Free CompTIA SY0-801 Practice Questions 2026 - Page 2
Cryptography certificates and key management
A certificate validation check reports that a server certificate has been revoked before its expiration date. What should a client do?
A. Reject the certificate and use a trusted alternative path or contact the service owner
B. Ignore revocation because the expiration date has not passed
C. Accept it if the website loads over HTTPS
D. Replace the certificate check with a DNS lookup
Why this is correct: Answer A — Reject the certificate and use a trusted alternative path or contact the service owner. Revocation signals that the certificate should no longer be trusted, for example because its private key may be compromised. A client should not accept it merely because its date range remains valid. The scenario asks: A certificate validation check reports that a server certificate has been revoked before its expiration date. What should a client do? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Reject the certificate and use a trusted alternative path or contact the service owner acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A certificate validation check reports that a server certificate has been revoked before its expiration date. What should a client do? |
| Selected response | Reject the certificate and use a trusted alternative path or contact the service owner |
| Reason it fits | Revocation signals that the certificate should no longer be trusted, for example because its private key may be compromised. A client should not accept it merely because its date range remains valid. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Reject the certificate and use a trusted alternative path or contact the service owner because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Ignore revocation because the expiration date has not passed:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the certificate status is explicitly revoked, which makes Reject the certificate and use a trusted alternative path or contact the service owner the better response.
It would leave a connection trusting a compromised identity unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
C. Accept it if the website loads over HTTPS:
This option is primarily designed to address a different security objective.
The key clue is the certificate status is explicitly revoked, which makes Reject the certificate and use a trusted alternative path or contact the service owner the better response.
It would leave a connection trusting a compromised identity unresolved.
Choose it when the main need is to address the different objective.
D. Replace the certificate check with a DNS lookup:
This option is primarily designed to establish or verify cryptographic identity and trust.
The key clue is the certificate status is explicitly revoked, which makes Reject the certificate and use a trusted alternative path or contact the service owner the better response.
It would leave a connection trusting a compromised identity unresolved.
Choose it when the main need is to validate a key or signer.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
A user digitally signs a document with a private key. Which key should a recipient use to verify the signature?
A. The corresponding public key
B. The signer’s private key
C. A newly generated symmetric key
D. The recipient’s password
Why this is correct: Answer A — The corresponding public key. A digital signature is created with the signer’s private key and verified with the corresponding public key. The recipient also needs a trusted way to associate that public key with the signer. The scenario asks: A user digitally signs a document with a private key. Which key should a recipient use to verify the signature? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A user digitally signs a document with a private key. Which key should a recipient use to verify the signature? |
| Selected response | The corresponding public key |
| Reason it fits | A digital signature is created with the signer’s private key and verified with the corresponding public key. The recipient also needs a trusted way to associate that public key with the signer. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that The corresponding public key acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is The corresponding public key because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. The signer’s private key
- This option is primarily designed to establish or verify cryptographic identity and trust.
- The key clue is the signature was made with a private key, which makes The corresponding public key the better response.
- It would leave accepting a forged or unverified document unresolved.
- Choose it when the main need is to validate a key or signer.
C. A newly generated symmetric key
- This option is primarily designed to address a different security objective.
- The key clue is the signature was made with a private key, which makes The corresponding public key the better response.
- It would leave accepting a forged or unverified document unresolved.
- Choose it when the main need is to address the different objective.
D. The recipient’s password
- This option is primarily designed to authenticate or protect access to an account.
- The key clue is the signature was made with a private key, which makes The corresponding public key the better response.
- It would leave accepting a forged or unverified document unresolved.
- Choose it when the main need is to secure account access.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
A business uses a rule that requires approval from two different administrators before a high-risk change. Which concept does this support?
A. Separation of duties
B. Single sign-on
C. Data minimization
D. Availability
Why this is correct: Answer A — Separation of duties. Separation of duties divides sensitive tasks so one person cannot complete the entire high-risk action alone. Independent approval helps reduce error and misuse. The scenario asks: A business uses a rule that requires approval from two different administrators before a high-risk change. Which concept does this support? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Separation of duties acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A business uses a rule that requires approval from two different administrators before a high-risk change. Which concept does this support? |
| Selected response | Separation of duties |
| Reason it fits | Separation of duties divides sensitive tasks so one person cannot complete the entire high-risk action alone. Independent approval helps reduce error and misuse. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Separation of duties because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Single sign-on:
This option is primarily designed to address a different security objective.
The key clue is two people must approve a sensitive action, which makes Separation of duties the better response.
It would leave one-person control over a high-impact change unresolved.
Choose it when the main need is to address the different objective.
C. Data minimization:
This option is primarily designed to control the handling, exposure, or lifecycle of information.
The key clue is two people must approve a sensitive action, which makes Separation of duties the better response.
It would leave one-person control over a high-impact change unresolved.
Choose it when the main need is to control data use or disclosure.
D. Availability:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is two people must approve a sensitive action, which makes Separation of duties the better response.
It would leave one-person control over a high-impact change unresolved.
Choose it when the main need is to assess or control AI-related risk.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A system must remain usable during a hardware failure. Which security property is the primary concern?
A. Availability
B. Confidentiality
C. Non-repudiation
D. Anonymity
Why this is correct: Answer A — Availability. Availability means authorized users can access systems and information when needed. Redundancy, failover, and recovery planning support this property. The scenario asks: A system must remain usable during a hardware failure. Which security property is the primary concern? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Availability acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A system must remain usable during a hardware failure. Which security property is the primary concern? |
| Selected response | Availability |
| Reason it fits | Availability means authorized users can access systems and information when needed. Redundancy, failover, and recovery planning support this property. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Availability because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Confidentiality
- This option is primarily designed to address a different security objective.
- The key clue is service access must continue during failure, which makes Availability the better response.
- It would leave service interruption unresolved.
- Choose it when the main need is to address the different objective.
C. Non-repudiation
- This option is primarily designed to address a different security objective.
- The key clue is service access must continue during failure, which makes Availability the better response.
- It would leave service interruption unresolved.
- Choose it when the main need is to address the different objective.
D. Anonymity
- This option is primarily designed to address a different security objective.
- The key clue is service access must continue during failure, which makes Availability the better response.
- It would leave service interruption unresolved.
- Choose it when the main need is to address the different objective.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
An application team proposes a security control that logs every privileged command but does not block it. What type of control is this?
A. Detective
B. Preventive
C. Corrective
D. Physical
Why this is correct: Answer A — Detective. Logging and review help identify that an event occurred, so the measure is detective. It may support response, but it does not itself stop the command. The scenario asks: An application team proposes a security control that logs every privileged command but does not block it. What type of control is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An application team proposes a security control that logs every privileged command but does not block it. What type of control is this? |
| Selected response | Detective |
| Reason it fits | Logging and review help identify that an event occurred, so the measure is detective. It may support response, but it does not itself stop the command. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Detective acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Detective because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. Preventive |
|
| C. Corrective |
|
| D. Physical |
|
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A company installs a locked server-room door and a badge reader. How are these controls best classified?
A. Physical and preventive
B. Technical and corrective
C. Managerial and detective
D. Operational and deterrent only
Why this is correct: Answer A — Physical and preventive. The door and badge reader restrict physical entry, making them physical preventive controls. They can also produce detective logs, but their primary purpose in the scenario is to prevent unauthorized entry. The scenario asks: A company installs a locked server-room door and a badge reader. How are these controls best classified? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Physical and preventive acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company installs a locked server-room door and a badge reader. How are these controls best classified? |
| Selected response | Physical and preventive |
| Reason it fits | The door and badge reader restrict physical entry, making them physical preventive controls. They can also produce detective logs, but their primary purpose in the scenario is to prevent unauthorized entry. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Physical and preventive because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Technical and corrective
- This option is primarily designed to address a different security objective.
- The key clue is the controls restrict entry to a location, which makes Physical and preventive the better response.
- It would leave unauthorized physical access unresolved.
- Choose it when the main need is to address the different objective.
C. Managerial and detective
- This option is primarily designed to address a different security objective.
- The key clue is the controls restrict entry to a location, which makes Physical and preventive the better response.
- It would leave unauthorized physical access unresolved.
- Choose it when the main need is to address the different objective.
D. Operational and deterrent only
- This option is primarily designed to address a different security objective.
- The key clue is the controls restrict entry to a location, which makes Physical and preventive the better response.
- It would leave unauthorized physical access unresolved.
- Choose it when the main need is to address the different objective.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A team wants to reduce the amount of personal data retained in analytics exports. Which privacy-friendly action is best?
A. Collect and retain only fields needed for the stated purpose
B. Copy every source field into the export
C. Keep all records indefinitely in case they become useful
D. Share raw data with every analyst
Why this is correct: Answer A — Collect and retain only fields needed for the stated purpose. Data minimization limits collection and retention to what a defined purpose requires. It reduces exposure if an export is misused or breached. The scenario asks: A team wants to reduce the amount of personal data retained in analytics exports. Which privacy-friendly action is best? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Collect and retain only fields needed for the stated purpose acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A team wants to reduce the amount of personal data retained in analytics exports. Which privacy-friendly action is best? |
| Selected response | Collect and retain only fields needed for the stated purpose |
| Reason it fits | Data minimization limits collection and retention to what a defined purpose requires. It reduces exposure if an export is misused or breached. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Collect and retain only fields needed for the stated purpose because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Copy every source field into the export:
This option is primarily designed to address a different security objective.
The key clue is the export contains more personal data than needed, which makes Collect and retain only fields needed for the stated purpose the better response.
It would leave unnecessary privacy and breach exposure unresolved.
Choose it when the main need is to address the different objective.
C. Keep all records indefinitely in case they become useful:
This option is primarily designed to address a different security objective.
The key clue is the export contains more personal data than needed, which makes Collect and retain only fields needed for the stated purpose the better response.
It would leave unnecessary privacy and breach exposure unresolved.
Choose it when the main need is to address the different objective.
D. Share raw data with every analyst:
This option is primarily designed to make information or access broadly available.
The key clue is the export contains more personal data than needed, which makes Collect and retain only fields needed for the stated purpose the better response.
It would leave unnecessary privacy and breach exposure unresolved.
Choose it when the main need is to share information broadly under an approved need.
References: NIST Privacy Framework; SY0-801 draft objectives.
A company is replacing a legacy application that cannot support modern authentication. What is the best first step?
A. Assess dependencies and risk, then plan compensating controls or replacement
B. Disable authentication for the application
C. Place it on the public internet to simplify access
D. Allow shared accounts so staff can keep working
Why this is correct: Answer A — Assess dependencies and risk, then plan compensating controls or replacement. Legacy systems require a risk-based plan that considers dependencies, support, and migration options. Until replacement, compensating controls such as segmentation and restricted access can reduce exposure. The scenario asks: A company is replacing a legacy application that cannot support modern authentication. What is the best first step? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company is replacing a legacy application that cannot support modern authentication. What is the best first step? |
| Selected response | Assess dependencies and risk, then plan compensating controls or replacement |
| Reason it fits | Legacy systems require a risk-based plan that considers dependencies, support, and migration options. Until replacement, compensating controls such as segmentation and restricted access can reduce exposure. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Assess dependencies and risk, then plan compensating controls or replacement acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Assess dependencies and risk, then plan compensating controls or replacement because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Disable authentication for the application
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is the application has a known security limitation, which makes Assess dependencies and risk, then plan compensating controls or replacement the better response.
- It would leave uncontrolled access to a vulnerable system unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
C. Place it on the public internet to simplify access
- This option is primarily designed to make information or access broadly available.
- The key clue is the application has a known security limitation, which makes Assess dependencies and risk, then plan compensating controls or replacement the better response.
- It would leave uncontrolled access to a vulnerable system unresolved.
- Choose it when the main need is to share information broadly under an approved need.
D. Allow shared accounts so staff can keep working
- This option is primarily designed to make information or access broadly available.
- The key clue is the application has a known security limitation, which makes Assess dependencies and risk, then plan compensating controls or replacement the better response.
- It would leave uncontrolled access to a vulnerable system unresolved.
- Choose it when the main need is to share information broadly under an approved need.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A policy states that customer data must be encrypted while stored and transmitted. These requirements primarily support which CIA properties?
A. Confidentiality, while integrity may also be supported by authenticated encryption
B. Availability only
C. Non-repudiation only
D. Physical safety only
Why this is correct: Answer A — Confidentiality, while integrity may also be supported by authenticated encryption. Encryption primarily protects confidentiality by making data unreadable without the required key. Authenticated encryption can also detect tampering, but ordinary encryption alone does not guarantee availability. The scenario asks: A policy states that customer data must be encrypted while stored and transmitted. These requirements primarily support which CIA properties? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Confidentiality, while integrity may also be supported by authenticated encryption acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A policy states that customer data must be encrypted while stored and transmitted. These requirements primarily support which CIA properties? |
| Selected response | Confidentiality, while integrity may also be supported by authenticated encryption |
| Reason it fits | Encryption primarily protects confidentiality by making data unreadable without the required key. Authenticated encryption can also detect tampering, but ordinary encryption alone does not guarantee availability. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Confidentiality, while integrity may also be supported by authenticated encryption because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Availability only:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is data must be protected from unauthorized disclosure, which makes Confidentiality, while integrity may also be supported by authenticated encryption the better response.
It would leave exposure of stored or transmitted information unresolved.
Choose it when the main need is to assess or control AI-related risk.
C. Non-repudiation only:
This option is primarily designed to address a different security objective.
The key clue is data must be protected from unauthorized disclosure, which makes Confidentiality, while integrity may also be supported by authenticated encryption the better response.
It would leave exposure of stored or transmitted information unresolved.
Choose it when the main need is to address the different objective.
D. Physical safety only:
This option is primarily designed to protect equipment or locations from physical access.
The key clue is data must be protected from unauthorized disclosure, which makes Confidentiality, while integrity may also be supported by authenticated encryption the better response.
It would leave exposure of stored or transmitted information unresolved.
Choose it when the main need is to restrict physical access to equipment or locations.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
A security administrator needs to prove a backup file is unchanged since creation. Which paired control is strongest?
A. A cryptographic hash stored separately with access controls
B. A filename containing the word FINAL
C. A screenshot of the backup directory
D. A checksum saved only inside the file being checked
Why this is correct: Answer A — A cryptographic hash stored separately with access controls. A trusted hash stored separately gives the team a comparison value that an attacker cannot casually alter along with the backup. Access controls protect the reference value. The scenario asks: A security administrator needs to prove a backup file is unchanged since creation. Which paired control is strongest? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that A cryptographic hash stored separately with access controls acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A security administrator needs to prove a backup file is unchanged since creation. Which paired control is strongest? |
| Selected response | A cryptographic hash stored separately with access controls |
| Reason it fits | A trusted hash stored separately gives the team a comparison value that an attacker cannot casually alter along with the backup. Access controls protect the reference value. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is A cryptographic hash stored separately with access controls because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. A filename containing the word FINAL |
|
| C. A screenshot of the backup directory |
|
| D. A checksum saved only inside the file being checked |
|
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
| Page 2 out of 15 Pages |
PREPARE BY TOPICS
Choose a topic to practice questions related to that specific exam topic.