Free SY0-701 practice questions

A logistics company is retiring forty laptops that previously held delivery manifests and payroll files. The IT manager wants the drives processed so that the data cannot be recovered even by a forensic lab, but the chassis themselves will be donated to a local charity in working order. Which disposal action best meets both requirements?

• ARun a quick format from the operating system installer on each laptop before handing the units over to the charity.
• BPerform a vendor-certified cryptographic erase or multi-pass overwrite of each drive, then verify and document the sanitisation before donation.check_circle Correct
• CPhysically shred each drive in an approved media destruction bin and pass the laptops on with the empty drive bays.
• DDelete the user profiles, empty the recycle bin, and rely on full disk encryption being enabled at the time of donation.

Why A is wrong: A quick format only rewrites filesystem metadata and leaves the underlying sectors intact, so commodity recovery tools can restore the manifests and payroll files. It is tempting because it appears to wipe the disk, but it does not satisfy the forensic non-recoverability requirement.

Why B is correct: A certified cryptographic erase or NIST-aligned multi-pass overwrite destroys the readable contents of the drive while leaving the hardware usable, and the verified certificate of sanitisation supports an auditable chain of custody. This satisfies both the non-recoverability and the working-order requirements.

Why C is wrong: Shredding does destroy the data beyond forensic recovery, but it also removes the storage that makes the laptops functional, so the charity would receive incomplete units. The requirement is to keep the chassis in working order, which this approach breaks.

Why D is wrong: Deleting profiles and emptying the recycle bin leaves the underlying data blocks recoverable, and an unrevoked encryption key on a donated machine still permits decryption by the recipient. Candidates may pick this because encryption sounds protective, but without key destruction it does not sanitise the drive.

During an incident review at a regional council, the security team finds that a compromised server in the data centre had no recorded owner, no business function description, and no entry in the configuration management database. Patching and monitoring had quietly lapsed because no team considered the host theirs. Which asset management activity, if it had been in place, would most directly have prevented this situation?

• ARunning an annual external penetration test against the council's internet-facing services and tracking remediation in a ticket queue.
• BBuying an extended detection and response platform that ingests endpoint telemetry across the data centre estate.
• CMaintaining an authoritative asset inventory in which every host has a recorded business owner and recorded function.check_circle Correct
• DEncrypting all server volumes at rest and rotating the underlying keys on a fixed quarterly schedule.

Why A is wrong: An annual penetration test may surface a missing patch on the host, but it does not establish who owns the asset or who should act on findings. Candidates may pick this because testing finds vulnerabilities, but it does not address the orphaned-asset root cause.

Why B is wrong: Endpoint telemetry would have raised alerts during the compromise but does nothing to ensure that a known team is accountable for the host before an incident. It is a control on top of inventory, not a substitute for it.

Why C is correct: An authoritative inventory that assigns ownership and function to each host removes the ambiguity that allowed the server to drift, because patching, monitoring, and renewal responsibilities can then be tied to a named team. This is the activity that most directly closes the gap exposed by the incident.

Why D is wrong: Volume encryption protects data confidentiality if the disk is stolen or improperly disposed of, but it does not assign an owner or prevent the patching and monitoring lapses that allowed the host to be compromised in the first place.

A procurement officer at a hospital is about to sign a purchase order for two hundred clinician tablets from a low-cost overseas reseller that is offering a sixty percent discount over the approved supplier. The security manager is asked to advise. Which aspect of acquisition and procurement should most strongly drive the decision before the order is placed?

• AWhether the reseller can deliver all two hundred tablets within four weeks so that the clinical rollout schedule is not delayed.
• BWhether the reseller offers an extended on-site repair warranty that includes free battery replacement during the first year of use.
• CWhether the reseller's quote includes accessories such as protective cases and screen protectors at no additional charge.
• DWhether the reseller is an authorised channel partner with a verifiable supply chain so the tablets carry genuine firmware and security updates from the manufacturer.check_circle Correct

Why A is wrong: Delivery time is a real project consideration, but it is an operational milestone rather than a security property of the asset. Candidates may pick this because procurement officers care about timelines, but it does not address the integrity or provenance of the devices entering the estate.

Why B is wrong: An extended warranty improves total cost of ownership and reduces downtime, but it does not establish that the tablets themselves are genuine, untampered, or eligible for vendor security patches. It is tempting because warranties feel risk-reducing, but the risk it reduces is financial rather than security.

Why C is wrong: Bundled accessories may make the offer financially attractive, but they have no bearing on whether the tablets can be trusted on a clinical network. This option appeals to a value-for-money instinct and is clearly not a security consideration.

Why D is correct: Buying from an unauthorised channel risks counterfeit or tampered units, missing firmware updates, and no manufacturer warranty support, all of which become exposures the moment the tablets reach the clinical floor. Verifying that the reseller is an authorised channel partner with a checkable supply chain directly addresses the dominant procurement-time security concern.

A regional water utility's SCADA network is breached by an attacker who patiently maintains access for months, exfiltrates engineering diagrams, and tampers with no production processes. Forensics traces the operation to infrastructure linked to a foreign military intelligence unit. Which threat actor category best fits the adversary in this incident?

• AAn organised cybercrime gang motivated by extorting the utility through a ransomware payout demand.
• BA hacktivist collective protesting the utility's environmental record through public defacement actions.
• CA disgruntled insider abusing valid credentials to harvest confidential project files for personal use.
• DA nation-state actor conducting cyber espionage to map critical infrastructure for future leverage.check_circle Correct

Why A is wrong: Tempting because utilities are common ransomware targets, but the long dwell time, lack of disruption, and theft of engineering diagrams point to espionage rather than financially motivated extortion.

Why B is wrong: Hacktivists seek visibility and publicity for a cause, so they would deface sites or leak data publicly rather than quietly steal schematics for months.

Why C is wrong: An insider scenario is plausible at utilities, but forensics here points to external foreign infrastructure rather than a current employee acting from within the network.

Why D is correct: Long-term stealthy access, theft of engineering data, and attribution to a foreign military intelligence unit are hallmarks of nation-state espionage against critical infrastructure.

A marketing team frustrated by slow IT procurement signs up for a third-party analytics SaaS using a corporate credit card and uploads customer contact lists to it. The security team only learns about the service after a data protection audit. Which risk category does this situation most directly illustrate?

• AShadow IT, where business units adopt unsanctioned technology that bypasses security and governance review.check_circle Correct
• BAn advanced persistent threat campaign carried out by a sophisticated external nation-state intrusion set.
• CA malicious insider deliberately exfiltrating sensitive records to harm the employer's reputation and revenue.
• DHacktivism in which ideologically driven outsiders pressure the organisation by leaking confidential customer details online.

Why A is correct: Marketing procured and used a SaaS outside the formal IT process, which is the textbook definition of shadow IT and the source of unmanaged data exposure.

Why B is wrong: APT campaigns involve covert external attackers exploiting systems, not authorised employees openly buying a SaaS subscription with corporate funds for daily marketing tasks.

Why C is wrong: Tempting because data left the perimeter, but the marketing team's intent was operational efficiency rather than sabotage, which distinguishes shadow IT from a malicious insider.

Why D is wrong: No external ideologically motivated party is involved and no public leak has occurred, so the scenario does not match hacktivist behaviour or motivation.

An energy company's public website is defaced with banners criticising its fossil fuel investments, and the attackers publish an open letter on social media demanding the firm divest. No data is encrypted and no ransom is requested. Which threat actor motivation best explains this attack?

• AFinancial gain, achieved by quietly monetising stolen records through underground criminal marketplaces.
• BHacktivism, where ideologically motivated actors use cyber means to publicise a political or social cause.check_circle Correct
• CEspionage, focused on long-term covert collection of proprietary research and operational intelligence.
• DRevenge by a recently terminated employee seeking to embarrass the former employer through visible disruption.

Why A is wrong: There is no extortion demand, no data theft for resale, and no ransomware payload, so financial motivation does not fit the public protest pattern observed.

Why B is correct: Web defacement combined with public demands tied to a social or environmental cause is the defining behaviour of hacktivist threat actors.

Why C is wrong: Espionage actors avoid drawing attention, but the attackers here loudly publicise their actions, which is incompatible with covert intelligence gathering objectives.

Why D is wrong: Tempting because defacement can feel personal, but the public ideological messaging and policy demands align with activism rather than an individual insider grievance.

A regional building society's incident review finds that engineers across three teams handled a recent ransomware outbreak inconsistently: one team wiped a compromised laptop before evidence was preserved, another paused containment to seek written approval that never arrived, and a third made firewall changes without recording them. The chief information security officer wants the governance artefact that most directly fixes this inconsistency by prescribing the exact step-by-step actions every responder must take, in order, for a ransomware event. Which artefact should she commission first?

• AA board-approved information security policy that states the firm will respond to ransomware in a timely and proportionate manner.
• BA written ransomware response procedure that lists the ordered steps for triage, isolation, evidence preservation, approval gates, and communications, mapped to named roles.check_circle Correct
• CAn industry standard such as ISO/IEC 27035 referenced in the security manual as the firm's accepted approach to incident management.
• DA governance committee charter that assigns the chief information security officer accountability for ransomware preparedness across the group.

Why A is wrong: A policy expresses managerial intent and accountability at a high level; it does not prescribe the ordered operational steps responders need, which is exactly the gap the incident review surfaced.

Why B is correct: Procedures translate policy and standards into the ordered, role-tagged actions responders execute; this directly removes the inconsistency by giving every team the same numbered runbook for a ransomware event.

Why C is wrong: A standard sets the criteria a programme should meet and is tempting because it carries authority, but it stops short of the ordered ransomware-specific actions a responder follows at 02:00 in the morning.

Why D is wrong: A charter clarifies who is accountable at the governance layer, which is useful, but it does not tell the engineer on shift which command to run before pulling a network cable on an infected host.

A retail group's new chief information security officer finds that security decisions are made ad hoc: the chief technology officer approves a cloud move with no security input, the head of internal audit blocks a deployment on the morning of go-live, and the data protection officer learns of a customer analytics project from a press release. The board has asked her to recommend the governance structure that most directly addresses the root cause by giving security a standing forum to advise on strategy, review material change, and report risk upward. Which recommendation should she make?

• APublish a security policy stating that every material change must be reviewed for security implications before approval.
• BHire additional security architects and embed one in each business unit so security advice is available on demand.
• CStand up a cross-functional security steering committee that meets monthly with representation from technology, audit, legal, data protection, and business lines, and that reports to the board risk committee.check_circle Correct
• DSubscribe to an external advisory service that provides quarterly briefings to the chief information security officer on emerging security risks.

Why A is wrong: A policy is tempting because it names the requirement, but a written statement does not create the forum or the membership needed to actually perform the review and the same ad hoc behaviour will continue.

Why B is wrong: Embedding architects increases capacity to give advice but does not establish a governance structure for collective oversight; advice given one to one is still ad hoc and does not give the board a consolidated view.

Why C is correct: A standing steering committee with the right membership is the recognised governance structure for cross-functional security oversight; it gives a single forum to advise on strategy, review change, and escalate risk through a defined route to the board.

Why D is wrong: External advisory is useful for environmental awareness but does not establish an internal forum to advise on strategy, review change, or escalate risk, which is the structural gap the board identified.

An Australian-headquartered health insurer is launching a customer wellness app that will collect heart-rate readings and lifestyle answers from members in Australia, Singapore, and the United Kingdom. The product lead wants to host the entire workload in a single Sydney cloud region and use one privacy notice for all markets to keep the build simple. The security governance lead must explain to the executive sponsor which regulatory consideration most directly constrains that proposal before development begins. Which consideration should she put first on the agenda?

• AThe cloud provider's standard contract already covers regulatory compliance in every region where it has a data centre, so the team can rely on the provider's certifications.
• BHosting in Sydney puts the data inside Australia's legal boundary, which automatically satisfies the requirements of the United Kingdom and Singapore for their residents' records.
• CIndustry standards such as ISO/IEC 27701 are sufficient evidence of compliance with national privacy laws for health data in all three countries.
• DEach jurisdiction imposes its own privacy and health-data regulations whose lawful basis, consent, transfer, and breach-notification rules must be assessed before a single design and notice can be assumed.check_circle Correct

Why A is wrong: Provider certifications attest to provider-side controls, not to the customer's regulatory obligations as a data controller; relying on them is a common but mistaken way to avoid the per-jurisdiction analysis.

Why B is wrong: Data location is one input to a transfer analysis but does not by itself satisfy the obligations a UK or Singapore resident's data attracts under UK GDPR or the Singapore PDPA; the laws follow the data subject, not just the storage location.

Why C is wrong: ISO/IEC 27701 supports a privacy management system but is not a substitute for statutory compliance; a certified programme can still breach a specific national health-data law if the lawful basis or consent model is wrong.

Why D is correct: Hosting the workload in one region does not exempt the insurer from the laws of the jurisdictions whose residents the data describes; the governance task is a per-jurisdiction regulatory analysis before any single-notice or single-region simplification is locked in.

A logistics start-up is rebuilding its order processing platform as a set of small services deployed independently to a Kubernetes cluster. Each service has its own database, owns one bounded context, and communicates with peers over authenticated REST and gRPC. The chief information security officer is briefing the board on how this microservices model changes the firm's security posture compared with the previous single Java monolith. Which statement best captures a distinctive security implication of moving to microservices rather than retaining the monolith?

• AThe microservices design eliminates the need for network segmentation because each service runs in its own container and is therefore isolated from peers by default at the operating system level.
• BPatching cycles can be relaxed because each microservice is small enough that a compromise is contained within that service's container and cannot affect data owned by other services in the platform.
• CCentralised audit logging becomes simpler because every microservice writes to the same application log file and the team can rely on a single chain of custody across the whole order processing workflow.
• DThe east-west attack surface grows because authentication, authorisation, and transport security must now be enforced on every inter-service call instead of relying on a single process boundary, which usually requires mutual TLS, service identities, and per-service policy.check_circle Correct

Why A is wrong: Container runtimes share a host kernel and a flat pod network unless deliberate network policies, service meshes, or namespaces enforce segmentation; assuming default isolation is a common misconception that leaves east-west traffic wide open.

Why B is wrong: A compromised service is often a stepping stone to peers via service tokens, shared secrets, or excessive RBAC; smaller blast radius is a goal, not an automatic property, and patching cadence must in fact rise because each service brings its own dependency tree.

Why C is wrong: Microservices typically emit logs from many pods to a shared pipeline, so achieving an end-to-end audit trail requires correlation IDs, distributed tracing, and centralised log aggregation; assuming a single log file is exactly the legacy mindset that microservice adoption breaks.

Why D is correct: Splitting a monolith into independently deployable services replaces in-process calls with network calls, so each hop must be authenticated, authorised, and encrypted; defenders typically introduce a service mesh, workload identities, and per-service policy to control the expanded east-west attack surface.

A regional water utility is planning a hybrid architecture that keeps its industrial control system network for pumping stations on-premises while migrating corporate email, finance, and customer billing to a public cloud provider. The two environments will be joined by a site-to-site VPN and a shared identity provider. The security architect must explain to executives which design decision most directly addresses the distinctive risk that this hybrid arrangement introduces, given that the on-premises segment hosts legacy ICS and SCADA equipment with long patch cycles and limited authentication capability. Which design choice best mitigates the dominant hybrid risk in this scenario?

• APlace a tightly controlled industrial demilitarised zone with unidirectional or strictly filtered gateways between the on-premises ICS network and the routes that reach the cloud-hosted corporate services, so that traffic into the control network is constrained to known protocols, sources, and destinations.check_circle Correct
• BExtend the corporate Active Directory trust into the ICS network so that engineers can use the same cloud-federated credentials on pumping station historians, reducing password reuse and simplifying joiner-mover-leaver processes for plant staff.
• CMove the SCADA historian database into the public cloud alongside the billing system so that the utility benefits from the cloud provider's patching, redundancy, and managed database hardening for all process data going forward.
• DReplace the site-to-site VPN with direct public internet exposure of the ICS management interfaces protected only by strong passwords and multifactor authentication, since modern authentication compensates for the lack of network controls in front of plant equipment.

Why A is correct: Hybrid architectures concentrate risk at the seam where corporate and cloud zones meet the brittle ICS estate; an industrial DMZ with unidirectional or tightly filtered gateways enforces ISA/IEC 62443 zone separation and stops cloud or corporate compromise from pivoting onto pumping station controllers.

Why B is wrong: Pushing federated corporate identity directly onto fragile ICS hosts widens the blast radius of any cloud or corporate credential compromise into the operational technology zone; this is the opposite of what the Purdue-style separation between IT and OT calls for.

Why C is wrong: Relocating the historian to the cloud and exposing it to internet-reachable services raises confidentiality, integrity, and availability risk for safety-relevant process data, and many regulators explicitly require process data to remain within the operational technology boundary.

Why D is wrong: Publishing ICS management interfaces to the internet is precisely the exposure pattern that Shodan-style scans and prior ICS incidents have shown to be catastrophic; authentication alone cannot compensate for missing perimeter and segmentation controls in front of legacy controllers.

A regional manufacturer runs a flat /16 office network where engineering workstations, finance servers, and a fleet of unmanaged programmable logic controllers all sit in the same broadcast domain. After a ransomware incident in which a single infected laptop reached the controllers within minutes, the security architect must redesign the network so that lateral movement between the office, the finance estate, and the plant floor requires traversing a policy enforcement point that inspects traffic by source, destination, and application. Budget allows for one new control to be introduced. Which design most directly meets this objective?

• ASplit the existing /16 into smaller /24 subnets so each department gets its own broadcast domain, and rely on the existing layer two switches to keep traffic local to each VLAN until it reaches the core router.
• BDeploy internal firewalls between three new security zones (office, finance, plant) so that inter-zone traffic is filtered by source, destination, port, and application, while intra-zone traffic continues to use the existing switching fabric.check_circle Correct
• CInstall a host-based firewall on every workstation and server with a default deny inbound rule, leaving the existing flat network untouched so that policy enforcement happens at the endpoint rather than in the network fabric.
• DReplace the office wireless with WPA3 Enterprise and enable 802.1X port-based authentication on every access switch so that only known devices receive an IP address, while the layer three topology of the network remains unchanged.

Why A is wrong: Splitting broadcast domains reduces broadcast noise and is tempting because it is described as segmentation in many introductory texts, but routed traffic between the new subnets still flows through a switch fabric with no inspection policy, so a compromised laptop can still reach finance servers and controllers across the routed core.

Why B is correct: Internal segmentation firewalls between trust zones enforce policy on every inter-zone flow by source, destination, port, and application, which is exactly the control the scenario asks for and directly constrains lateral movement from a compromised office host into finance or plant systems.

Why C is wrong: Host-based firewalls add useful endpoint policy and are tempting because they appear cheap, but unmanaged controllers cannot run them, exceptions tend to accumulate, and a single misconfigured or disabled host leaves the flat plant network reachable, so the architectural goal of a central inspected boundary is not met.

Why D is wrong: Strong authentication and port-based access control raise the bar for getting onto the network and are tempting because they sound like segmentation in marketing material, but an authenticated yet compromised laptop is still on the same flat fabric as finance and plant systems, so the lateral movement path the architect must close is left open.

A hospital's electronic health record system goes offline for four hours during a ransomware incident, blocking clinicians from reading patient charts. Which pillar of the CIA triad is most directly impacted by this outage?

• AAvailability, because authorised users were unable to access the data when needed.check_circle Correct
• BConfidentiality, because clinicians could not see records they are authorised to view.
• CIntegrity, because the records could not be trusted to be accurate during the outage.
• DNon-repudiation, because the source of the records could not be verified during the outage.

Why A is correct: Availability is the assurance that authorised users can reach systems and data when required. A four-hour outage that blocks clinical access is the textbook impact on availability.

Why B is wrong: Confidentiality concerns unauthorised disclosure, not denial of access to authorised users. The incident may also affect confidentiality if data was exfiltrated, but the four-hour read outage described is fundamentally an availability problem, so this is the wrong best fit.

Why C is wrong: Integrity concerns unauthorised modification or corruption of data. The scenario describes inability to reach the records, not altered content, so integrity is a tempting but incorrect choice.

Why D is wrong: Non-repudiation prevents a party from denying an action they performed and is usually achieved through digital signatures and logging. It is not the pillar harmed by a system being offline, so this option is incorrect.

A finance manager denies approving a large supplier payment, but the workflow tool shows the approval was made using her smart card and signed with her private key, with a tamper-evident audit log. Which fundamental security concept does this control set most directly support?

• AConfidentiality, because the smart card encrypts the approval so only authorised parties can read it.
• BNon-repudiation, because the cryptographic signature and audit trail prevent her from credibly denying the approval.check_circle Correct
• CAvailability, because the workflow tool ensures the approval is always accessible to auditors.
• DAuthorisation, because the smart card grants the manager permission to approve the payment.

Why A is wrong: Smart cards can encrypt data, but the question is about the manager denying she approved the transaction, not about preventing disclosure. Confidentiality is a plausible but wrong fit.

Why B is correct: Non-repudiation is provided by binding an action to an identity through a unique authenticator, such as a private key on a smart card, plus a trustworthy log. The scenario is the textbook use case.

Why C is wrong: Availability concerns timely access for authorised users. The control described is about proving who acted, not about keeping the system reachable, so this is tempting but incorrect.

Why D is wrong: Authorisation decides what an authenticated identity is permitted to do. The scenario centres on proving the action occurred and tying it to the manager, which is non-repudiation rather than authorisation.

A new employee signs in with her username and password, then approves a push prompt on her phone. The system then checks her role and decides she may read invoices but not approve them. Which AAA stage is performing the second check, after authentication has succeeded?

• AIdentification, because the system is matching her username to a stored account.
• BAuthentication, because the push prompt confirms she is who she claims to be.
• CAuthorisation, because role membership determines which actions she is permitted to perform.check_circle Correct
• DAccounting, because the system is recording what she is allowed to do for later review.

Why A is wrong: Identification is when the user first claims an identity, typically by entering a username. It happens before authentication and is not the stage that decides what she may do afterwards.

Why B is wrong: Authentication verifies the claimed identity using factors such as a password plus a push prompt. The question explicitly says this stage has already succeeded, so it is not the answer.

Why C is correct: Authorisation is the AAA stage that enforces what an authenticated identity is allowed to do. Mapping her role to read-only invoice access is a classic authorisation decision.

Why D is wrong: Accounting records what an authenticated user actually does, such as logging the invoice she opened. It is logging, not the permission decision itself, so it is a tempting but wrong choice.