Search index

Practice questions

28 original questions written for the SY0-701 objectives, not copied from exam leaks. The question and the answer check are free. The longer explanation is what a plan opens.

28 items

• A warehouse installs badge readers on the cage door so a person without a badge cannot enter the parts room. Which control type is the reader, and which purchase would still block entry if the reader lost power?1.1 · 1.0 · Foundational · Porch
• A clinic keeps a second copy of the charting system in another building so nurses can still open schedules when the primary storage shelf fails. Which leg of the CIA triad is this purchase mainly protecting?1.2 · 1.0 · Applied
• A finance lead denies approving a wire. The approval email was signed with her private key, and the signature verifies. Which security property lets you reject the denial?1.2 · 1.0 · Foundational
• You must encrypt 40 GB of disk images before they go to an offsite shelf. A colleague suggests encrypting each image directly with the company’s RSA public key. What should you use instead, and why?1.4 · 1.0 · Applied
• A developer wants to store customer passwords ‘so support can decrypt them if the customer forgets.’ Which design should you reject that sentence for?1.4 · 1.0 · Foundational
• A systems administrator who was passed over for promotion uses a still-valid admin account to export the customer table the night before their last day. No exploit is involved. Which actor label fits best?2.1 · 2.0 · Scenario
• Attackers compromise the agenda site of an industry conference because the target company’s engineers all visit it the week before they travel. The engineers’ own mail is never touched. What is this vector called?2.2 · 2.0 · Scenario
• A support forum saves comments and later renders them as HTML for every reader. An attacker posts a comment that runs script in other users’ browsers. Which vulnerability is this?2.3 · 2.0 · Applied · Porch
• A scanner reports a missing patch that the vendor published 40 days ago. A manager calls it a zero-day in the status meeting. Why is that the wrong word?2.3 · 2.0 · Foundational
• A build server’s CPU stays near 100% after hours. Fans are loud. Firewall logs show steady outbound connections to a known mining pool. Files on the server open normally, and nobody has found a ransom note. What is the most likely activity?2.4 · 2.0 · Scenario
• Lateral movement is confirmed inside one server VLAN. Incident response is starting. Which action best limits further spread while preserving evidence?2.5 · 2.0 · Scenario
• The same account authenticates to the VPN from Lisbon and, four minutes later, from Singapore. The user is on a train in Lisbon and does not hold a second phone. What should this alert be called?2.4 · 2.0 · Applied
• A network lead says devices on the corporate VPN should be trusted because they ‘made it inside.’ Which model are they describing, and which model rejects that sentence?3.1 · 3.0 · Applied · Porch
• Administrators need SSH into private subnets. You do not want SSH exposed on the internet, and you want every admin session recorded. Which pattern fits?3.2 · 3.0 · Scenario
• Support agents must confirm a card with the customer by reading back only the last four digits. The full number is stored for settlement. Which approach matches the agent’s screen?3.3 · 3.0 · Scenario
• A public web form is being hit with SQL injection attempts. The network firewall already allows 443 to the web tier. Which additional control is aimed at this traffic?3.2 · 3.0 · Applied
• Production deploys require one engineer to propose the change and a second engineer to approve it. Neither can complete the deploy alone. Which principle is this?4.6 · 4.0 · Foundational
• An unauthenticated scan of a server shows almost no missing patches. A scan that logs in with a read-only agent account shows 30. Why does the second scan disagree?4.3 · 4.0 · Applied
• Three logs arrive in ten minutes: VPN failures for one user, then a VPN success, then a large download from a file server that user rarely touches. A single rule fires only when all three occur together. What is that rule doing?4.4 · 4.0 · Applied
• Attackers are relaying one-time codes from your SMS logins in real time, and a few employees have had SIM swaps. Which replacement is phishing-resistant?4.6 · 4.0 · Scenario · Porch
• Ransomware is confirmed on one workstation. The share it was encrypting has been disconnected by a user who noticed. What is the next response action?4.8 · 4.0 · Scenario
• A USB drive found in the parking lot may become evidence. Which handling keeps it useful in an investigation?4.9 · 4.0 · Scenario
• Which document should contain the sentence ‘Passwords must be at least 14 characters and must not be reused across company systems’?5.1 · 5.0 · Foundational · Porch
• A laptop fleet is valued at $2,000 each. A loss exposes half the value (exposure factor 0.5). Analysts expect four such losses a year. What is the annualized loss expectancy for one laptop?5.2 · 5.0 · Applied
• You need the contractual ability to inspect a payroll vendor’s controls after an incident, not just a promise of 99.9% uptime. Which clause is that?5.3 · 5.0 · Applied
• A call center takes card numbers over the phone and types them into a payment page. Which system is in PCI DSS scope?5.4 · 5.0 · Scenario
• Leadership wants to walk through a ransomware decision tree — who isolates a host, who talks to counsel, who speaks to customers — without touching a production system. Which exercise is this?5.5 · 5.0 · Scenario
• You are asked to run a phishing simulation. Which outcome is the point of the exercise?5.6 · 5.0 · Applied