Free CompTIA SY0-801 Practice Questions 2026 - Page 4
Credential attacks and vulnerability handling
An attacker tries thousands of leaked username-password pairs from another website against a company portal. What is this?
A. Credential stuffing
B. Password spraying
C. Shoulder surfing
D. Tailgating
Why this is correct: Answer A — Credential stuffing. Credential stuffing reuses breached credentials across services, relying on password reuse. Unique passwords and phishing-resistant MFA reduce the chance that another site’s breach compromises the portal. The scenario asks: An attacker tries thousands of leaked username-password pairs from another website against a company portal. What is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Credential stuffing acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An attacker tries thousands of leaked username-password pairs from another website against a company portal. What is this? |
| Selected response | Credential stuffing |
| Reason it fits | Credential stuffing reuses breached credentials across services, relying on password reuse. Unique passwords and phishing-resistant MFA reduce the chance that another site’s breach compromises the portal. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Credential stuffing because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Password spraying:
This option is primarily designed to authenticate or protect access to an account.
The key clue is previously stolen credential pairs are being reused, which makes Credential stuffing the better response.
It would leave account compromise from password reuse unresolved.
Choose it when the main need is to secure account access.
C. Shoulder surfing:
This option is primarily designed to address a different security objective.
The key clue is previously stolen credential pairs are being reused, which makes Credential stuffing the better response.
It would leave account compromise from password reuse unresolved.
Choose it when the main need is to address the different objective.
D. Tailgating:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is previously stolen credential pairs are being reused, which makes Credential stuffing the better response.
It would leave account compromise from password reuse unresolved.
Choose it when the main need is to assess or control AI-related risk.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
PBQ-style scenario: An account has implausible logins followed by a new mailbox rule. Which sequence is the best first response?
A. Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence
B. Delete the mailbox rule only, leave sessions active, and close the alert
C. Disable all employee accounts, erase the mailbox, and discard the logs
D. Wait for the user to report data loss before taking action
Why this is correct: Answer A — Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence. The sequence verifies whether access is legitimate, cuts off likely attacker sessions, preserves evidence, and checks for additional persistence or data access. The scenario asks: PBQ-style scenario: An account has implausible logins followed by a new mailbox rule. Which sequence is the best first response? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | PBQ-style scenario: An account has implausible logins followed by a new mailbox rule. Which sequence is the best first response? |
| Selected response | Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence |
| Reason it fits | The sequence verifies whether access is legitimate, cuts off likely attacker sessions, preserves evidence, and checks for additional persistence or data access. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Delete the mailbox rule only, leave sessions active, and close the alert
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is geographically implausible logins and an unexpected forwarding rule, which makes Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence the better response.
- It would leave continued attacker access and incomplete incident scope unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
C. Disable all employee accounts, erase the mailbox, and discard the logs
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is geographically implausible logins and an unexpected forwarding rule, which makes Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence the better response.
- It would leave continued attacker access and incomplete incident scope unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
D. Wait for the user to report data loss before taking action
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is geographically implausible logins and an unexpected forwarding rule, which makes Validate the user and session, revoke suspicious sessions or contain the account, preserve logs, then investigate access and persistence the better response.
- It would leave continued attacker access and incomplete incident scope unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
References: NIST SP 800-61 Rev. 3 Incident Response Recommendations; SY0-801 draft objectives.
PBQ-style scenario: A host is encrypting files and displaying a ransom demand. Which response sequence is best?
A. Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups
B. Pay immediately, reconnect the host, and delete the security alerts
C. Power off every device in the organization, erase logs, and restore all data without checking backups
D. Wait for encryption to finish, then ask the user to reboot
Why this is correct: Answer A — Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups. Isolation can slow spread, incident coordination preserves evidence, scoping identifies affected systems, and recovery should use verified clean backups after containment. The scenario asks: PBQ-style scenario: A host is encrypting files and displaying a ransom demand. Which response sequence is best? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | PBQ-style scenario: A host is encrypting files and displaying a ransom demand. Which response sequence is best? |
| Selected response | Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups |
| Reason it fits | Isolation can slow spread, incident coordination preserves evidence, scoping identifies affected systems, and recovery should use verified clean backups after containment. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Pay immediately, reconnect the host, and delete the security alerts:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is files are being encrypted and payment is demanded, which makes Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups the better response.
It would leave ransomware spreading and recovery from compromised data unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
C. Power off every device in the organization, erase logs, and restore all data without checking backups:
This option is primarily designed to restore data or services after loss or disruption.
The key clue is files are being encrypted and payment is demanded, which makes Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups the better response.
It would leave ransomware spreading and recovery from compromised data unresolved.
Choose it when the main need is to recover services after an outage.
D. Wait for encryption to finish, then ask the user to reboot:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is files are being encrypted and payment is demanded, which makes Isolate the affected host, alert incident response, preserve relevant evidence, assess scope, and recover from verified clean backups the better response.
It would leave ransomware spreading and recovery from compromised data unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
References: CISA Incident Response Resources; SY0-801 draft objectives.
A user receives an unexpected attachment that launches a macro and downloads a second-stage payload. Which vector enabled the compromise?
A. Malicious email attachment
B. DNSSEC validation
C. Secure boot
D. Data masking
Why this is correct: Answer A — Malicious email attachment. The attachment acted as the initial delivery vector and the macro initiated additional code. Email filtering, macro restrictions, and endpoint monitoring can reduce this risk. The scenario asks: A user receives an unexpected attachment that launches a macro and downloads a second-stage payload. Which vector enabled the compromise? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Malicious email attachment acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A user receives an unexpected attachment that launches a macro and downloads a second-stage payload. Which vector enabled the compromise? |
| Selected response | Malicious email attachment |
| Reason it fits | The attachment acted as the initial delivery vector and the macro initiated additional code. Email filtering, macro restrictions, and endpoint monitoring can reduce this risk. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Malicious email attachment because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. DNSSEC validation |
|
| C. Secure boot |
|
| D. Data masking |
|
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
A vulnerability scanner reports a critical issue, but the affected software is not installed on the asset. What should the analyst do?
A. Validate the asset and finding, then close or correct the record with evidence
B. Patch every server regardless of inventory
C. Ignore all scanner findings in the future
D. Disable the scanner
Why this is correct: Answer A — Validate the asset and finding, then close or correct the record with evidence. A finding must be validated against the actual asset and software inventory. Correcting a false positive preserves accurate risk prioritization without dismissing the scanning program. The scenario asks: A vulnerability scanner reports a critical issue, but the affected software is not installed on the asset. What should the analyst do? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Validate the asset and finding, then close or correct the record with evidence acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A vulnerability scanner reports a critical issue, but the affected software is not installed on the asset. What should the analyst do? |
| Selected response | Validate the asset and finding, then close or correct the record with evidence |
| Reason it fits | A finding must be validated against the actual asset and software inventory. Correcting a false positive preserves accurate risk prioritization without dismissing the scanning program. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Validate the asset and finding, then close or correct the record with evidence because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Patch every server regardless of inventory:
This option is primarily designed to identify or correct a known software weakness.
The key clue is the scan result conflicts with inventory evidence, which makes Validate the asset and finding, then close or correct the record with evidence the better response.
It would leave wasted remediation effort and inaccurate risk records unresolved.
Choose it when the main need is to remediate a known vulnerability.
C. Ignore all scanner findings in the future:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the scan result conflicts with inventory evidence, which makes Validate the asset and finding, then close or correct the record with evidence the better response.
It would leave wasted remediation effort and inaccurate risk records unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
D. Disable the scanner:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the scan result conflicts with inventory evidence, which makes Validate the asset and finding, then close or correct the record with evidence the better response.
It would leave wasted remediation effort and inaccurate risk records unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A cloud storage bucket is publicly readable because of an overly permissive access policy. What is the primary issue?
A. Misconfiguration exposing data to unauthorized users
B. A denial-of-service attack
C. A hardware failure
D. A certificate revocation event
Why this is correct: Answer A — Misconfiguration exposing data to unauthorized users. Public read access is a cloud configuration error that can expose stored data. The team should restrict access, review exposure logs, and assess whether information was accessed. The scenario asks: A cloud storage bucket is publicly readable because of an overly permissive access policy. What is the primary issue? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A cloud storage bucket is publicly readable because of an overly permissive access policy. What is the primary issue? |
| Selected response | Misconfiguration exposing data to unauthorized users |
| Reason it fits | Public read access is a cloud configuration error that can expose stored data. The team should restrict access, review exposure logs, and assess whether information was accessed. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Misconfiguration exposing data to unauthorized users acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Misconfiguration exposing data to unauthorized users because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. A denial-of-service attack
- This option is primarily designed to address a different security objective.
- The key clue is the bucket permits public reading, which makes Misconfiguration exposing data to unauthorized users the better response.
- It would leave unauthorized disclosure of stored data unresolved.
- Choose it when the main need is to address the different objective.
C. A hardware failure
- This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
- The key clue is the bucket permits public reading, which makes Misconfiguration exposing data to unauthorized users the better response.
- It would leave unauthorized disclosure of stored data unresolved.
- Choose it when the main need is to assess or control AI-related risk.
D. A certificate revocation event
- This option is primarily designed to establish or verify cryptographic identity and trust.
- The key clue is the bucket permits public reading, which makes Misconfiguration exposing data to unauthorized users the better response.
- It would leave unauthorized disclosure of stored data unresolved.
- Choose it when the main need is to validate a key or signer.
References: CISA Cloud Security Technical Reference Architecture; SY0-801 draft objectives.
A developer’s test model was trained on poisoned data, causing it to classify malicious inputs as safe. Which AI risk is illustrated?
A. Data poisoning or model poisoning
B. Prompt injection only
C. Hallucination only
D. Model explainability
Why this is correct: Answer A — Data poisoning or model poisoning. Poisoned training data can manipulate model behavior, including its classifications. The organization should validate data provenance, monitor model behavior, and test for integrity issues. The scenario asks: A developer’s test model was trained on poisoned data, causing it to classify malicious inputs as safe. Which AI risk is illustrated? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Data poisoning or model poisoning acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A developer’s test model was trained on poisoned data, causing it to classify malicious inputs as safe. Which AI risk is illustrated? |
| Selected response | Data poisoning or model poisoning |
| Reason it fits | Poisoned training data can manipulate model behavior, including its classifications. The organization should validate data provenance, monitor model behavior, and test for integrity issues. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Data poisoning or model poisoning because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Prompt injection only:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is training data was deliberately manipulated, which makes Data poisoning or model poisoning the better response.
It would leave unsafe model decisions unresolved.
Choose it when the main need is to assess or control AI-related risk.
C. Hallucination only:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is training data was deliberately manipulated, which makes Data poisoning or model poisoning the better response.
It would leave unsafe model decisions unresolved.
Choose it when the main need is to assess or control AI-related risk.
D. Model explainability:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is training data was deliberately manipulated, which makes Data poisoning or model poisoning the better response.
It would leave unsafe model decisions unresolved.
Choose it when the main need is to assess or control AI-related risk.
References: NIST AI Risk Management Framework; SY0-801 draft objectives.
A user tells a chatbot to ignore its system instructions and reveal confidential data. What attack is being attempted?
A. Prompt injection
B. Cross-site scripting
C. ARP spoofing
D. Downgrade attack
Why this is correct: Answer A — Prompt injection. Prompt injection attempts to manipulate an AI system through crafted instructions, potentially causing it to disregard intended safeguards or expose data. Input isolation and access controls are still needed around connected tools and information. The scenario asks: A user tells a chatbot to ignore its system instructions and reveal confidential data. What attack is being attempted? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Prompt injection acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A user tells a chatbot to ignore its system instructions and reveal confidential data. What attack is being attempted? |
| Selected response | Prompt injection |
| Reason it fits | Prompt injection attempts to manipulate an AI system through crafted instructions, potentially causing it to disregard intended safeguards or expose data. Input isolation and access controls are still needed around connected tools and information. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Prompt injection because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Cross-site scripting
- This option is primarily designed to address a different security objective.
- The key clue is the prompt tries to override intended instructions, which makes Prompt injection the better response.
- It would leave unauthorized disclosure or action by an AI system unresolved.
- Choose it when the main need is to address the different objective.
C. ARP spoofing
- This option is primarily designed to address a different security objective.
- The key clue is the prompt tries to override intended instructions, which makes Prompt injection the better response.
- It would leave unauthorized disclosure or action by an AI system unresolved.
- Choose it when the main need is to address the different objective.
D. Downgrade attack
- This option is primarily designed to address a different security objective.
- The key clue is the prompt tries to override intended instructions, which makes Prompt injection the better response.
- It would leave unauthorized disclosure or action by an AI system unresolved.
- Choose it when the main need is to address the different objective.
References: NIST AI Risk Management Framework; SY0-801 draft objectives.
An attacker alters a facial video to make it appear that a finance director approved a wire transfer. What risk is most directly involved?
A. Deepfake-enabled impersonation
B. A buffer overflow
C. A hardware trojan
D. Data remanence
Why this is correct: Answer A — Deepfake-enabled impersonation. A manipulated media artifact can support impersonation and social engineering. High-risk approvals should rely on independent verification through a trusted channel, not solely on a video or voice message. The scenario asks: An attacker alters a facial video to make it appear that a finance director approved a wire transfer. What risk is most directly involved? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An attacker alters a facial video to make it appear that a finance director approved a wire transfer. What risk is most directly involved? |
| Selected response | Deepfake-enabled impersonation |
| Reason it fits | A manipulated media artifact can support impersonation and social engineering. High-risk approvals should rely on independent verification through a trusted channel, not solely on a video or voice message. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Deepfake-enabled impersonation acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Deepfake-enabled impersonation because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. A buffer overflow |
|
| C. A hardware trojan |
|
| D. Data remanence |
|
References: CISA phishing guidance; SY0-801 draft objectives.
A server is repeatedly queried for a nonexistent hostname after a typo-squatted domain appears in user reports. Which threat is most likely?
A. Users may be directed to a deceptive lookalike domain
B. A certificate authority has revoked every certificate
C. A database backup is corrupted
D. An IPS has blocked all outbound traffic
Why this is correct: Answer A — Users may be directed to a deceptive lookalike domain. A typo-squatted domain resembles a legitimate name and can capture mistyped traffic or credentials. The team should block the domain and notify users while checking for exposure. The scenario asks: A server is repeatedly queried for a nonexistent hostname after a typo-squatted domain appears in user reports. Which threat is most likely? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Users may be directed to a deceptive lookalike domain acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A server is repeatedly queried for a nonexistent hostname after a typo-squatted domain appears in user reports. Which threat is most likely? |
| Selected response | Users may be directed to a deceptive lookalike domain |
| Reason it fits | A typo-squatted domain resembles a legitimate name and can capture mistyped traffic or credentials. The team should block the domain and notify users while checking for exposure. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Users may be directed to a deceptive lookalike domain because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. A certificate authority has revoked every certificate
- This option is primarily designed to establish or verify cryptographic identity and trust.
- The key clue is the domain closely resembles a trusted one, which makes Users may be directed to a deceptive lookalike domain the better response.
- It would leave credential theft or malicious downloads unresolved.
- Choose it when the main need is to validate a key or signer.
C. A database backup is corrupted
- This option is primarily designed to restore data or services after loss or disruption.
- The key clue is the domain closely resembles a trusted one, which makes Users may be directed to a deceptive lookalike domain the better response.
- It would leave credential theft or malicious downloads unresolved.
- Choose it when the main need is to recover services after an outage.
D. An IPS has blocked all outbound traffic
- This option is primarily designed to address a different security objective.
- The key clue is the domain closely resembles a trusted one, which makes Users may be directed to a deceptive lookalike domain the better response.
- It would leave credential theft or malicious downloads unresolved.
- Choose it when the main need is to address the different objective.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
| Page 4 out of 15 Pages |
PREPARE BY TOPICS
Choose a topic to practice questions related to that specific exam topic.