Note 25 Oct 2024 at 10_23_43 PM.pdf

SY0-701-Q001 A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access? A. Data masking B. Encryption C. Geolocation...

SY0-701-Q001 A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access? A. Data masking B. Encryption C. Geolocation policy D. Data sovereignty regulation Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q002 Which of the following is a hardware- specific vulnerability? A. Firmware version B. Buffer overflow C. SQL injection D. Cross-site scripting Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q003 While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue? A. Documenting the new policy in a change request and submitting the request to change management B. Testing the policy in a non-production environment before enabling the policy in the production network C. Disabling any intrusion prevention signatures on the 'deny any* policy prior to enabling the new policy D. Including an 'allow any1 policy above the 'deny any* policy Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q004 An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values around two days. Which of the following types of sites is the best for this scenario? A. Real-time recovery B. Hot C. Cold D. Warm Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q005 A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy? A. Enumeration B. Sanitization C. Destruction D. Inventory Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q006 A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data? A. Private B. Critical C. Sensitive D. Public Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q007 A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first? A. Local data protection regulations B. Risks from hackers residing in other countries C. Impacts to existing contractual obligations D. Time zone differences in log correlation Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q008 Which of the following would be the best way to block unknown programs from executing? A. Access control list B. Application allow list. C. Host-based firewall D. DLP solution Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q009 A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity? A. White B. Purple C. Blue D. Red Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q010 A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate? A. Testing input validation on the user input fields B. Performing code signing on company- developed software C. Performing static code analysis on the software D. Ensuring secure cookies are use Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q011 Which of the following can be used to identify potential attacker activities without affecting production servers? A. Honey pot B. Video surveillance C. Zero Trust D. Geofencing Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q012 During an investigation, an incident response team attempts to understand the source of an incident. Which of the following incident response activities describes this process? A. Analysis B. Lessons learned C. Detection D. Containment Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q013 A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Which of the following should be done next? A. Conduct an audit. B. Initiate a penetration test. C. Rescan the network. D. Submit a report. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q014 An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device. Which of the following best describes the user’s activity? A. Penetration testing B. Phishing campaign C. External audit D. Insider threat Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q015 Which of the following allows for the attribution of messages to individuals? A. Adaptive identity B. Non-repudiation C. Authentication D. Access logs Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q016 Which of the following is the best way to consistently determine on a daily basis whether security settings on servers have been modified? A. Automation B. Compliance checklist C. Attestation D. Manual audit Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q017 Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII? A. SCAP B. Net Flow C. Antivirus D. DLP Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q018 An organization recently updated its security policy to include the following statement: Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application. Which of the following best explains the security technique the organization adopted by making this addition to the policy? A. Identify embedded keys B. Code debugging C. Input validation D. Static code analysis Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q019 A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click- through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message. Which of the following should the analyst do? A. Place posters around the office to raise awareness of common phishing activities. B. Implement email security filters to prevent phishing emails from being delivered C. Update the EDR policies to block automatic execution of downloaded programs. D. Create additional training for users to recognize the signs of phishing attempts. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q020 Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses? A. Compensating control B. Network segmentation C. Transfer of risk D. SNMP traps Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q021 The management team notices that new accounts that are set up manually do not always have correct access or permissions. Which of the following automation techniques should a systems administrator use to streamline account creation? A. Guard rail script B. Ticketing workflow C. Escalation script D. User provisioning script Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q022 A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis. Which of the following types of controls is the company setting up? A. Corrective B. Preventive C. Detective D. Deterrent Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q023 A systems administrator is looking for a low- cost application-hosting solution that is cloudbased. Which of the following meets these requirements? A. Serverless framework B. Type 1 hvpervisor C. SD-WAN D. SDN Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q024 A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future? A. Tuning B. Aggregating C. Quarantining D. Archiving Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q025 Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q026 A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider? A. Clustering servers B. Geographic dispersion C. Load balancers D. Off-site backups Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q027 Which of the following is a primary security concern for a company setting up a BYOD program? A. End of life B. Buffer overflow C. VM escape D. Jailbreaking Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q028 A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision? A. IMTTR B. RTO C. ARO D. MTBF Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q029 Which of the following is the most likely to be included as an element of communication in a security awareness program? A. Reporting phishing attempts or other suspicious activities B. Detecting insider threats using anomalous behavior recognition C. Verifying information when modifying wire transfer data D. Performing social engineering as part of third-party penetration testing Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q030 Salah Al-Attar +966592994290 t.me/salahsami2002  Attack Description Target Attack Best Preventative or Explanation (English) Explanation (Arabic) Identified Remediation Action An attacker sends multiple SYN packets from Botnets are used to launch DDoS attacks; enabling DDoS ‫(؛ تمك‬DDoS) ‫ستخدم البوت نت لشن هجمات حجب الخدمة الموزعة‬ multiple sources. Web server Botnet Enable DDoS protection protection helps mitigate such attacks..‫ ساعد التخف ف من هذه الهجمات‬DDoS ‫حما ة‬ The attack establishes a connection, which RATs enable remote control of systems; disabling remote ‫( تمكن الس طرة عن عد ع اﻷنظمة؛ تعط ل‬RAT) ‫برامج التح م عن عد‬ allows remote commands to be executed. User RAT Disable remote access services access prevents this exploitation..‫خدمات الوصول عن عد منع هذا اﻻستغﻼل‬ The attack is self propagating and compromises a SQL database using well- known credentials as it moves through the Database Change the default system Worms spread via weak credentials; changing default ‫لمات المرور اﻻف اض ة قلل‬ ‫الد دان تن ع ب انات اﻻعتماد الضع فة؛ تغي‬ network. server Worm password passwords reduces this risk..‫من هذا الخطر‬ The attacker uses hardware to remotely monitor a user's input activity to harvest Implement 2FA using push Keyloggers capture keystrokes; 2FA with push notifications ‫( استخدام‬2FA) ‫مسجﻼت المفاتيح تلتقط ات المفاتيح؛ المصادقة الثنائ ة‬ credentials. Executive Keylogger notification provides an additional security layer..‫إشعارات الدفع توفر ط قة أمان إضاف ة‬ The attacker embeds hidden access in an internally developed application that bypasses Backdoors allow hidden access; code reviews help identify ‫تحد د هذه‬ ‫اﻷبواب الخلف ة سمح الوصول المخ ؛ مراجعة ال ود ساعد‬ account login. Application Backdoor Conduct a code review and eliminate these vulnerabilities..‫الثغرات و زالتها‬ Salah Al-Attar WA +966592994290 SY0-701-Q031 Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q032 Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address? A. VM escape B. SQL injection C. Buffer overflow D. Race condition Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q033 Which of the following would be the best way to handle a critical business application that is running on a legacy server? A. Segmentation B. Isolation C. Hardening D. Decommissioning Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q034 Which of the following describes the process of concealing code or text inside a graphical image? A. Symmetric encryption B. Hashing C. Data masking D. Steganography Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q035 After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response to the lawsuit. Which of the following describes the action the security team will most likely be required to take? A. Retain the emails between the security team and affected customers for 30 days. B. Retain any communications related to the security breach until further notice. C. Retain any communications between security members during the breach response. D. Retain all emails from the company to affected customers for an indefinite period of time. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q036 A network manager wants to protect the company's VPN by implementing multifactor authentication that uses:. Something you know. Something you have. Something you are Which of the following would accomplish the manager's goal? A. Domain name, PKI, GeolP lookup B. VPN IP address, company ID, facial structure C. Password, authentication token, thumbprint D. Company URL, TLS certificate, home address Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q037 A security manager created new documentation to use in response to various types of security incidents. Which of the following is the next step the manager should take? A. Set the maximum data retention policy. B. Securely store the documents on an air-gapped network. C. Review the documents' data classification policy. D. Conduct a tabletop exercise with the team. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q038 Users at a company are reporting they are unable to access the URL for a new retail website because it is flagged as gambling and is being blocked. Which of the following changes would allow users to access the site? A. Creating a firewall rule to allow HTTPS traffic B. Configuring the IPS to allow shopping C. Tuning the DLP rule that detects credit card data D. Updating the categorization in the content filter Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q039 An administrator discovers that some files on a database server were recently encrypted. The administrator sees from the security logs that the data was last accessed by a domain user. Which of the following best describes the type of attack that occurred? A. Insider threat B. Social engineering C. Watering-hole D. Unauthorized attacker Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q041 Which of the following must be considered when designing a high-availability network? (Select two). A. Ease of recovery B. Ability to patch C. Physical isolation D. Responsiveness E. Attack surface F. Extensible authentication Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q042 Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card? A. Encryption B. Hashing C. Masking D. Tokenization Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q043 An administrator finds that all user workstations and servers are displaying a message that is associated with files containing an extension of.ryk. Which of the following types of infections is present on the systems? A. Virus B. Trojan C. Spyware D. Ransomware Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q044 A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies. Which of the following is the most important consideration during development? A. Scalability B. Availability C. Cost D. Ease of deployment Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q045 An organization wants a third-party vendor to do a penetration test that targets a specific device. The organization has provided basic information about the device. Which of the following best describes this kind of penetration test? A. Partially known environment B. Unknown environment C. Integrated D. Known environment Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q046 An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using? A. Smishing B. Disinformation C. Impersonating D. Whaling Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q047 An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate? A. Secured zones B. Subject role C. Adaptive identity D. Threat scope reduction Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q048 An organization is leveraging a VPN between its headquarters and a branch location. Which of the following is the VPN protecting? A. Data in use B. Data in transit C. Geographic restrictions D. Data sovereignty Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q049 The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario? A. Shadow IT B. Insider threat C. Data exfiltration D. Service disruption Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q050 An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal? A. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 B. Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53 C. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q051 After a security incident, a systems administrator asks the company to buy a NAC platform. Which of the following attack surfaces is the systems administrator trying to protect? A. Bluetooth B. Wired C. NFC D. SCADA Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q052 Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Select two). A. Channels by which the organization communicates with customers B. The reporting mechanisms for ethics violations C. Threat vectors based on the industry in which the organization operates D. Secure software development training for all personnel E. Cadence and duration of training events F. Retraining requirements for individuals who fail phishing simulations Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q053 An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization? A. Exception B. Segmentation C. Risk transfer D. Compensating controls Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q054 Which of the following is the best reason to complete an audit in a banking environment? A. Regulatory requirement B. Organizational change C. Self-assessment requirement D. Service-level requirement Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q055 A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first? A. Block access to cloud storage websites. B. Create a rule to block outgoing email attachments. C. Apply classifications to the data. D. Remove all user permissions from shares on the file server. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q056 Which of the following describes a security alerting and monitoring tool that collects system,application, and network logs from multiple sources in a centralized system? A. SIEM B. DLP C. IDS D. SNMP Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q057 Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Select two). A. The device has been moved from a production environment to a test environment. C. The device is moved to an isolated segment on the enterprise network. D. The device is moved to a different location in the enterprise. E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates. Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q058 An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out? A. Compromise B. Retention C. Analysis D. Transfer E. Inventory Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q060 A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes. Which of the following should the administrator set up to achieve this goal? A. SPF B. GPO C. NAC D. FIM Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q061 Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities? A. Preparation B. Recovery C. Lessons learned D. Analysis Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q062 A company is discarding a classified storage array and hires an outside vendor to complete the disposal. Which of the following should the company request from the vendor? A. Certification B. Inventory list C. Classification D. Proof of ownership Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q063 Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Select two). A. Fencing B. Video surveillance C. Badge access D. Access control vestibule E. Sign-in sheet F. Sensor Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q064 A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer? A. Processor B. Custodian C. Subject D. Owner Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q065 Malware spread across a company's network after an employee visited a compromised industry blog. Which of the following best describes this type of attack? A. Impersonation B. Disinformation C. Watering-hole D. Smishing Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q066 After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following control types did the administrator use? A. Compensating B. Detective C. Preventive D. Corrective Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q067 Which of the following agreement types defines the time frame in which a vendor needs to respond? A. SOW B. SLA C. MOA D. MOU Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q068 A Chief Information Security Officer wants to monitor the company's servers for SQLi attacks and allow for comprehensive investigations if an attack occurs. The company uses SSL decryption to allow traffic monitoring. Which of the following strategies would best accomplish this goal? A. Logging all NetFlow traffic into a SIEM B. Deploying network traffic sensors on the same subnet as the servers C. Logging endpoint and OS-specific security logs D. Enabling full packet capture for traffic entering and exiting the servers Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q069 A client demands at least 99.99% uptime from a service provider's hosted security services. Which of the following documents includes the information the service provider should return to the client? A. MOA B. SOW C. MOU D. SLA Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q070 A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing? A. Cross-site scripting B. Buffer overflow C. Jailbreaking D. Side loading Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q071 Which of the following practices would be best to prevent an insider from introducing malicious code into a company's development process? A. Code scanning for vulnerabilities B. Open-source component usage C. Quality assurance testing D. Peer review and approval Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q072 A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task? A. Off-the-shelf software B. Orchestration C. Baseline D. Policy enforcement Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q073 After an audit, an administrator discovers all users have access to confidential data on a file server. Which of the following should the administrator use to restrict access to the data quickly? A. Group Policy B. Content filtering C. Data loss prevention D. Access control lists Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q074 A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO's report? A. Insider threat B. Hacktivist C. Nation-state D. Organized crime Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q075 A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture? A. Patch availability B. Product software compatibility C. Ease of recovery D. Cost of replacement Salah Al-Attar +966592994290 t.me/salahsami2002 SY0-701-Q076 A company is developing a critical system for the government and storing project information on a fileshare. Which of the following describes how this data will most likely be classified? (Select two). A. Private B. Confidential C. Public D. Operational E. Urgent F. Restricted Salah Al-Attar +966592994290 t.me/salahsami2002