SY0-701 practice questions 501–510

1. Question 501 · 607 in bank

   An organization is preparing to export proprietary software to a customer. Which of the following would be the best way to prevent the loss of intellectual property?

   • ACode signing
   • BObfuscation
   • CTokenization
   • DBlockchain

   Show answer

   Answer: B

   Explanation

   B. Obfuscation Explanation: Obfuscation is the process of modifying code to make it difficult for unauthorized parties to understand, reverse-engineer, or modify while maintaining its functionality. This helps protect proprietary software from intellectual property theft when exporting to external customers. Breakdown of the other options: A. Code signing: Ensures authenticity and integrity but does not prevent reverse engineering or IP theft. C. Tokenization: Replaces sensitive data with tokens for security purposes, but it is primarily used for data protection rather than software IP protection. D. Blockchain: Can provide tamper-proof records but does not directly prevent software reverse engineering or protect proprietary code.

   Source: Adapted from community discussion — test_arrow

   Next question

2. Question 502 · 607 in bank

   Which of the following should be used to ensure a device is inaccessible to a network-connected resource?

   • ADisablement of unused services
   • BWeb application firewall
   • CHost isolation
   • DNetwork-based IDS

   Show answer

   Answer: C

   Next question

3. Question 503 · 607 in bank

   In which of the following will unencrypted network traffic most likely be found?

   • ASDN
   • BIoT
   • CVPN
   • DSCADA

   Show answer

   Answer: B

   Explanation

   Unencrypted network traffic is most likely to be found in B. IoT (Internet of Things). Many IoT devices, especially low-cost or low-power ones, often transmit data without encryption, which can make them vulnerable to interception. This is a common security concern in the IoT ecosystem. A. SDN (Software-Defined Networking): Typically uses encrypted communication protocols, especially for control planes. C. VPN (Virtual Private Network): VPNs are designed to encrypt traffic to protect data transmission. D. SCADA (Supervisory Control and Data Acquisition): While SCADA systems are critical and often operate on specialized protocols, modern implementations are increasingly using encryption to secure communications, although older systems may still have vulnerabilities. So, IoT stands out as the most likely for unencrypted traffic.

   Source: Adapted from community discussion — test_arrow

   Next question

4. Question 504 · 607 in bank

   Which of the following is the best reason to perform a tabletop exercise?

   • ATo address audit findings
   • BTo collect remediation response times
   • CTo update the IRP
   • DTo calculate the ROI

   Show answer

   Answer: C

   Explanation

   C. To update the IRP (Incident Response Plan) Explanation: A tabletop exercise is a simulation-based activity where team members discuss their roles, responses, and strategies in a hypothetical scenario, often related to security incidents. The main goal is to assess and improve the Incident Response Plan (IRP), ensuring that all stakeholders know their roles and that the plan is up-to-date and effective in handling real-world incidents. Breakdown of the other options: A. To address audit findings: While a tabletop exercise may reveal gaps that could be addressed in audits, it is not specifically designed for this purpose. B. To collect remediation response times: Tabletop exercises are about discussing and refining processes, not directly measuring remediation times. D. To calculate the ROI (Return on Investment): ROI is not a focus of tabletop exercises, which are more concerned with improving preparedness and refining response strategies.

   Source: Adapted from community discussion — test_arrow

   Next question

5. Question 505 · 607 in bank

   Which of the following is a use of CVSS?

   • ATo determine the cost associated with patching systems
   • BTo identify unused ports and services that should be closed
   • CTo analyze code for defects that could be exploited
   • DTo prioritize the remediation of vulnerabilities

   Show answer

   Answer: D

   Explanation

   D. To prioritize the remediation of vulnerabilities Explanation: CVSS (Common Vulnerability Scoring System) provides a standardized way to assess the severity of vulnerabilities. It assigns a numerical score to vulnerabilities based on factors such as exploitability, impact, and the potential damage. This score helps organizations prioritize remediation efforts, ensuring that the most critical vulnerabilities are addressed first. Breakdown of the other options: A. To determine the cost associated with patching systems: CVSS does not calculate the cost of patching systems, but rather the severity of vulnerabilities. B. To identify unused ports and services that should be closed: CVSS is not used for network inventory or identifying unused services. It focuses on scoring vulnerabilities. C. To analyze code for defects that could be exploited: CVSS does not analyze code but rather scores the impact of known vulnerabilities in existing software or systems.

   Source: Adapted from community discussion — test_arrow

   Next question

6. Question 506 · 607 in bank

   For an upcoming product launch, a company hires a marketing agency whose owner is a close relative of the Chief Executive Officer. Which of the following did the company violate?

   • AIndependent assessments
   • BSupply chain analysis
   • CRight-to-audit clause
   • DConflict of interest policy

   Show answer

   Answer: D

   Explanation

   D. Conflict of interest policy Explanation: A conflict of interest policy is in place to ensure that business decisions are made without undue influence from personal relationships or interests. In this case, the company's decision to hire a marketing agency owned by a close relative of the CEO creates a conflict of interest, as it may compromise the impartiality of the decision-making process and raise concerns about favoritism or bias. Breakdown of the other options: A. Independent assessments: This is about ensuring unbiased evaluations, but the issue here is more about the personal relationship rather than an independent assessment of the product. B. Supply chain analysis: This relates to evaluating risks and dependencies within the supply chain, which doesn't apply to the situation of hiring the marketing agency. C. Right-to-audit clause: Refers to the ability to audit a vendor's activities but is unrelated to the personal conflict of interest in the hiring decision.

   Source: Adapted from community discussion — test_arrow

   Next question

7. Question 507 · 607 in bank

   A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?

   • ATesting input validation on the user input fields
   • BPerforming code signing on company-developed software
   • CPerforming static code analysis on the software
   • DEnsuring secure cookies are use

   Show answer

   Answer: B

   Explanation

   Code signing involves applying a digital signature to software, verifying the identity of the developer and ensuring that the code has not been altered or tampered with since it was signed. This process provides assurance of the authenticity and integrity of the software. Testing input validation, performing static code analysis, and ensuring secure cookies are important security practices but do not specifically address the need to verify the authenticity of the code.

   Source: Adapted from community discussion — SHADTECH123

   Next question

8. Question 508 · 607 in bank

   An organization designs an inbound firewall with a fail-open configuration while implementing a website. Which of the following would the organization consider to be the highest priority?

   • AConfidentiality
   • BNon-repudiation
   • CAvailability
   • DIntegrity

   Show answer

   Answer: C

   Explanation

   C. Availability Explanation: A fail-open configuration means that, in the event of a failure, the firewall will allow all inbound traffic rather than blocking it. This is typically done to ensure availability, meaning that the website or service remains accessible to users even if there are issues with the firewall. The priority in this case is to avoid service disruption, ensuring the website remains available to users even during a failure scenario. Breakdown of the other options: A. Confidentiality: Protecting sensitive data is important, but in a fail-open scenario, the primary concern is ensuring that the service remains available, not necessarily confidential. B. Non-repudiation: Ensures that actions are traceable and verifiable, but it is less relevant to the firewall's configuration or availability. D. Integrity: While integrity is crucial to protect data from being tampered with, the fail-open configuration prioritizes availability, allowing traffic even in the event of failure.

   Source: Adapted from community discussion — test_arrow

   Next question

9. Question 509 · 607 in bank

   An engineer needs to ensure that a script has not been modified before it is launched. Which of the following best provides this functionality?

   • AMasking
   • BObfuscation
   • CHashing
   • DEncryption

   Show answer

   Answer: C

   Explanation

   C. Hashing Explanation: Hashing creates a unique fixed-size output (hash value) from the script. By calculating the hash of the original script and comparing it with the hash of the script before launch, the engineer can confirm whether the script has been modified. If the hashes match, the script is unchanged; if they differ, the script has been altered. Breakdown of the other options: A. Masking: Typically used to hide sensitive data, like credit card numbers, rather than ensuring the integrity of a script. B. Obfuscation: Involves making code difficult to understand or read, but does not guarantee that the script has not been modified. D. Encryption: Protects data confidentiality but does not inherently check for modifications; it focuses on securing data from unauthorized access.

   Source: Adapted from community discussion — test_arrow

   Next question

10. Question 510 · 607 in bank

    Which of the following is the most important element when defining effective security governance?

    • ADiscovering and documenting external considerations
    • BDeveloping procedures for employee onboarding and offboarding
    • CAssigning roles and responsibilities for owners, controllers, and custodians
    • DDefining and monitoring change management procedures

    Show answer

    Answer: C

    Explanation

    C. Assigning roles and responsibilities for owners, controllers, and custodians Explanation: One of the most critical elements of effective security governance is ensuring that clear roles and responsibilities are assigned to individuals or groups within the organization, such as owners, controllers, and custodians. These roles define who is responsible for the security of data, systems, and processes, ensuring accountability and alignment with security policies and practices. Breakdown of the other options: A. Discovering and documenting external considerations: While important for risk management, external considerations are secondary to defining internal roles and responsibilities in governance. B. Developing procedures for employee onboarding and offboarding: This is essential for operational security but falls under procedural management rather than governance itself. D. Defining and monitoring change management procedures: While important for maintaining security, this is a part of operational controls rather than the core structure of security governance.

    Source: Adapted from community discussion — test_arrow

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 501. 607 questions available.