Free SY0-701 practice questions

A logistics company is retiring forty laptops that previously held delivery manifests and payroll files. The IT manager wants the drives processed so that the data cannot be recovered even by a forensic lab, but the chassis themselves will be donated to a local charity in working order. Which disposal action best meets both requirements?

• ARun a quick format from the operating system installer on each laptop before handing the units over to the charity.
• BPerform a vendor-certified cryptographic erase or multi-pass overwrite of each drive, then verify and document the sanitisation before donation.check_circle Correct
• CPhysically shred each drive in an approved media destruction bin and pass the laptops on with the empty drive bays.
• DDelete the user profiles, empty the recycle bin, and rely on full disk encryption being enabled at the time of donation.

Why A is wrong: A quick format only rewrites filesystem metadata and leaves the underlying sectors intact, so commodity recovery tools can restore the manifests and payroll files. It is tempting because it appears to wipe the disk, but it does not satisfy the forensic non-recoverability requirement.

Why B is correct: A certified cryptographic erase or NIST-aligned multi-pass overwrite destroys the readable contents of the drive while leaving the hardware usable, and the verified certificate of sanitisation supports an auditable chain of custody. This satisfies both the non-recoverability and the working-order requirements.

Why C is wrong: Shredding does destroy the data beyond forensic recovery, but it also removes the storage that makes the laptops functional, so the charity would receive incomplete units. The requirement is to keep the chassis in working order, which this approach breaks.

Why D is wrong: Deleting profiles and emptying the recycle bin leaves the underlying data blocks recoverable, and an unrevoked encryption key on a donated machine still permits decryption by the recipient. Candidates may pick this because encryption sounds protective, but without key destruction it does not sanitise the drive.

During an incident review at a regional council, the security team finds that a compromised server in the data centre had no recorded owner, no business function description, and no entry in the configuration management database. Patching and monitoring had quietly lapsed because no team considered the host theirs. Which asset management activity, if it had been in place, would most directly have prevented this situation?

• ARunning an annual external penetration test against the council's internet-facing services and tracking remediation in a ticket queue.
• BBuying an extended detection and response platform that ingests endpoint telemetry across the data centre estate.
• CMaintaining an authoritative asset inventory in which every host has a recorded business owner and recorded function.check_circle Correct
• DEncrypting all server volumes at rest and rotating the underlying keys on a fixed quarterly schedule.

Why A is wrong: An annual penetration test may surface a missing patch on the host, but it does not establish who owns the asset or who should act on findings. Candidates may pick this because testing finds vulnerabilities, but it does not address the orphaned-asset root cause.

Why B is wrong: Endpoint telemetry would have raised alerts during the compromise but does nothing to ensure that a known team is accountable for the host before an incident. It is a control on top of inventory, not a substitute for it.

Why C is correct: An authoritative inventory that assigns ownership and function to each host removes the ambiguity that allowed the server to drift, because patching, monitoring, and renewal responsibilities can then be tied to a named team. This is the activity that most directly closes the gap exposed by the incident.

Why D is wrong: Volume encryption protects data confidentiality if the disk is stolen or improperly disposed of, but it does not assign an owner or prevent the patching and monitoring lapses that allowed the host to be compromised in the first place.

A solicitors' practice is decommissioning a stack of solid state drives that previously held client matter files. The information security manager wants the chosen sanitisation method to align with how solid state drives store data internally, given that simple sector overwrites are known to be unreliable on this media type. Which approach should she select for the bulk of the drives?

• AIssue the drive's built-in cryptographic erase command so that the internal media encryption key is destroyed and the remaining ciphertext becomes unreadable.check_circle Correct
• BUse a legacy seven-pass magnetic overwrite utility because additional passes increase the certainty that every cell is cleared on flash media.
• CDelete all visible partitions through the operating system disk manager and then create a new empty partition before redeployment.
• DApply a strong demagnetiser to each solid state drive in turn to scramble the residual stored data before the units leave the building.

Why A is correct: Self-encrypting solid state drives store all data as ciphertext and reveal it only through an internal media encryption key. Destroying that key with the drive's cryptographic erase command renders the ciphertext unrecoverable in a single fast operation, which NIST SP 800-88 recognises as an appropriate sanitisation technique for flash storage.

Why B is wrong: Multi-pass overwrite patterns were designed for magnetic platters and provide little additional assurance on flash media, where wear levelling and over-provisioned cells mean some blocks are never addressed by the host. Candidates may pick this because more passes sound safer, but it is the wrong tool for this media type.

Why C is wrong: Deleting and recreating partitions only updates the partition table and leaves the underlying cells populated with the original data. It is tempting because the drive appears empty afterwards, but routine recovery utilities can still read the residual blocks.

Why D is wrong: Degaussing relies on magnetic flux to disrupt stored bits, which works on tape and platter media but has no effect on the flash cells used in solid state drives. Candidates may select this because degaussing is associated with secure disposal generally, but it is not a valid sanitisation method for this media.

A marketing team frustrated by slow IT procurement signs up for a third-party analytics SaaS using a corporate credit card and uploads customer contact lists to it. The security team only learns about the service after a data protection audit. Which risk category does this situation most directly illustrate?

• AShadow IT, where business units adopt unsanctioned technology that bypasses security and governance review.check_circle Correct
• BAn advanced persistent threat campaign carried out by a sophisticated external nation-state intrusion set.
• CA malicious insider deliberately exfiltrating sensitive records to harm the employer's reputation and revenue.
• DHacktivism in which ideologically driven outsiders pressure the organisation by leaking confidential customer details online.

Why A is correct: Marketing procured and used a SaaS outside the formal IT process, which is the textbook definition of shadow IT and the source of unmanaged data exposure.

Why B is wrong: APT campaigns involve covert external attackers exploiting systems, not authorised employees openly buying a SaaS subscription with corporate funds for daily marketing tasks.

Why C is wrong: Tempting because data left the perimeter, but the marketing team's intent was operational efficiency rather than sabotage, which distinguishes shadow IT from a malicious insider.

Why D is wrong: No external ideologically motivated party is involved and no public leak has occurred, so the scenario does not match hacktivist behaviour or motivation.

A regional water utility's SCADA network is breached by an attacker who patiently maintains access for months, exfiltrates engineering diagrams, and tampers with no production processes. Forensics traces the operation to infrastructure linked to a foreign military intelligence unit. Which threat actor category best fits the adversary in this incident?

• AAn organised cybercrime gang motivated by extorting the utility through a ransomware payout demand.
• BA hacktivist collective protesting the utility's environmental record through public defacement actions.
• CA disgruntled insider abusing valid credentials to harvest confidential project files for personal use.
• DA nation-state actor conducting cyber espionage to map critical infrastructure for future leverage.check_circle Correct

Why A is wrong: Tempting because utilities are common ransomware targets, but the long dwell time, lack of disruption, and theft of engineering diagrams point to espionage rather than financially motivated extortion.

Why B is wrong: Hacktivists seek visibility and publicity for a cause, so they would deface sites or leak data publicly rather than quietly steal schematics for months.

Why C is wrong: An insider scenario is plausible at utilities, but forensics here points to external foreign infrastructure rather than a current employee acting from within the network.

Why D is correct: Long-term stealthy access, theft of engineering data, and attribution to a foreign military intelligence unit are hallmarks of nation-state espionage against critical infrastructure.

An energy company's public website is defaced with banners criticising its fossil fuel investments, and the attackers publish an open letter on social media demanding the firm divest. No data is encrypted and no ransom is requested. Which threat actor motivation best explains this attack?

• AFinancial gain, achieved by quietly monetising stolen records through underground criminal marketplaces.
• BHacktivism, where ideologically motivated actors use cyber means to publicise a political or social cause.check_circle Correct
• CEspionage, focused on long-term covert collection of proprietary research and operational intelligence.
• DRevenge by a recently terminated employee seeking to embarrass the former employer through visible disruption.

Why A is wrong: There is no extortion demand, no data theft for resale, and no ransomware payload, so financial motivation does not fit the public protest pattern observed.

Why B is correct: Web defacement combined with public demands tied to a social or environmental cause is the defining behaviour of hacktivist threat actors.

Why C is wrong: Espionage actors avoid drawing attention, but the attackers here loudly publicise their actions, which is incompatible with covert intelligence gathering objectives.

Why D is wrong: Tempting because defacement can feel personal, but the public ideological messaging and policy demands align with activism rather than an individual insider grievance.

A regional building society's incident review finds that engineers across three teams handled a recent ransomware outbreak inconsistently: one team wiped a compromised laptop before evidence was preserved, another paused containment to seek written approval that never arrived, and a third made firewall changes without recording them. The chief information security officer wants the governance artefact that most directly fixes this inconsistency by prescribing the exact step-by-step actions every responder must take, in order, for a ransomware event. Which artefact should she commission first?

• AA board-approved information security policy that states the firm will respond to ransomware in a timely and proportionate manner.
• BA written ransomware response procedure that lists the ordered steps for triage, isolation, evidence preservation, approval gates, and communications, mapped to named roles.check_circle Correct
• CAn industry standard such as ISO/IEC 27035 referenced in the security manual as the firm's accepted approach to incident management.
• DA governance committee charter that assigns the chief information security officer accountability for ransomware preparedness across the group.

Why A is wrong: A policy expresses managerial intent and accountability at a high level; it does not prescribe the ordered operational steps responders need, which is exactly the gap the incident review surfaced.

Why B is correct: Procedures translate policy and standards into the ordered, role-tagged actions responders execute; this directly removes the inconsistency by giving every team the same numbered runbook for a ransomware event.

Why C is wrong: A standard sets the criteria a programme should meet and is tempting because it carries authority, but it stops short of the ordered ransomware-specific actions a responder follows at 02:00 in the morning.

Why D is wrong: A charter clarifies who is accountable at the governance layer, which is useful, but it does not tell the engineer on shift which command to run before pulling a network cable on an infected host.

A retail group's new chief information security officer finds that security decisions are made ad hoc: the chief technology officer approves a cloud move with no security input, the head of internal audit blocks a deployment on the morning of go-live, and the data protection officer learns of a customer analytics project from a press release. The board has asked her to recommend the governance structure that most directly addresses the root cause by giving security a standing forum to advise on strategy, review material change, and report risk upward. Which recommendation should she make?

• APublish a security policy stating that every material change must be reviewed for security implications before approval.
• BHire additional security architects and embed one in each business unit so security advice is available on demand.
• CStand up a cross-functional security steering committee that meets monthly with representation from technology, audit, legal, data protection, and business lines, and that reports to the board risk committee.check_circle Correct
• DSubscribe to an external advisory service that provides quarterly briefings to the chief information security officer on emerging security risks.

Why A is wrong: A policy is tempting because it names the requirement, but a written statement does not create the forum or the membership needed to actually perform the review and the same ad hoc behaviour will continue.

Why B is wrong: Embedding architects increases capacity to give advice but does not establish a governance structure for collective oversight; advice given one to one is still ad hoc and does not give the board a consolidated view.

Why C is correct: A standing steering committee with the right membership is the recognised governance structure for cross-functional security oversight; it gives a single forum to advise on strategy, review change, and escalate risk through a defined route to the board.

Why D is wrong: External advisory is useful for environmental awareness but does not establish an internal forum to advise on strategy, review change, or escalate risk, which is the structural gap the board identified.

A logistics firm's audit shows that a customer database breach went undetected for seven weeks because patching was assumed to be the database administrator's job, vulnerability scanning was assumed to be the security operations team's job, and risk acceptance was assumed to be the chief information officer's job. None of these assumptions appeared in writing, and each team believed another team owned the workflow. The governance lead must recommend the artefact that most directly prevents this class of failure recurring across the estate. Which recommendation should she make?

• APublish a RACI matrix for each critical security workflow that records, by name or role, who is responsible, accountable, consulted, and informed.check_circle Correct
• BMandate that all security tasks be added to the chief information security officer's reporting line so a single owner is accountable end to end.
• CAdopt an external framework such as NIST CSF and refer staff to its functions when a question of ownership arises.
• DHold a quarterly all-hands meeting in which each team describes the work it currently owns so the others are aware.

Why A is correct: A documented RACI removes the assumption-driven gaps observed in the incident by stating in writing who performs the work, who owns the outcome, and who must be consulted or informed across every critical workflow.

Why B is wrong: Concentrating every task under the CISO is tempting because it appears to remove ambiguity, but it confuses accountability with execution and overloads one role; the failure was lack of documented split, not lack of central ownership.

Why C is wrong: A framework structures the programme but does not record who in this organisation performs each task; staff still need an internal mapping from framework function to named role, which is exactly the artefact missing here.

Why D is wrong: Verbal awareness fades and is not auditable; the next person joining a team inherits the same assumption gap, so this does not durably prevent the failure from recurring.

A regional water utility is planning a hybrid architecture that keeps its industrial control system network for pumping stations on-premises while migrating corporate email, finance, and customer billing to a public cloud provider. The two environments will be joined by a site-to-site VPN and a shared identity provider. The security architect must explain to executives which design decision most directly addresses the distinctive risk that this hybrid arrangement introduces, given that the on-premises segment hosts legacy ICS and SCADA equipment with long patch cycles and limited authentication capability. Which design choice best mitigates the dominant hybrid risk in this scenario?

• APlace a tightly controlled industrial demilitarised zone with unidirectional or strictly filtered gateways between the on-premises ICS network and the routes that reach the cloud-hosted corporate services, so that traffic into the control network is constrained to known protocols, sources, and destinations.check_circle Correct
• BExtend the corporate Active Directory trust into the ICS network so that engineers can use the same cloud-federated credentials on pumping station historians, reducing password reuse and simplifying joiner-mover-leaver processes for plant staff.
• CMove the SCADA historian database into the public cloud alongside the billing system so that the utility benefits from the cloud provider's patching, redundancy, and managed database hardening for all process data going forward.
• DReplace the site-to-site VPN with direct public internet exposure of the ICS management interfaces protected only by strong passwords and multifactor authentication, since modern authentication compensates for the lack of network controls in front of plant equipment.

Why A is correct: Hybrid architectures concentrate risk at the seam where corporate and cloud zones meet the brittle ICS estate; an industrial DMZ with unidirectional or tightly filtered gateways enforces ISA/IEC 62443 zone separation and stops cloud or corporate compromise from pivoting onto pumping station controllers.

Why B is wrong: Pushing federated corporate identity directly onto fragile ICS hosts widens the blast radius of any cloud or corporate credential compromise into the operational technology zone; this is the opposite of what the Purdue-style separation between IT and OT calls for.

Why C is wrong: Relocating the historian to the cloud and exposing it to internet-reachable services raises confidentiality, integrity, and availability risk for safety-relevant process data, and many regulators explicitly require process data to remain within the operational technology boundary.

Why D is wrong: Publishing ICS management interfaces to the internet is precisely the exposure pattern that Shodan-style scans and prior ICS incidents have shown to be catastrophic; authentication alone cannot compensate for missing perimeter and segmentation controls in front of legacy controllers.

A logistics start-up is rebuilding its order processing platform as a set of small services deployed independently to a Kubernetes cluster. Each service has its own database, owns one bounded context, and communicates with peers over authenticated REST and gRPC. The chief information security officer is briefing the board on how this microservices model changes the firm's security posture compared with the previous single Java monolith. Which statement best captures a distinctive security implication of moving to microservices rather than retaining the monolith?

• AThe microservices design eliminates the need for network segmentation because each service runs in its own container and is therefore isolated from peers by default at the operating system level.
• BPatching cycles can be relaxed because each microservice is small enough that a compromise is contained within that service's container and cannot affect data owned by other services in the platform.
• CCentralised audit logging becomes simpler because every microservice writes to the same application log file and the team can rely on a single chain of custody across the whole order processing workflow.
• DThe east-west attack surface grows because authentication, authorisation, and transport security must now be enforced on every inter-service call instead of relying on a single process boundary, which usually requires mutual TLS, service identities, and per-service policy.check_circle Correct

Why A is wrong: Container runtimes share a host kernel and a flat pod network unless deliberate network policies, service meshes, or namespaces enforce segmentation; assuming default isolation is a common misconception that leaves east-west traffic wide open.

Why B is wrong: A compromised service is often a stepping stone to peers via service tokens, shared secrets, or excessive RBAC; smaller blast radius is a goal, not an automatic property, and patching cadence must in fact rise because each service brings its own dependency tree.

Why C is wrong: Microservices typically emit logs from many pods to a shared pipeline, so achieving an end-to-end audit trail requires correlation IDs, distributed tracing, and centralised log aggregation; assuming a single log file is exactly the legacy mindset that microservice adoption breaks.

Why D is correct: Splitting a monolith into independently deployable services replaces in-process calls with network calls, so each hop must be authenticated, authorised, and encrypted; defenders typically introduce a service mesh, workload identities, and per-service policy to control the expanded east-west attack surface.

A regional manufacturer runs a flat /16 office network where engineering workstations, finance servers, and a fleet of unmanaged programmable logic controllers all sit in the same broadcast domain. After a ransomware incident in which a single infected laptop reached the controllers within minutes, the security architect must redesign the network so that lateral movement between the office, the finance estate, and the plant floor requires traversing a policy enforcement point that inspects traffic by source, destination, and application. Budget allows for one new control to be introduced. Which design most directly meets this objective?

• ASplit the existing /16 into smaller /24 subnets so each department gets its own broadcast domain, and rely on the existing layer two switches to keep traffic local to each VLAN until it reaches the core router.
• BDeploy internal firewalls between three new security zones (office, finance, plant) so that inter-zone traffic is filtered by source, destination, port, and application, while intra-zone traffic continues to use the existing switching fabric.check_circle Correct
• CInstall a host-based firewall on every workstation and server with a default deny inbound rule, leaving the existing flat network untouched so that policy enforcement happens at the endpoint rather than in the network fabric.
• DReplace the office wireless with WPA3 Enterprise and enable 802.1X port-based authentication on every access switch so that only known devices receive an IP address, while the layer three topology of the network remains unchanged.

Why A is wrong: Splitting broadcast domains reduces broadcast noise and is tempting because it is described as segmentation in many introductory texts, but routed traffic between the new subnets still flows through a switch fabric with no inspection policy, so a compromised laptop can still reach finance servers and controllers across the routed core.

Why B is correct: Internal segmentation firewalls between trust zones enforce policy on every inter-zone flow by source, destination, port, and application, which is exactly the control the scenario asks for and directly constrains lateral movement from a compromised office host into finance or plant systems.

Why C is wrong: Host-based firewalls add useful endpoint policy and are tempting because they appear cheap, but unmanaged controllers cannot run them, exceptions tend to accumulate, and a single misconfigured or disabled host leaves the flat plant network reachable, so the architectural goal of a central inspected boundary is not met.

Why D is wrong: Strong authentication and port-based access control raise the bar for getting onto the network and are tempting because they sound like segmentation in marketing material, but an authenticated yet compromised laptop is still on the same flat fabric as finance and plant systems, so the lateral movement path the architect must close is left open.

A hospital's electronic health record system goes offline for four hours during a ransomware incident, blocking clinicians from reading patient charts. Which pillar of the CIA triad is most directly impacted by this outage?

• AAvailability, because authorised users were unable to access the data when needed.check_circle Correct
• BConfidentiality, because clinicians could not see records they are authorised to view.
• CIntegrity, because the records could not be trusted to be accurate during the outage.
• DNon-repudiation, because the source of the records could not be verified during the outage.

Why A is correct: Availability is the assurance that authorised users can reach systems and data when required. A four-hour outage that blocks clinical access is the textbook impact on availability.

Why B is wrong: Confidentiality concerns unauthorised disclosure, not denial of access to authorised users. The incident may also affect confidentiality if data was exfiltrated, but the four-hour read outage described is fundamentally an availability problem, so this is the wrong best fit.

Why C is wrong: Integrity concerns unauthorised modification or corruption of data. The scenario describes inability to reach the records, not altered content, so integrity is a tempting but incorrect choice.

Why D is wrong: Non-repudiation prevents a party from denying an action they performed and is usually achieved through digital signatures and logging. It is not the pillar harmed by a system being offline, so this option is incorrect.

A facilities team is tagging each safeguard at a regional office by control type, sorting them into technical, managerial, operational, and physical categories. Which TWO of the following belong in the physical control category? Select TWO.

• AA documented acceptable use policy that staff must sign before they are issued a laptop and network account.
• BA set of bollards and a vehicle barrier arm at the entrance to the staff car park beside the building.check_circle Correct
• CA firewall ruleset that blocks inbound traffic to the office subnet from untrusted external addresses.
• DA weekly rota assigning staff to review yesterday's building access logs for unusual entries.
• EA reinforced security door fitted with a mechanical deadbolt on the server room.check_circle Correct

Why A is wrong: A signed policy looks like a real safeguard, but a written rule that governs behaviour is a managerial control, not a physical one, because it imposes no tangible barrier.

Why B is correct: Bollards and a barrier arm are tangible objects in the environment that physically obstruct vehicles, which is the defining property of a physical control.

Why C is wrong: A firewall ruleset is enforced by hardware or software logic, so it is a technical control even though it sits at the network boundary and feels like a wall.

Why D is wrong: A review rota is people carrying out a recurring process, which makes it an operational control rather than a physical object that blocks or deters entry.

Why E is correct: A reinforced door and deadbolt are physical hardware that mechanically prevent entry to a space, which places them squarely in the physical control category.

A finance manager denies approving a large supplier payment, but the workflow tool shows the approval was made using her smart card and signed with her private key, with a tamper-evident audit log. Which fundamental security concept does this control set most directly support?

• AConfidentiality, because the smart card encrypts the approval so only authorised parties can read it.
• BNon-repudiation, because the cryptographic signature and audit trail prevent her from credibly denying the approval.check_circle Correct
• CAvailability, because the workflow tool ensures the approval is always accessible to auditors.
• DAuthorisation, because the smart card grants the manager permission to approve the payment.

Why A is wrong: Smart cards can encrypt data, but the question is about the manager denying she approved the transaction, not about preventing disclosure. Confidentiality is a plausible but wrong fit.

Why B is correct: Non-repudiation is provided by binding an action to an identity through a unique authenticator, such as a private key on a smart card, plus a trustworthy log. The scenario is the textbook use case.

Why C is wrong: Availability concerns timely access for authorised users. The control described is about proving who acted, not about keeping the system reachable, so this is tempting but incorrect.

Why D is wrong: Authorisation decides what an authenticated identity is permitted to do. The scenario centres on proving the action occurred and tying it to the manager, which is non-repudiation rather than authorisation.