SY0-701 Free Practice Questions — Page 25 (2026)

Question 216

A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers. Which of the following architectures will best achieve the company’s objectives?

A. IoT

B. IaC

C. IaaS

D. ICS

Show Answer

Correct Answer: B

Explanation:
Infrastructure as Code (IaC) automates the provisioning and configuration of servers using declarative or scripted definitions, enabling consistent, standardized, repeatable deployments while reducing build time and manual effort. IaaS provides infrastructure resources but does not by itself standardize or automate server builds. IoT and ICS are unrelated to server provisioning.

Question 217

After a security incident, a systems administrator asks the company to buy a NAC platform. Which of the following attack surfaces is the systems administrator trying to protect?

A. Bluetooth

B. Wired

C. NFC

D. SCADA

Show Answer

Correct Answer: B

Explanation:
A Network Access Control (NAC) platform enforces access policies for endpoints connecting to the enterprise network, most commonly controlling access on wired (and often wireless) networks using technologies such as 802.1X. Among the options, the attack surface it is intended to protect is the wired network. Bluetooth and NFC are short-range wireless technologies rather than the primary NAC focus, and SCADA is an industrial control environment, not an attack surface addressed by NAC.

Question 218

Which of the following architectures is most suitable to provide redundancy for critical business processes?

A. Network-enabled

B. Server-side

C. Cloud-native

D. Multitenant

Show Answer

Correct Answer: C

Explanation:
Cloud-native architectures are designed for resilience through distributed services, automated failover, scaling, and deployment across multiple availability zones or regions. These characteristics make them the most suitable choice for providing redundancy for critical business processes. Network-enabled and server-side describe where connectivity or processing occurs rather than redundancy, while multitenancy is about sharing infrastructure among customers, not ensuring redundancy for a single organization's workloads.

Question 219

Which of the following data states applies to data that is being actively processed by a database server?

A. In use

B. At rest

C. In transit

D. Being hashed

Show Answer

Correct Answer: A

Explanation:
Data that is actively being processed by a database server is considered data 'in use'. 'At rest' refers to stored data, 'in transit' refers to data moving across a network, and 'being hashed' is a cryptographic operation rather than a data state.

Question 220

An accountant is transferring information to a bank over FTP. Which of the following mitigations should the accountant use to protect the confidentiality of the data?

A. Tokenization

B. Data masking

C. Encryption

D. Obfuscation

Show Answer

Correct Answer: C

Explanation:
Encryption protects the confidentiality of data in transit. Standard FTP transmits data in plaintext, so the appropriate mitigation is to encrypt the data (or use an encrypted variant such as FTPS or SFTP). Tokenization, data masking, and obfuscation do not provide confidentiality for data being transmitted over the network.

Question 221

A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following activities should the company perform next?

A. Gap analysis

B. Policy review

C. Security procedure evaluation

D. Threat scope reduction

Show Answer

Correct Answer: A

Explanation:
A gap analysis is the appropriate next step after a new regulation is announced because it compares the organization's current controls, processes, and compliance posture against the new regulatory requirements. This identifies deficiencies that must be addressed before updating policies, procedures, or implementing remediation. Policy reviews and procedure evaluations may follow based on the identified gaps, while threat scope reduction is not the primary compliance activity.

Question 222

Which of the following strategies should an organization use to efficiently manage and analyze multiple types of logs?

A. Deploy a SIEM solution

B. Create custom scripts to aggregate and analyze logs.

C. Implement EDR technology.

D. Install a unified threat management appliance.

Show Answer

Correct Answer: A

Explanation:
A SIEM (Security Information and Event Management) solution is purpose-built to collect, normalize, correlate, store, and analyze logs from many different sources efficiently. Custom scripts are less scalable and harder to maintain, EDR focuses on endpoint detection and response rather than centralized multi-source log management, and a UTM appliance consolidates security functions but is not designed for enterprise-wide log aggregation and analysis across diverse systems.

Question 223

A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way to identify where the system data was exfiltrated from and what location the attacker sent the data to?

A. Analyze firewall and network logs for large amounts of outbound traffic to external IP addresses or domains.

B. Analyze IPS and IDS logs to find the IP addresses used by the attacker for reconnaissance scans.

C. Analyze endpoint and application logs to see whether file-sharing programs were running on the company systems.

D. Analyze external vulnerability scans and automated reports to identify the systems the attacker could have exploited a remote code vulnerability.

Show Answer

Correct Answer: A

Explanation:
Firewall and network logs are the most efficient source for identifying large outbound data transfers, the internal host that initiated the transfer, and the external IP address or domain that received the data. IDS/IPS logs focus on detection events rather than complete exfiltration paths, endpoint logs may show applications but not the network destination, and vulnerability scan reports do not identify actual exfiltration activity.

Question 224

A group of developers has a shared backup account to access the source code repository. Which of the following is best way to secure the backup account if there is an SSO failure?

A. RAS

B. EAP

C. SAML

D. PAM

Show Answer

Correct Answer: D

Explanation:
Privileged Access Management (PAM) is designed to secure and control privileged or shared accounts through credential vaulting, access approval, auditing, session monitoring, and credential rotation. For a shared backup account used when SSO is unavailable, PAM is the appropriate control. RAS provides remote access, EAP is a network authentication framework, and SAML is an SSO/federation protocol rather than a mechanism for securing a shared fallback account.

Question 225

An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, which could allow attackers to access customer payment information. Which of the following mitigation strategies would be most effective for preventing an attack on the organization's web servers? (Choose two.)

A. Regularly updating server software and patches

B. Implementing strong password policies

C. Encrypting sensitive data at rest and in transit

D. Utilizing a web-application firewall

E. Performing regular vulnerability scans

F. Removing payment information from the servers

Show Answer

Correct Answer: A, D

Explanation:
Regularly updating server software and applying patches addresses known vulnerabilities that could be exploited for JavaScript injection. A web application firewall (WAF) provides runtime protection by detecting and blocking malicious requests, including many injection and cross-site scripting attacks. Other options improve security posture or reduce impact but do not most effectively prevent exploitation of the vulnerable web application.