Free SY0-801 practice test: 30 questions with answers

Correlation rules join related events by time, source, and pattern, which reveals a probable password attack. Disk encryption, DHCP logs, and printer dashboards do not connect events across sources.

Device control limits what can connect and scan or block dangerous media, and current patches reduce exploitable flaws. Disabling protection, auto-running media, and granting admin rights each increase the chance of compromise.

Removing the cause and restoring systems belongs to eradication and recovery. Preparation happens before incidents, identification confirms the event, and lessons learned follows the response.

Authenticated scans can inspect installed packages and patch levels, producing far more accurate findings. Ignoring results or disabling scans leaves gaps, and scanning only a website misses the servers.

DLP inspects content and blocks or quarantines sensitive data leaving the organization. A handbook reminder is advisory, retention periods do not prevent sending, and blocking all internet traffic is disproportionate.

EDR telemetry captures process relationships and behaviors that reveal code injection and its context. Wallpapers, printers, and ticket counts do not describe the process activity.

Spear phishing targets a specific person using tailored details, here a real invoice and the manager's name. Denial of service, SQL injection, and rootkits do not rely on targeted deception of a person.

Password spraying tries a few passwords across many accounts to avoid lockout thresholds. Brute force targets one account with many guesses, while keylogging captures typed input and hijacking steals an active session.

A man-in-the-middle attack intercepts and possibly modifies traffic between two parties. Cross-site scripting injects script into web pages, a zero-day is an unpatched vulnerability, and typosquatting registers look-alike names.

Offline or immutable backups that have been tested allow recovery without paying the ransom. Backups on the same server can be encrypted too, and password length or removing antivirus does not limit the damage.

Pressure to bypass verification and requests for one-time codes are classic social engineering indicators. Routine work requests, scheduled updates, and normal invitations are expected activity.

Compromising the vendor's build or distribution process to reach many customers is a supply chain attack. Brute force, denial of service, and credential stuffing target access or availability differently.

Zero trust verifies every request based on identity, device health, and context regardless of network location. An air gap isolates a network, while defense in depth layers controls without changing the trust assumption, and obscurity is not a security model.

Segmentation with restricted rules limits lateral movement from a compromised device. A flat network and shared credentials make lateral movement easy, and disabling firewalls removes a control.

The shared responsibility model divides security duties between provider and customer based on the service. Least privilege governs access rights, mandatory access control enforces labels, and air gaps are a network isolation method.

Combining a knowledge factor with a possession factor is multifactor authentication. A single long password is one factor, IP-based checks are not identity proof, and shared tokens and anonymity offer no individual proof.

Decoy systems let defenders watch attacker methods and capture tools in isolation, without risking production data. They do not replace patching, enlarge the production attack surface, or block internet traffic.

The certificate authority signs certificates, and the registration authority verifies the requester's identity before issuance. Printer queues, firewall rules, and password spreadsheets are not PKI components.

Digests detect unauthorized modification, which protects integrity. Availability concerns access when needed, and confidentiality concerns disclosure, while non-repudiation is about proving origin rather than detecting change.

Symmetric encryption is fast and suited to bulk data, and asymmetric cryptography is typically used to exchange or authenticate the shared key. Hashing does not encrypt, and steganography hides data rather than encrypting it.

A unique salt per password makes precomputed rainbow-table attacks impractical and identical passwords produce different hashes. Salting does not make hashes reversible, shorten them, or permit plaintext transmission.

AAA covers verifying identity, deciding permitted actions, and logging activity. The other sets describe cryptographic operations, vulnerability management, and network forwarding.

Hash functions produce fixed-length outputs and are designed to make collisions infeasible, and any change to the input changes the digest. Hashes are one-way and do not provide confidentiality on their own, and the other statements contradict these properties.

CRLs and OCSP are the revocation checking mechanisms that tell clients whether a certificate is still valid. DHCP, SMTP, and FTP do not check certificate status.

A high likelihood and impact score calls for prompt treatment with an accountable owner and deadline. Ignoring, undocumented acceptance, or deleting the entry removes oversight of a serious risk.

A policy states mandatory requirements, and a procedure gives step-by-step instructions to implement them. Baselines, contracts, logs, checklists, and diagrams serve other purposes.

Third-party assessments and contract clauses set security expectations, and periodic review confirms they are met. Assuming security, skipping documentation, and sharing data without review each leave the risk unmanaged.

A business impact analysis identifies critical functions, dependencies, and the cost of downtime, which sets recovery priorities. Scans, penetration tests, and phishing simulations test technical controls rather than business priorities.

GDPR governs the processing of personal data about people in the EU. SOX applies to financial reporting in US public companies, PCI DSS covers card data, and aviation regulations are unrelated.

Phishing training and simulations build recognition and reporting habits. Sharing passwords, publishing them, and removing reporting channels all weaken security and are never part of an awareness program.