Free CompTIA SY0-801 Practice Questions 2026 - Page 3
Data protection classification and keys
An organization classifies information as public, internal, confidential, or restricted. What should access rules primarily reflect?
A. The data classification and business need
B. The alphabetic order of user names
C. The age of the database
D. The operating system vendor
Why this is correct: Answer A — The data classification and business need. Classification communicates the sensitivity and handling needs of information. Access rules should reflect the potential harm of disclosure and the user’s legitimate work need. The scenario asks: An organization classifies information as public, internal, confidential, or restricted. What should access rules primarily reflect? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An organization classifies information as public, internal, confidential, or restricted. What should access rules primarily reflect? |
| Selected response | The data classification and business need |
| Reason it fits | Classification communicates the sensitivity and handling needs of information. Access rules should reflect the potential harm of disclosure and the user’s legitimate work need. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that The data classification and business need acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is The data classification and business need because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. The alphabetic order of user names:
This option is primarily designed to address a different security objective.
The key clue is data sensitivity differs by classification, which makes The data classification and business need the better response.
It would leave sensitive information reaching unauthorized users unresolved.
Choose it when the main need is to address the different objective.
C. The age of the database:
This option is primarily designed to control the handling, exposure, or lifecycle of information.
The key clue is data sensitivity differs by classification, which makes The data classification and business need the better response.
It would leave sensitive information reaching unauthorized users unresolved.
Choose it when the main need is to control data use or disclosure.
D. The operating system vendor:
This option is primarily designed to assess or manage a supplier relationship.
The key clue is data sensitivity differs by classification, which makes The data classification and business need the better response.
It would leave sensitive information reaching unauthorized users unresolved.
Choose it when the main need is to assess a supplier handling systems or sensitive data.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A security team documents that a planned maintenance change may cause a brief outage and names the rollback owner. What practice is being followed?
A. Change management
B. Threat hunting
C. Key escrow
D. Data tokenization
Why this is correct: Answer A — Change management. Change management records the proposed change, impact, approvals, and recovery responsibilities. That helps the organization implement changes predictably and learn from failures. The scenario asks: A security team documents that a planned maintenance change may cause a brief outage and names the rollback owner. What practice is being followed? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Change management acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A security team documents that a planned maintenance change may cause a brief outage and names the rollback owner. What practice is being followed? |
| Selected response | Change management |
| Reason it fits | Change management records the proposed change, impact, approvals, and recovery responsibilities. That helps the organization implement changes predictably and learn from failures. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Change management because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Threat hunting
- This option is primarily designed to address a different security objective.
- The key clue is the change has an assessed impact and rollback owner, which makes Change management the better response.
- It would leave an uncontrolled production change unresolved.
- Choose it when the main need is to address the different objective.
C. Key escrow
- This option is primarily designed to address a different security objective.
- The key clue is the change has an assessed impact and rollback owner, which makes Change management the better response.
- It would leave an uncontrolled production change unresolved.
- Choose it when the main need is to address the different objective.
D. Data tokenization
- This option is primarily designed to control the handling, exposure, or lifecycle of information.
- The key clue is the change has an assessed impact and rollback owner, which makes Change management the better response.
- It would leave an uncontrolled production change unresolved.
- Choose it when the main need is to control data use or disclosure.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A service uses a certificate issued by a trusted certificate authority. What does the certificate mainly help establish?
A. A binding between a public key and an asserted identity
B. The user’s password strength
C. That the server cannot be attacked
D. That all content is safe to download
Why this is correct: Answer A — A binding between a public key and an asserted identity. A trusted certificate helps bind a public key to an identity under the certificate authority’s validation process. It does not guarantee that a server is free from vulnerabilities or malicious content. The scenario asks: A service uses a certificate issued by a trusted certificate authority. What does the certificate mainly help establish? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that A binding between a public key and an asserted identity acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A service uses a certificate issued by a trusted certificate authority. What does the certificate mainly help establish? |
| Selected response | A binding between a public key and an asserted identity |
| Reason it fits | A trusted certificate helps bind a public key to an identity under the certificate authority’s validation process. It does not guarantee that a server is free from vulnerabilities or malicious content. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is A binding between a public key and an asserted identity because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. The user’s password strength:
This option is primarily designed to authenticate or protect access to an account.
The key clue is a key must be associated with a server identity, which makes A binding between a public key and an asserted identity the better response.
It would leave impersonation of the legitimate service unresolved.
Choose it when the main need is to secure account access.
C. That the server cannot be attacked:
This option is primarily designed to address a different security objective.
The key clue is a key must be associated with a server identity, which makes A binding between a public key and an asserted identity the better response.
It would leave impersonation of the legitimate service unresolved.
Choose it when the main need is to address the different objective.
D. That all content is safe to download:
This option is primarily designed to address a different security objective.
The key clue is a key must be associated with a server identity, which makes A binding between a public key and an asserted identity the better response.
It would leave impersonation of the legitimate service unresolved.
Choose it when the main need is to address the different objective.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
PBQ-style scenario: A signing key may have leaked. Which response sequence is best?
A. Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems
B. Keep using the key, publish it for transparency, and rotate it at the next annual review
C. Delete the audit logs, generate a new key, and leave old certificates active
D. Ask users to ignore signature warnings until the key expires
Why this is correct: Answer A — Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems. A suspected exposed key is no longer trustworthy. Revocation limits further misuse, evidence supports investigation, and a controlled replacement restores trust across dependent systems. The scenario asks: PBQ-style scenario: A signing key may have leaked. Which response sequence is best? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | PBQ-style scenario: A signing key may have leaked. Which response sequence is best? |
| Selected response | Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems |
| Reason it fits | A suspected exposed key is no longer trustworthy. Revocation limits further misuse, evidence supports investigation, and a controlled replacement restores trust across dependent systems. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Keep using the key, publish it for transparency, and rotate it at the next annual review
- This option is primarily designed to make information or access broadly available.
- The key clue is the key may be exposed, which makes Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems the better response.
- It would leave continued forgery or decryption using a compromised key unresolved.
- Choose it when the main need is to share information broadly under an approved need.
C. Delete the audit logs, generate a new key, and leave old certificates active
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is the key may be exposed, which makes Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems the better response.
- It would leave continued forgery or decryption using a compromised key unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
D. Ask users to ignore signature warnings until the key expires
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is the key may be exposed, which makes Treat the key as compromised, revoke or disable it, preserve relevant evidence, issue a replacement, and update dependent systems the better response.
- It would leave continued forgery or decryption using a compromised key unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
Several employees receive messages that imitate the CFO and ask them to buy gift cards urgently. What attack is most likely?
A. Business email compromise using impersonation
B. SQL injection
C. Evil twin Wi-Fi
D. DNS cache poisoning
Why this is correct: Answer A — Business email compromise using impersonation. The attacker is impersonating an executive and using urgency to induce a financial action. This is a business email compromise pattern, whether the messages come from a spoofed or compromised account. The scenario asks: Several employees receive messages that imitate the CFO and ask them to buy gift cards urgently. What attack is most likely? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Business email compromise using impersonation acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | Several employees receive messages that imitate the CFO and ask them to buy gift cards urgently. What attack is most likely? |
| Selected response | Business email compromise using impersonation |
| Reason it fits | The attacker is impersonating an executive and using urgency to induce a financial action. This is a business email compromise pattern, whether the messages come from a spoofed or compromised account. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Business email compromise using impersonation because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. SQL injection:
This option is primarily designed to address a different security objective.
The key clue is the request impersonates an executive and seeks money, which makes Business email compromise using impersonation the better response.
It would leave unauthorized financial transfer unresolved.
Choose it when the main need is to address the different objective.
C. Evil twin Wi-Fi:
This option is primarily designed to address a different security objective.
The key clue is the request impersonates an executive and seeks money, which makes Business email compromise using impersonation the better response.
It would leave unauthorized financial transfer unresolved.
Choose it when the main need is to address the different objective.
D. DNS cache poisoning:
This option is primarily designed to address a naming, messaging, or social-engineering threat.
The key clue is the request impersonates an executive and seeks money, which makes Business email compromise using impersonation the better response.
It would leave unauthorized financial transfer unresolved.
Choose it when the main need is to address a deceptive message or destination.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
A threat report links repeated attacks against a defense contractor to a well-funded foreign intelligence group. Which actor is most likely?
A. Nation-state or advanced persistent threat
B. Casual script user
C. Accidental insider
D. Hacktivist with no resources
Why this is correct: Answer A — Nation-state or advanced persistent threat. A state-linked, well-resourced actor pursuing strategic objectives is commonly categorized as a nation-state or APT. Attribution should still be based on evidence and treated with appropriate confidence. The scenario asks: A threat report links repeated attacks against a defense contractor to a well-funded foreign intelligence group. Which actor is most likely? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Nation-state or advanced persistent threat acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A threat report links repeated attacks against a defense contractor to a well-funded foreign intelligence group. Which actor is most likely? |
| Selected response | Nation-state or advanced persistent threat |
| Reason it fits | A state-linked, well-resourced actor pursuing strategic objectives is commonly categorized as a nation-state or APT. Attribution should still be based on evidence and treated with appropriate confidence. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Nation-state or advanced persistent threat because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Casual script user
- This option is primarily designed to address a different security objective.
- The key clue is the activity is sustained and well resourced, which makes Nation-state or advanced persistent threat the better response.
- It would leave underestimating a capable, persistent adversary unresolved.
- Choose it when the main need is to address the different objective.
C. Accidental insider
- This option is primarily designed to address a different security objective.
- The key clue is the activity is sustained and well resourced, which makes Nation-state or advanced persistent threat the better response.
- It would leave underestimating a capable, persistent adversary unresolved.
- Choose it when the main need is to address the different objective.
D. Hacktivist with no resources
- This option is primarily designed to address a different security objective.
- The key clue is the activity is sustained and well resourced, which makes Nation-state or advanced persistent threat the better response.
- It would leave underestimating a capable, persistent adversary unresolved.
- Choose it when the main need is to address the different objective.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
A company’s public web server has an unpatched vulnerability listed in CISA’s Known Exploited Vulnerabilities catalog. What should the team prioritize?
A. Assess exposure and remediate or mitigate promptly based on risk
B. Wait for the next annual maintenance cycle
C. Remove the vulnerability scanner report
D. Assume exploitation is impossible because the server is patched next month
Why this is correct: Answer A — Assess exposure and remediate or mitigate promptly based on risk. Known exploitation raises urgency. The team should verify exposure, apply the vendor fix or an approved mitigation, and track the risk until remediation is confirmed. The scenario asks: A company’s public web server has an unpatched vulnerability listed in CISA’s Known Exploited Vulnerabilities catalog. What should the team prioritize? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company’s public web server has an unpatched vulnerability listed in CISA’s Known Exploited Vulnerabilities catalog. What should the team prioritize? |
| Selected response | Assess exposure and remediate or mitigate promptly based on risk |
| Reason it fits | Known exploitation raises urgency. The team should verify exposure, apply the vendor fix or an approved mitigation, and track the risk until remediation is confirmed. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Assess exposure and remediate or mitigate promptly based on risk acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Assess exposure and remediate or mitigate promptly based on risk because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Wait for the next annual maintenance cycle:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the flaw is known to be exploited, which makes Assess exposure and remediate or mitigate promptly based on risk the better response.
It would leave continued exposure to active attacks unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
C. Remove the vulnerability scanner report:
This option is primarily designed to identify or correct a known software weakness.
The key clue is the flaw is known to be exploited, which makes Assess exposure and remediate or mitigate promptly based on risk the better response.
It would leave continued exposure to active attacks unresolved.
Choose it when the main need is to remediate a known vulnerability.
D. Assume exploitation is impossible because the server is patched next month:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the flaw is known to be exploited, which makes Assess exposure and remediate or mitigate promptly based on risk the better response.
It would leave continued exposure to active attacks unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
References: CISA Known Exploited Vulnerabilities Catalog; SY0-801 draft objectives.
A web form inserts unsanitized user input into a database query, allowing an attacker to alter the query. Which weakness is present?
A. SQL injection
B. Cross-site request forgery
C. DNS tunneling
D. Credential stuffing
Why this is correct: Answer A — SQL injection. SQL injection occurs when untrusted input is interpreted as part of a database command. Parameterized queries and safe input handling help prevent this class of flaw. The scenario asks: A web form inserts unsanitized user input into a database query, allowing an attacker to alter the query. Which weakness is present? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that SQL injection acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A web form inserts unsanitized user input into a database query, allowing an attacker to alter the query. Which weakness is present? |
| Selected response | SQL injection |
| Reason it fits | SQL injection occurs when untrusted input is interpreted as part of a database command. Parameterized queries and safe input handling help prevent this class of flaw. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is SQL injection because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Cross-site request forgery
- This option is primarily designed to address a different security objective.
- The key clue is user input changes the meaning of a database query, which makes SQL injection the better response.
- It would leave unauthorized data access or modification unresolved.
- Choose it when the main need is to address the different objective.
C. DNS tunneling
- This option is primarily designed to address a naming, messaging, or social-engineering threat.
- The key clue is user input changes the meaning of a database query, which makes SQL injection the better response.
- It would leave unauthorized data access or modification unresolved.
- Choose it when the main need is to address a deceptive message or destination.
D. Credential stuffing
- This option is primarily designed to authenticate or protect access to an account.
- The key clue is user input changes the meaning of a database query, which makes SQL injection the better response.
- It would leave unauthorized data access or modification unresolved.
- Choose it when the main need is to secure account access.
References: OWASP Cheat Sheet Series; SY0-801 draft objectives.
Users are redirected to a counterfeit login page after scanning a malicious QR code in a parking notice. What is this technique often called?
A. QR-code phishing or quishing
B. Password spraying
C. Kerberoasting
D. Watering-hole attack
Why this is correct: Answer A — QR-code phishing or quishing. The QR code is used as a lure to send users to a fraudulent site, which is QR-code phishing, often called quishing. User reporting and URL inspection can help limit credential theft. The scenario asks: Users are redirected to a counterfeit login page after scanning a malicious QR code in a parking notice. What is this technique often called? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that QR-code phishing or quishing acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | Users are redirected to a counterfeit login page after scanning a malicious QR code in a parking notice. What is this technique often called? |
| Selected response | QR-code phishing or quishing |
| Reason it fits | The QR code is used as a lure to send users to a fraudulent site, which is QR-code phishing, often called quishing. User reporting and URL inspection can help limit credential theft. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is QR-code phishing or quishing because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. Password spraying |
|
| C. Kerberoasting |
|
| D. Watering-hole attack |
|
References: CISA phishing guidance; SY0-801 draft objectives.
An attacker sends one common password against many accounts, attempting only a few guesses per account. Which attack is this?
A. Password spraying
B. Brute force against one account
C. Pass-the-hash
D. Rainbow-table lookup
Why this is correct: Answer A — Password spraying. Password spraying tests a small number of likely passwords across many accounts to reduce lockout risk. Monitoring distributed failures and enforcing MFA help detect or blunt it. The scenario asks: An attacker sends one common password against many accounts, attempting only a few guesses per account. Which attack is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An attacker sends one common password against many accounts, attempting only a few guesses per account. Which attack is this? |
| Selected response | Password spraying |
| Reason it fits | Password spraying tests a small number of likely passwords across many accounts to reduce lockout risk. Monitoring distributed failures and enforcing MFA help detect or blunt it. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Password spraying acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Password spraying because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Brute force against one account
- This option is primarily designed to grant, restrict, or review user permissions.
- The key clue is a small number of guesses are spread across accounts, which makes Password spraying the better response.
- It would leave many accounts compromised without obvious lockouts unresolved.
- Choose it when the main need is to limit or review identity permissions.
C. Pass-the-hash
- This option is primarily designed to detect whether data or files have changed.
- The key clue is a small number of guesses are spread across accounts, which makes Password spraying the better response.
- It would leave many accounts compromised without obvious lockouts unresolved.
- Choose it when the main need is to verify data integrity.
D. Rainbow-table lookup
- This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
- The key clue is a small number of guesses are spread across accounts, which makes Password spraying the better response.
- It would leave many accounts compromised without obvious lockouts unresolved.
- Choose it when the main need is to assess or control AI-related risk.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
| Page 3 out of 15 Pages |
PREPARE BY TOPICS
Choose a topic to practice questions related to that specific exam topic.