SY0-701 practice questions 541–550

1. Question 541 · 607 in bank

   A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message. Which of the following should the analyst do?

   • APlace posters around the office to raise awareness of common phishing activities.
   • BImplement email security filters to prevent phishing emails from being delivered.
   • CUpdate the EDR policies to block automatic execution of downloaded programs.
   • DCreate additional training for users to recognize the signs of phishing attempts.

   Show answer

   Answer: C

   Explanation

   Updating the Endpoint Detection and Response (EDR) policies to block the automatic execution of downloaded programs helps to mitigate the risk by preventing malicious software from running even if a user clicks on a phishing link. This technical control directly addresses the potential consequences of a phishing attack by stopping harmful actions from taking place after the initial click, thus reducing the overall impact of the phishing campaign. While raising awareness (option A), implementing email security filters (option B), and creating additional training (option D) are all valuable preventive measures, they do not directly reduce the impact after a phishing link is clicked.

   Source: Adapted from community discussion — SHADTECH123

   Next question

2. Question 542 · 607 in bank

   Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?

   • ACompensating control
   • BNetwork segmentation
   • CTransfer of risk
   • DSNMP traps

   Show answer

   Answer: A

   Explanation

   A. Compensating control w, the keyword in the question is "legacy". Suppose that you have a legacy Linux server which is not compatible with those network-based firewalls, routers and multi-layer switches which is preventing you not just from building VLANs (Network Segmentation), but also from applying white-listing ACL technique against malicious IP addresses. So, what you're going to do is you are going to use host-based firewalls as a compensation for network appliances to be able to accomplish the similar end-result

   Source: Adapted from community discussion — shady23

   Next question

3. Question 543 · 607 in bank

   The management team notices that new accounts that are set up manually do not always have correct access or permissions. Which of the following automation techniques should a systems administrator use to streamline account creation?

   • AGuard rail script
   • BTicketing workflow
   • CEscalation script
   • DUser provisioning script

   Show answer

   Answer: D

   Explanation

   D. User provisioning script A user provisioning script automates the process of creating user accounts, ensuring that each new account is set up with the correct access and permissions consistently. This helps prevent errors that can occur with manual account creation. Therefore, the correct answer is: D. User provisioning script

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

4. Question 544 · 607 in bank

   A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis. Which of the following types of controls is the company setting up?

   • ACorrective
   • BPreventive
   • CDetective
   • DDeterrent

   Show answer

   Answer: C

   Explanation

   C. Detective By setting up a Security Information and Event Management (SIEM) system and assigning an analyst to review the logs on a weekly basis, the company is implementing a detective control. Detective controls are designed to identify and alert on potential security incidents, allowing the organization to take appropriate action after an event has occurred. Therefore, the correct answer is: C. Detective

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

5. Question 545 · 607 in bank

   A systems administrator is looking for a low-cost application-hosting solution that is cloud-based. Which of the following meets these requirements?

   • AServerless framework
   • BType 1 hypervisor
   • CSD-WAN
   • DSDN

   Show answer

   Answer: A

   Explanation

   A. Serverless framework A serverless framework is a cloud-based application-hosting solution that allows developers to build and run applications without managing the underlying infrastructure. It is typically a low-cost option because it charges based on the actual usage of the resources rather than requiring the provisioning of dedicated servers. Therefore, the correct answer is: A. Serverless framework

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

6. Question 546 · 607 in bank

   A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?

   • AJump server
   • BRADIUS
   • CHSM
   • DLoad balancer

   Show answer

   Answer: A

   Explanation

   It would be a jump server. A jump server is a secure node that sits between the untrusted network and the secure zone (where the Database servers are).

   Source: Adapted from community discussion — rjbb

   Next question

7. Question 547 · 607 in bank

   A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future?

   • ATuning
   • BAggregating
   • CQuarantining
   • DArchiving

   Show answer

   Answer: A

   Explanation

   The act of ignoring detected activity in the future is described as A. Tuning. Tuning refers to the process of adjusting the configuration of a system, in this case, the security operations center’s detection systems, to reduce or eliminate the number of false positives. In this context, if the so-called “malicious activity” is determined to be normal and is expected to recur, the system can be tuned to ignore this activity in the future, preventing unnecessary alerts. Please note that while the other options (B. Aggregating, C. Quarantining, D. Archiving) are activities related to managing and responding to security events, they do not specifically apply to the scenario of ignoring detected activity in the future.

   Source: Adapted from community discussion — jovines

   Next question

8. Question 548 · 607 in bank

   A security analyst reviews domain activity logs and notices the following:

   

   Which of the following is the best explanation for what the security analyst has discovered?

   • AThe user jsmith’s account has been locked out.
   • BA keylogger is installed on jsmith’s workstation.
   • CAn attacker is attempting to brute force jsmith’s account.
   • DRansomware has been deployed in the domain.

   Show answer

   Answer: C

   Explanation

   The scenario perfectly matches a common security issue where attackers gain partial access through stolen credentials but are thwarted by MFA, which they try to bypass unsuccessfully.The repeated success in password authentication suggests that the attacker has access to jsmith's password, but the failure of MFA points to an attempt to guess or brute-force the MFA code.

   Source: Adapted from community discussion — dbrowndiver

   Next question

9. Question 549 · 607 in bank

   A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider?

   • AClustering servers
   • BGeographic dispersion
   • CLoad balancers
   • DOff-site backups

   Show answer

   Answer: B

   Explanation

   Given the concern about weather events causing damage to the server room and resulting downtime, the company should consider measures that protect against physical damage and ensure business continuity. The most relevant option for this scenario is: B. Geographic dispersion Geographic dispersion involves placing critical infrastructure in multiple, geographically distant locations. This strategy ensures that even if one site is affected by a weather event, operations can continue at another site, minimizing downtime and maintaining availability.

   Source: Adapted from community discussion — barracouto

   Next question

10. Question 550 · 607 in bank

    Which of the following is a primary security concern for a company setting up a BYOD program?

    • AEnd of life
    • BBuffer overflow
    • CVM escape
    • DJailbreaking

    Show answer

    Answer: D

    Explanation

    When setting up a Bring Your Own Device (BYOD) program, the primary security concern is ensuring that personal devices, which may not be under the company's direct control, do not introduce security risks into the organization. Among the options provided, the most relevant concern is: D. Jailbreaking Jailbreaking refers to removing the manufacturer's restrictions on a device, which can compromise the security of the device. This makes it more susceptible to malware and unauthorized access, posing a significant risk to the company's network and data when such a device is connected.

    Source: Adapted from community discussion — barracouto

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 541. 607 questions available.