Free SY0-701 flashcards

Why must secure disposal pair data sanitisation with the planned future use of the device chassis?

Secure disposal balances data sanitisation with the future use of the device. Cryptographic erase and verified multi-pass overwrite render data non-recoverable while preserving the drive and chassis for reuse or donation, and the resulting certificate provides documented evidence for the asset record.

A quick format from the OS installer wipes the disk well enough to defeat forensic recovery before donation.

A quick format only rewrites filesystem metadata and leaves the underlying sectors intact, so commodity recovery tools can restore the manifests and payroll files. It appears to wipe the disk but does not satisfy the forensic non-recoverability requirement.

A SCADA breach features months of stealthy access, theft of engineering diagrams, no production tampering, and attribution to a foreign military intelligence unit. Which threat actor category does this fit?

Nation-state actors. They prioritise persistent access, low-noise operations, and intelligence collection over immediate disruption or financial gain. Stealing engineering diagrams from a SCADA environment supports future targeting and strategic leverage, which is the defining motivation of state-sponsored espionage against critical infrastructure operators.

Long dwell time inside a utility network must indicate an organised cybercrime gang preparing a ransomware extortion demand.

Utilities are common ransomware targets, but the long dwell time, lack of disruption, and theft of engineering diagrams point to espionage rather than financially motivated extortion.

Which governance artefact prescribes the exact ordered steps responders must execute during a ransomware incident?

A procedure (runbook). In the governance hierarchy, policies state intent and standards state measurable criteria, but procedures state the ordered actions people must take. Inconsistent operational behaviour during an incident is a procedure gap because no policy or standard reaches the level of telling a responder exactly what to do, in what order, with which approval gates and named roles.

Will a board-approved information security policy fix inconsistent responder behaviour during ransomware events?

No. A policy expresses managerial intent and accountability at a high level; it does not prescribe the ordered operational steps responders need, which is exactly the gap an incident review surfaces when teams handle an outbreak inconsistently.

Why does moving from a monolith to microservices expand the east-west attack surface?

Decomposing a monolith replaces in-process function calls with networked REST or gRPC hops between independently deployed services. Each inter-service call becomes a network request an attacker on the cluster network could observe, replay, or forge. To preserve the implicit guarantees the monolith got for free, defenders must terminate mutual TLS, assign workload identities, enforce per-service authorisation, and apply network policies on every hop.

Do containers isolate microservices from peers by default, removing the need for network segmentation?

No. Container runtimes share a host kernel and a flat pod network unless deliberate network policies, service meshes, or namespaces enforce segmentation. Assuming default isolation is a common misconception that leaves east-west traffic wide open.