Adapted from community discussion — 499c5c4

   Next question

5. Question 45 · 607 in bank

   A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?

   • ARBAC
   • BACL
   • CSAML
   • DGPO

   Show answer

   Answer: A

   Explanation

   RBAC: Role-Based Access Control (Permissions based on roles. Others include: MAC, DAC, Rule-based, ABAC) ACL: Access Control List (Popular with configuring firewalls) SAML: Security Assertion Markup Language (used alongside SSO, authentication) GPO: Group Policy Objective (used in hardening, to dictate policies, user rights, and audit settings)

   Source: Adapted from community discussion — AutoroTink

   Next question

6. Question 46 · 607 in bank

   A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?

   • AActive
   • BPassive
   • CDefensive
   • DOffensive

   Show answer

   Answer: A

   Explanation

   A. Active Active reconnaissance involves actively probing and scanning the target environment to gather information. This typically includes activities such as port and service scans, vulnerability scans, and other direct interactions with the target systems to identify potential weaknesses or entry points. Passive reconnaissance, on the other hand, involves gathering information without directly interacting with the target systems, such as monitoring network traffic or analyzing publicly available information. Options C and D, defensive and offensive reconnaissance, respectively, are not standard reconnaissance types typically used in the context of penetration testing.

   Source: Adapted from community discussion — shady23

   Next question

7. Question 47 · 607 in bank

   Select 2

   During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)

   • AFederation
   • BIdentity proofing
   • CPassword complexity
   • DDefault password changes
   • EPassword manager
   • FOpen authentication

   Show answer

   Answer: AC

   Explanation

   "A". Federation and "C". are the correct answers. Federation facilitates access to multiple systems using a single intranet profile, and password complexity ensures that the passwords used are strong and secure. These concepts work together to safeguard intranet accounts and streamline user access across various company-owned websites.

   Source: Adapted from community discussion — dbrowndiver

   Next question

8. Question 48 · 607 in bank

   Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system?

   • ASIEM
   • BDLP
   • CIDS
   • DSNMP

   Show answer

   Answer: A

   Explanation

   SIEM is the correct answer because SIEM systems are specifically designed to collect, centralize, and analyze logs from multiple sources, providing security alerting and monitoring capabilities essential for detecting and responding to potential threats.

   Source: Adapted from community discussion — dbrowndiver

   Next question

9. Question 49 · 607 in bank

   A network manager wants to protect the company's VPN by implementing multifactor authentication that uses: Something you know - Something you have - Something you are - Which of the following would accomplish the manager's goal?

   • ADomain name, PKI, GeoIP lookup
   • BVPN IP address, company ID, facial structure
   • CPassword, authentication token, thumbprint
   • DCompany URL, TLS certificate, home address

   Show answer

   Answer: C

   Next question

10. Question 50 · 607 in bank

    Which of the following would be the best way to handle a critical business application that is running on a legacy server?

    • ASegmentation
    • BIsolation
    • CHardening
    • DDecommissioning

    Show answer

    Answer: A

    Explanation

    A. Segmentation Segmentation is the best approach to handle a critical business application running on a legacy server. By segmenting the legacy server from the rest of the network, you can limit the potential impact of any vulnerabilities associated with the legacy system. This approach allows the critical application to continue running while minimizing the risk to the rest of the network. Therefore, the correct answer is: A. Segmentation

    Source: Adapted from community discussion — Etc_Shadow28000

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 41. 607 questions available.