SY0-701 Free Practice Questions — Page 6 (2026)

Question 20

HOTSPOT - Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation. INSTRUCTIONS - Not all attacks and remediation actions will be used. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Show Answer

Correct Answer: 1. Botnet — Enable DDoS protection 2. RAT — Implement a host-based IPS 3. Worm — Change the default application password 4. Keylogger — Implement 2FA using push notifications 5. Backdoor — Conduct a code review

Explanation:
Multiple-source SYN flooding indicates a botnet. A host-based IPS can block RAT activity; changing well-known credentials stops the worm’s stated method of spread. Push-based 2FA limits the value of stolen keystrokes, and code review can uncover hidden application access.

Question 21

Which of the following is a prerequisite for a DLP solution?

A. Data destruction

B. Data sanitization

C. Data classification

D. Data masking

Show Answer

Correct Answer: C

Explanation:
A Data Loss Prevention (DLP) solution relies on identifying which information is sensitive so it can monitor, control, and prevent unauthorized disclosure. Data classification provides the labels or categories that define sensitive data and is therefore a prerequisite for effective DLP policies. Data destruction, sanitization, and masking are protective techniques but are not prerequisites for deploying DLP.

Question 21

Which of the following scenarios describes a possible business email compromise attack?

A. An employee receives a gift card request in an email that has an executive’s name in the display field of the email.

B. Employees who open an email attachment receive messages demanding payment in order to access files.

C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.

D. An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal.

Show Answer

Correct Answer: A

Explanation:
A is the clearest example of business email compromise: an attacker can spoof an executive’s display name and use that authority to trick an employee into buying gift cards, a common BEC tactic. C is more specifically a credential-phishing attempt; the scenario doesn’t establish that the HR director’s business email account was compromised.

Question 22

Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

A. Hacktivist

B. Whistleblower

C. Organized crime

D. Unskilled attacker

Show Answer

Correct Answer: C

Explanation:
Organized crime groups can have the skills and resources to conduct sophisticated attacks and may be hired by foreign governments as proxies. Hacktivists are generally driven by their own political or social causes, while whistleblowers and unskilled attackers are less likely to carry out such operations.

Question 22

Which of the following is a type of vulnerability that may result from outdated algorithms or keys?

A. Hash collision

B. Cryptographic

C. Buffer overflow

D. Input validation

Show Answer

Correct Answer: B

Explanation:
Outdated cryptographic algorithms (such as DES or RC4) and weak, short, or compromised keys create cryptographic vulnerabilities because they reduce the strength of encryption and related security mechanisms. A hash collision is a specific cryptographic issue, not the broad vulnerability type described. Buffer overflow and input validation are unrelated software security vulnerability categories.

Question 23

A company wants to prevent proprietary and confidential company information from being shared to outsiders. Which of the following would this best describe?

A. MOA

B. SLA

C. MSA

D. NDA

Show Answer

Correct Answer: D

Explanation:
An NDA (Non-Disclosure Agreement) is specifically designed to protect proprietary and confidential information by legally restricting parties from disclosing it to unauthorized outsiders. An MOA (Memorandum of Agreement), SLA (Service Level Agreement), and MSA (Master Service Agreement) serve different contractual purposes and are not primarily confidentiality agreements.

Question 24

Which of the following solutions would most likely be used in the financial industry to mask sensitive data?

A. Tokenization

B. Hashing

C. Salting

D. Steganography

Show Answer

Correct Answer: A

Explanation:
Tokenization is the standard approach in the financial industry for masking sensitive data such as payment card numbers by replacing the original value with a non-sensitive token. Hashing is primarily for integrity and password verification, salting strengthens hashes, and steganography hides the existence of data rather than masking sensitive values for transactional use.

Question 25

Which of the following is used to calculate the impact to an organization per cybersecurity incident?

A. SLE

B. ALE

C. ARO

D. SLA

Show Answer

Correct Answer: A

Explanation:
SLE (Single Loss Expectancy) measures the expected financial impact of a single cybersecurity incident. ALE (Annual Loss Expectancy) is calculated as SLE × ARO and represents expected annual loss, ARO is the expected frequency per year, and SLA is a service agreement, not a risk calculation metric.

Question 26

A security administrator needs to reduce the attack surface in the company's data centers. Which of the following should the security administrator do to complete this task?

A. Implement a honeynet.

B. Define Group Policy on the servers.

C. Configure the servers for high availability.

D. Upgrade end-of-support operating systems.

Show Answer

Correct Answer: D

Explanation:
Upgrading end-of-support operating systems reduces the attack surface by eliminating unsupported, unpatched platforms that are more vulnerable to exploitation. Honeynets are detection/deception controls, Group Policy can harden systems but is not inherently an attack surface reduction measure in this context, and high availability improves resilience rather than reducing exposed attack vectors.

Question 27

A site reliability engineer is designing a recovery strategy that requires quick failover to an identical site if the primary facility goes down. Which of the following types of sites should the engineer consider?

A. Recovery site

B. Hot site

C. Cold site

D. Warm site

Show Answer

Correct Answer: B

Explanation:
A hot site is a fully equipped, operational duplicate of the primary environment with current systems and data, enabling rapid failover and minimal downtime. A warm site requires additional setup and synchronization before use, a cold site provides only basic infrastructure, and 'recovery site' is a generic term rather than a specific recovery readiness level.