SY0-701 practice questions with answers

Answer: A) Operational and preventive

In SY0-701 terms, security awareness training is an operational control, because people carry it out. It is preventive because it aims to stop incidents before they occur.

• ATraining is carried out by people rather than by technology, so it is an operational control. Its goal is to stop incidents such as successful phishing before they happen, which makes it preventive.
• BTraining is not enforced by hardware or software, and its main purpose is not to find events after they occur, as an IDS or log review does.
• CTraining is not a physical barrier like a lock or fence, and it does not restore systems after an incident.
• DTraining is not implemented in technology. It is also a planned control in its own right, not an alternative used because a required control can't be implemented.

Answer: A) A honeyfile

• AA honeyfile is a decoy file whose only purpose is to alert defenders when someone accesses it.
• BA honeynet is a network of decoy systems, not a single file.
• CSteganography hides data inside other content; it isn't a decoy to detect access.
• DMasking hides parts of real data values; it doesn't create decoys.

Answer: A) A virus

• AA virus attaches to files and spreads when users run or share the infected files.
• BA worm spreads across networks without needing a user to open anything.
• CSpyware gathers information; self-copying into documents isn't its defining behavior.
• DBloatware is unwanted preinstalled software, not self-replicating code.

Answer: A) A rootkit

• AA rootkit hides its presence and maintains privileged access, often by modifying the kernel or system tools.
• BA worm spreads itself across networks; self-hiding at kernel level is the defining trait of a rootkit.
• CAdware displays unwanted advertising; it doesn't typically hide at kernel level.
• DA keylogger records keystrokes; hiding from system tools isn't its defining feature.

Answer: A) Bluesnarfing

• ABluesnarfing is unauthorized access to data on a device over a Bluetooth connection.
• BBluejacking sends unsolicited messages to nearby Bluetooth devices; it doesn't steal data.
• CAn evil twin is a rogue Wi-Fi access point imitating a legitimate one.
• DRFID cloning copies badge identifiers; it doesn't access phone data over Bluetooth.

Answer: A) A jump box / bastion host

• AA jump box is a single hardened, logged entry point placed between admin workstations and sensitive systems, shrinking the attack surface and concentrating monitoring on one chokepoint.
• BAn air gap means no network connection at all between environments; here there is a controlled path via the bastion.
• CA honeypot is a decoy meant to attract and study attackers, not a sanctioned admin access path.
• DA CDN caches and distributes content to users; it is not an administrative access control.

Answer: A) Control-plane decisions move off individual devices to a centralized controller

SDN separates (abstracts) the control plane from the data-plane devices. A central controller defines policy and programs the forwarding devices, which can be physical or virtual.

• ACorrect. SDN abstracts the management and control planes away from the forwarding devices. A centralized controller sets policy and programs the data-plane devices, which handle the actual packet forwarding.
• BIncorrect. This is how a traditional, device-by-device network works. SDN centralizes configuration and policy instead of relying on each device's local decisions.
• CIncorrect. This is the opposite of SDN. SDN works because the planes are no longer bound to the individual devices.
• DIncorrect. Physical switches, routers, and other hardware still have a place in SDN. SDN changes how devices are controlled, not whether hardware exists.

Answer: A) TLS

• ATLS secures individual application sessions, such as HTTPS.
• BTunnel mode typically protects all traffic between two networks.
• CSNMPv1 is an unencrypted management protocol.
• DTelnet sends data in plaintext.

Answer: A) Root cause analysis

• ARoot cause analysis identifies the underlying reason an incident happened, to prevent recurrence.
• BThreat hunting proactively searches for undetected threats, not the cause of a known incident.
• CIdentity proofing verifies who someone is.
• DEnumeration discovers devices for inventory.

Answer: A) COPE

• ACorporate-owned, personally enabled: the organization owns and manages the device but allows personal use.
• BBring your own device means employees use their personally owned devices; here the company owns them.
• CChoose your own device lets employees pick from approved models, typically for work use; personal use isn't the defining feature.
• DVDI provides hosted virtual desktops; it isn't a mobile device ownership model.

Answer: A) The scanner can sign in and read installed patch levels and local settings, so it reports from evidence instead of inferring from banners

A credentialed scan signs in to the target and reads its actual patch and configuration state, so it is more accurate and produces fewer false positives than a non-credentialed scan that guesses from outside. It needs a protected account with only the access it requires.

• ACorrect. With credentials, the scanner inspects the host from the inside (installed updates, package versions, registry and configuration). This removes the guesswork of version-banner matching that causes false positives in non-credentialed scans.
• BIncorrect. Confirming findings by exploiting them is penetration testing. A credentialed vulnerability scan does not exploit anything; it reads system state using the account it was given.
• CIncorrect. Credentials do not narrow the set of ports that are probed. A credentialed scan usually examines more of the system, not less. The findings dropped because they were false positives, not because less was scanned.
• DIncorrect. Credentials let the scanner authenticate and inspect the host. They do not exist to hide scan traffic from an IPS, and that would not explain why already-installed patches were being reported as missing.

Answer: A) Threat hunting

• AThreat hunting is a proactive, hypothesis-driven search through logs and endpoint data for adversary activity that automated detections may have missed, often guided by threat intelligence and TTPs.
• BPen testing simulates an attacker to find weaknesses; hunting looks for an attacker already present.
• CPatching remediates vulnerabilities; it isn't a search for intruders.
• DA tabletop is a discussion-based rehearsal of a scenario, not an active search of live data.

Answer: A) Due diligence

• ADue diligence investigates a vendor's suitability and risks before entering an agreement.
• BMonitoring happens after the vendor is engaged.
• CAcceptance tolerates a known risk without action.
• DA legal hold preserves data for litigation.

Answer: A) Qualitative risk analysis

• AQualitative analysis uses relative ratings (categories, heat maps) for likelihood and impact; quantitative analysis assigns numeric values like SLE, ARO, and ALE.
• BQuantitative analysis would compute monetary loss expectancies, which this scenario explicitly avoids.
• CA pen test finds exploitable weaknesses; it isn't a risk-scoring method.
• DA BIA identifies critical processes and recovery objectives; it isn't the likelihood/impact scoring described.

Answer: A) Hybrid and remote work

• AGuidance for remote and hybrid work addresses risks of working outside the office, such as untrusted networks and onlookers.
• BData retention concerns how long records are kept.
• CChange management governs modifications to systems.
• DVendor management concerns third-party suppliers.