SY0-701 practice questions 511–520

1. Question 511 · 607 in bank

   A contractor is required to visually inspect the motherboards of all new servers that are purchased to determine whether the servers were tampered with. Which of the following risks is the contractor attempting to mitigate?

   • AEmbedded rootkit
   • BSupply chain
   • CFirmware failure
   • DRFID keylogger

   Show answer

   Answer: B

   Explanation

   B. Supply chain Explanation: The contractor is inspecting the motherboards of new servers to ensure they have not been tampered with during the manufacturing or shipping process. This is a classic example of mitigating supply chain risks, specifically the risk of malicious modifications or unauthorized components being introduced during the supply process, which could compromise the security of the servers. Breakdown of the other options: A. Embedded rootkit: While a rootkit is a form of malware that could be installed on a device, a physical inspection of hardware is aimed at detecting hardware tampering, not malware. C. Firmware failure: This refers to issues with the device’s firmware, but inspecting the motherboard would not directly address firmware issues. D. RFID keylogger: This type of attack involves tracking or logging keystrokes via RFID, which is not directly related to inspecting motherboards for tampering.

   Source: Adapted from community discussion — test_arrow

   Next question

2. Question 512 · 607 in bank

   Which of the following could potentially be introduced at the time of side loading?

   • AUser impersonation
   • BRootkit
   • COn-path attack
   • DBuffer overflow

   Show answer

   Answer: B

   Explanation

   B. Rootkit Explanation: Side loading refers to the process of installing applications or software from unofficial or untrusted sources, bypassing the standard security measures of an operating system or application store. During side loading, malicious software such as a rootkit can be introduced, which allows attackers to gain deep, hidden access to the system, often with administrative privileges. Rootkits can remain undetected for long periods, enabling further malicious activity. Breakdown of the other options: A. User impersonation: This typically occurs through credential theft or social engineering, not directly due to side loading. C. On-path attack: An on-path attack (previously known as man-in-the-middle) involves intercepting communications, typically happening through network vulnerabilities, not side loading. D. Buffer overflow: While a buffer overflow is a type of software vulnerability, it is not typically introduced directly through side loading; it typically arises from poor coding practices.

   Source: Adapted from community discussion — test_arrow

   Next question

3. Question 513 · 607 in bank

   While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning is occurring on the network and then terminates access for the host. Which of the following is most likely responsible for this malicious activity?

   • AUnskilled attacker
   • BShadow IT
   • CInsider threat
   • DNation-state

   Show answer

   Answer: C

   Explanation

   C. Insider threat Explanation: ARP poisoning (or ARP spoofing) involves sending fake Address Resolution Protocol (ARP) messages onto a local network, which can cause network traffic to be misdirected or intercepted. The analyst’s discovery of the attack and their immediate response to terminate access indicates that someone may be intentionally disrupting the network. Given the context that the attack is occurring during a sensitive time (state testing) and considering that the attacker was able to execute such an attack and cause significant disruption, it's likely that the attacker has access to the internal network and knowledge of its operation, which aligns with an insider threat. Insiders, whether employees, contractors, or others with network access, are often responsible for these types of attacks.

   Source: Adapted from community discussion — test_arrow

   Next question

4. Question 514 · 607 in bank

   A user needs to complete training at https://comptiatraining.com. After manually entering the URL, the user sees that the accessed website is noticeably different from the standard company website. Which of the following is the most likely explanation for the difference?

   • ACross-site scripting
   • BPretexting
   • CTyposquatting
   • DVishing

   Show answer

   Answer: C

   Explanation

   C. Typosquatting Explanation: Typosquatting is a form of cyber attack where an attacker registers a domain name similar to a legitimate website but with a slight typo or variation. In this case, the user manually entered the URL "https://comptiatraining.com", which is likely a misspelling or variation of a legitimate website, and was redirected to a fake website designed to look similar to the legitimate one. The noticeable difference in the website suggests that the user may have been directed to a typosquatted site that attempts to trick the user into providing sensitive information or interacting with malicious content.

   Source: Adapted from community discussion — test_arrow

   Next question

5. Question 515 · 607 in bank

   A company has yearly engagements with a service provider. The general terms and conditions are the same for all engagements. The company wants to simplify the process and revisit the general terms every three years. Which of the following documents would provide the best way to set the general terms?

   • AMSA
   • BNDA
   • CMOU
   • DSLA

   Show answer

   Answer: A

   Explanation

   A. MSA (Master Service Agreement) Explanation: An MSA (Master Service Agreement) is a contract that establishes the general terms and conditions for an ongoing or long-term relationship between a company and a service provider. It typically covers standard terms for multiple engagements or projects and can be revisited periodically, as in the case described (every three years), without needing to renegotiate the entire agreement each time. Breakdown of the other options: B. NDA (Non-Disclosure Agreement): An NDA is focused on protecting confidential information and does not typically govern the general terms of a business relationship. C. MOU (Memorandum of Understanding): An MOU is a non-binding document that outlines the intent to collaborate but is not typically used for establishing the detailed terms of service. D. SLA (Service Level Agreement): An SLA defines the specific performance metrics, deliverables, and quality standards for services provided but is usually a more detailed agreement tied to specific engagements, not a general framework for the entire relationship.

   Source: Adapted from community discussion — test_arrow

   Next question

6. Question 516 · 607 in bank

   While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the following recommendations should the security analyst include in the training?

   • ARefrain from clicking on images included in emails from new vendors
   • BDelete emails from unknown service provider partners.
   • CRequire that invoices be sent as attachments
   • DBe alert to unexpected requests from familiar email addresses

   Show answer

   Answer: D

   Explanation

   D. Be alert to unexpected requests from familiar email addresses Explanation: Compromised email accounts are a common attack vector. If a vendor's email account is compromised, attackers may use it to send legitimate-looking, but malicious, emails. Employees should be trained to recognize unexpected requests from familiar email addresses, as this could indicate that an email is fraudulent or part of a phishing attack. why not A: A. Refrain from clicking on images included in emails from new vendors: While this is good advice, it is more specific to a single type of attack (e.g., image-based phishing) and may not address the broader issue of compromised accounts.

   Source: Adapted from community discussion — test_arrow

   Next question

7. Question 517 · 607 in bank

   Select 2

   A new corporate policy requires all staff to use multifactor authentication to access company resources. Which of the following can be utilized to set up this form of identity and access management? (Choose two.)

   • AAuthentication tokens
   • BLeast privilege
   • CBiometrics
   • DLDAP
   • EPassword vaulting
   • FSAML

   Show answer

   Answer: AC

   Explanation

   A. Authentication tokens C. Biometrics Explanation: Multifactor authentication (MFA) requires at least two of the following factors for user authentication: Something you know (e.g., password or PIN) Something you have (e.g., authentication token, smart card) Something you are (e.g., biometric factors like fingerprints or facial recognition) A. Authentication tokens: These are physical or software-based devices that generate or store a one-time password (OTP) to provide an additional layer of security. This is a common method used in MFA. C. Biometrics: Biometrics such as fingerprints, retina scans, or facial recognition are used as a second factor of authentication, making this a suitable option for MFA.

   Source: Adapted from community discussion — test_arrow

   Next question

8. Question 518 · 607 in bank

   Which of the following can be used to identify potential attacker activities without affecting production servers?

   • AHoneypot
   • BVideo surveillance
   • CZero Trust
   • DGeofencing

   Show answer

   Answer: A

   Explanation

   Honeypot - a network-attached system set up as a decoy to lure cyber attackers and detect, deflect and study hacking attempts on systems.

   Source: Adapted from community discussion — 123456789User

   Next question

9. Question 519 · 607 in bank

   A help desk employee receives a call from someone impersonating the Chief Executive Officer. The caller asks for assistance with resetting a password. Which of the following best describes this event?

   • AVishing
   • BHacktivism
   • CBlackmail
   • DMisinformation

   Show answer

   Answer: A

   Explanation

   A. Vishing Explanation: Vishing (voice phishing) is a type of social engineering attack where an attacker uses phone calls or voice messages to impersonate someone else, often with the goal of tricking the victim into providing sensitive information or performing an action like resetting a password. In this scenario, the help desk employee receives a call from someone impersonating the Chief Executive Officer (CEO) and asks for assistance with resetting a password, which is a classic vishing attack.

   Source: Adapted from community discussion — test_arrow

   Next question

10. Question 520 · 607 in bank

    The number of tickets the help desk has been receiving has increased recently due to numerous false-positive phishing reports. Which of the following would be best to help to reduce the false positives?

    • APerforming more phishing simulation campaigns
    • BImproving security awareness training
    • CHiring more help desk staff
    • DImplementing an incident reporting web page

    Show answer

    Answer: B

    Explanation

    B. Improving security awareness training Explanation: False-positive phishing reports occur when employees incorrectly identify legitimate emails as phishing attempts. Improving security awareness training helps employees better recognize actual phishing emails, reducing unnecessary reports to the help desk. Training should include: ✅ How to differentiate between real and phishing emails ✅ Examples of common phishing tactics ✅ When and how to report suspicious emails Why not the others? A. Performing more phishing simulation campaigns – While simulations are helpful, they mainly test employee awareness rather than directly improving their ability to distinguish false positives. C. Hiring more help desk staff – This may address the increased workload but does not solve the root issue of frequent false-positive reports. D. Implementing an incident reporting web page – This could streamline reporting but would not necessarily reduce false positives.

    Source: Adapted from community discussion — test_arrow

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 511. 607 questions available.