Free SY0-701 Practice Test – 20 Questions with Explanations

An insurer already enforces MFA and conditional access, but the SOC is missing a reliable detective use case for compromised user sessions during a remote-work surge. Analysts must use existing identity logs, keep false positives low, and trigger an alert within five minutes without forcing new login prompts during a month-end close. During triage, they review the following sign-in evidence for one finance employee.

Which detective control use case is the best match for this evidence and these constraints?

A customer portal for contractors must keep authentication records for one year to satisfy an external audit, and passwords cannot be stored in plaintext. The service must stay within a FIPS-validated crypto module, and it runs on legacy hosts with limited CPU headroom. A breach sample shows many identical password hashes across different users and a GPU rig cracks weak passwords quickly.

which change most directly fixes the storage weakness while respecting the constraints?

A bank must be able to prove which employee approved a high-risk refund, and the approval record must be retained for seven years. Multiple administrators have access to the shared automation account, and the solution must avoid storing full customer data in logs for privacy reasons. The team claims the approval events are “non-repudiable” because each record is cryptographically signed.

what most undermines non-repudiation in this design?

A software team distributes an internal Linux package to remote field devices over untrusted networks, and the update process must remain lightweight because bandwidth is limited. The current script downloads the package, logs the transfer timestamp, and installs immediately, but auditors flagged that the process does not actually verify whether the package was altered in transit. The team must add the smallest practical change that strengthens integrity checking without redesigning the deployment workflow.

What is the best fix to add integrity verification under these constraints?

A regulated manufacturing network must keep production systems online and cannot deploy any new sensors during a change freeze. The SOC must reduce false positives because alert volume is already breaching SLA, and audit requires 180-day log retention for investigation. Overnight, one user workstation shows bursts of internal authentication activity with no corresponding ticketed maintenance.

Which pattern is the best indicator of unusual lateral movement in this exhibit?

An organization’s “Corp” network segment is treated as trusted, and any device on that segment can reach multiple shared services without additional verification. A recent internal audit flagged that contractors on a split-tunnel VPN land directly into the “Corp” segment, but the business requires continued access to one legacy database with no downtime. The security team must reduce lateral movement risk while keeping change effort minimal this sprint.

Which change most directly reduces implicit trust zones while meeting the constraints?

A regional hospital chain has a 30-day window to reduce risk from financially motivated actors that buy stolen credentials, phish staff, and deploy double-extortion ransomware, but the budget only allows a few high-impact controls this quarter. Legacy imaging systems cannot be replaced yet, email flow must not break, and recovery time objectives for clinical scheduling are strict. The CISO wants the two defenses that best match the adversary’s capability and motive rather than a broad wishlist.
Which TWO defenses should be prioritized first? Select TWO.

A company uses serverless functions to process customer uploads and must separate duties between platform operations and application security. The team cannot deploy host-based agents and must rely on platform-native controls while keeping false positives low. Auditors require clear evidence of what the provider secures versus what the customer must configure for event-driven execution.
Which statements correctly describe serverless security boundaries and event triggers? (Select
THREE.)

A retailer must deploy an updated containerized checkout service before a holiday freeze, and operations is not allowed to introduce a new runtime security product this week. The cluster already enforces basic namespace quotas, but the SOC sees one workload definition that would materially raise breakout risk while still passing simple image scans. The responder must

Which issue is the most dangerous immediate risk?

A cloud CRM vendor will integrate with your IdP and ingest regulated support tickets, and your compliance team requires 72-hour incident notification. The vendor offers strong uptime SLAs, but you have a limited budget and must prioritize the single risk signal that most increases your exposure in a shared-responsibility model. You are reviewing a short excerpt from the vendor’s due-diligence responses.

Which response is the HIGHEST risk signal under the constraints?

A fintech runs a shared PostgreSQL cluster where outsourced DBAs must troubleshoot performance, but regulators require least privilege and separation of duties for PII. The app team can add application-layer crypto quickly, but the database schema must remain stable and analytics queries must keep low latency. You must encrypt only SSN and bank routing fields without taking downtime for full re-encryption.

Which encryption scope best fits the constraints?

A global company wants to replace a patchwork of remote VPN concentrators and separate cloud web gateways with a converged edge model for remote staff and branch traffic. The migration must avoid breaking identity-based policies, keep rollback possible during the pilot, and move the smallest risky population first because the help desk is already overloaded. The architect lists four actions that must be sequenced correctly so the SASE rollout preserves policy intent and operational control.
Steps
1. Inventory applications, paths, and user groups
2. Translate legacy controls into identity-aware policy
3. Pilot a limited user group through the nearest SASE PoP
4. Retire legacy remote-access paths
Which sequence is the best order?

A hospital campus uses managed Wi-Fi and must meet patient-privacy requirements plus 365-day security log retention. The security team has one change window tonight and cannot disrupt clinical Wi-Fi during morning rounds. A WIDS alert shows intermittent rogue-SSID beacons, and the wireless survey tool produced the heat-map summary below from the last 30 minutes.

Which zone should you prioritize first for a physical sweep to locate the likely rogue AP?

Your SOC uses a managed dark web monitoring service because you support a remote workforce and must keep audit logs for 12 months. The vendor alerts that your company domain appears in a new “combo list,” but you are under a change freeze and must not break mail flow. You need the most actionable exposure signal that indicates real account compromise risk rather than general internet noise.

Which exposure signal in the exhibit is the strongest indicator you should treat this as a credible credential exposure event?

A payment processor must retain security logs for 18 months and prove they were not altered during quarterly audits. The SOC cannot add new tools this quarter and must keep ingestion latency under 2 minutes during peak traffic. An incident review found that administrators can delete indexed events in the current log platform without an independent integrity record.

Which change best satisfies both retention and integrity requirements with minimal additional tooling?

A security team is reviewing privileged access to a Linux jump host used by contractors and employees, and auditors found that recent command activity could not be tied confidently to one person. The company must preserve least privilege, avoid shared accountability gaps, and improve post-incident reconstruction without replacing the current bastion this quarter. The architect is asked to choose the two changes that most directly strengthen the auditing value of AAA in this environment.
Which two changes best support auditing through AAA? Select TWO.

A global consultancy monitors endpoints primarily through agentless network sensors to reduce operational overhead. A recent incident review found that several contractor laptops executed suspicious binaries while traveling and never connected to the corporate VPN, and audit requires evidence for all privileged actions. The SOC must improve investigative completeness without expanding full packet capture across all sites.

Which decision BEST addresses the observed gap under the constraints?

A retailer’s board wants risk decisions expressed in expected annual loss dollars to set cyber insurance limits and prioritize funding. The risk team must use existing spreadsheets this quarter and has enough historical incident cost data to estimate frequency without buying new tooling. An internal audit found the register is using qualitative scoring but presenting it as financial exposure.

What is the best fix to make this a quantitative approach under the constraints?

A healthcare board must compare cyber risks this week, but one business unit has rich loss data while another only has expert judgment and rough impact bands. The team cannot buy a new platform, must keep the workshop under two hours, and still needs a defensible method for a regulator-facing summary. The risk manager asks which mapping best matches each approach.

Which mapping is most accurate?

A payment processor exports a daily settlement file to a banking partner and must prove the file was not altered in transit or during staging. The transfer cannot introduce downtime, and audit requires nonrepudiation evidence tied to a specific release window. The organization must keep overhead low and cannot add a new data-loss platform this quarter.

Which description best identifies the data and the integrity requirement you must enforce?