Free CompTIA SY0-801 Practice Questions 2026 - Page 5
AI risks and malicious indicators
A compromised application process launches a shell through an unusual parent-child relationship. What kind of evidence is this?
A. An endpoint indicator of suspicious execution
B. Proof that a firewall rule is correct
C. Evidence of an approved change
D. A certificate chain
Why this is correct: Answer A — An endpoint indicator of suspicious execution. Unexpected process relationships can indicate exploitation or post-compromise activity. Analysts should correlate the event with command-line, network, and user context before drawing conclusions. The scenario asks: A compromised application process launches a shell through an unusual parent-child relationship. What kind of evidence is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that An endpoint indicator of suspicious execution acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A compromised application process launches a shell through an unusual parent-child relationship. What kind of evidence is this? |
| Selected response | An endpoint indicator of suspicious execution |
| Reason it fits | Unexpected process relationships can indicate exploitation or post-compromise activity. Analysts should correlate the event with command-line, network, and user context before drawing conclusions. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is An endpoint indicator of suspicious execution because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Proof that a firewall rule is correct:
This option is primarily designed to restrict or control network communication.
The key clue is an unusual process tree is observed, which makes An endpoint indicator of suspicious execution the better response.
It would leave malicious activity continuing unnoticed unresolved.
Choose it when the main need is to limit or monitor network paths.
C. Evidence of an approved change:
This option is primarily designed to control a planned production change.
The key clue is an unusual process tree is observed, which makes An endpoint indicator of suspicious execution the better response.
It would leave malicious activity continuing unnoticed unresolved.
Choose it when the main need is to manage a system change with approval and rollback.
D. A certificate chain:
This option is primarily designed to establish or verify cryptographic identity and trust.
The key clue is an unusual process tree is observed, which makes An endpoint indicator of suspicious execution the better response.
It would leave malicious activity continuing unnoticed unresolved.
Choose it when the main need is to validate a key or signer.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
An attacker exploits a flaw before a vendor has released a patch. What term best describes the vulnerability at that point?
A. Zero-day vulnerability
B. False positive
C. Known-good baseline
D. End-of-life system
Why this is correct: Answer A — Zero-day vulnerability. A zero-day vulnerability is unknown to or unaddressed by the vendor at the time of exploitation or disclosure. Defenders may need mitigations such as isolation, configuration changes, or detection rules until a fix exists. The scenario asks: An attacker exploits a flaw before a vendor has released a patch. What term best describes the vulnerability at that point? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An attacker exploits a flaw before a vendor has released a patch. What term best describes the vulnerability at that point? |
| Selected response | Zero-day vulnerability |
| Reason it fits | A zero-day vulnerability is unknown to or unaddressed by the vendor at the time of exploitation or disclosure. Defenders may need mitigations such as isolation, configuration changes, or detection rules until a fix exists. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Zero-day vulnerability acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Zero-day vulnerability because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. False positive
- This option is primarily designed to address a different security objective.
- The key clue is there is no available vendor patch, which makes Zero-day vulnerability the better response.
- It would leave exploitation before normal remediation is possible unresolved.
- Choose it when the main need is to address the different objective.
C. Known-good baseline
- This option is primarily designed to address a different security objective.
- The key clue is there is no available vendor patch, which makes Zero-day vulnerability the better response.
- It would leave exploitation before normal remediation is possible unresolved.
- Choose it when the main need is to address the different objective.
D. End-of-life system
- This option is primarily designed to address a different security objective.
- The key clue is there is no available vendor patch, which makes Zero-day vulnerability the better response.
- It would leave exploitation before normal remediation is possible unresolved.
- Choose it when the main need is to address the different objective.
References: CISA Known Exploited Vulnerabilities Catalog; SY0-801 draft objectives.
A malicious browser extension reads page contents and sends them to an external server. What is the main risk?
A. Data exfiltration through a compromised or overprivileged extension
B. Certificate pinning
C. Secure boot
D. Tokenization
Why this is correct: Answer A — Data exfiltration through a compromised or overprivileged extension. A browser extension with excessive permissions can access sensitive page content and transmit it externally. Restrict extension installation and review permissions and network behavior. The scenario asks: A malicious browser extension reads page contents and sends them to an external server. What is the main risk? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Data exfiltration through a compromised or overprivileged extension acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A malicious browser extension reads page contents and sends them to an external server. What is the main risk? |
| Selected response | Data exfiltration through a compromised or overprivileged extension |
| Reason it fits | A browser extension with excessive permissions can access sensitive page content and transmit it externally. Restrict extension installation and review permissions and network behavior. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Data exfiltration through a compromised or overprivileged extension because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Certificate pinning:
This option is primarily designed to establish or verify cryptographic identity and trust.
The key clue is the extension can read pages and communicate externally, which makes Data exfiltration through a compromised or overprivileged extension the better response.
It would leave loss of confidentiality through browser activity unresolved.
Choose it when the main need is to validate a key or signer.
C. Secure boot:
This option is primarily designed to address a different security objective.
The key clue is the extension can read pages and communicate externally, which makes Data exfiltration through a compromised or overprivileged extension the better response.
It would leave loss of confidentiality through browser activity unresolved.
Choose it when the main need is to address the different objective.
D. Tokenization:
This option is primarily designed to control the handling, exposure, or lifecycle of information.
The key clue is the extension can read pages and communicate externally, which makes Data exfiltration through a compromised or overprivileged extension the better response.
It would leave loss of confidentiality through browser activity unresolved.
Choose it when the main need is to control data use or disclosure.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
A user clicks a link that silently submits a bank transfer request using the user’s active browser session. Which web attack is most likely?
A. Cross-site request forgery
B. SQL injection
C. Directory traversal
D. DNS amplification
Why this is correct: Answer A — Cross-site request forgery. Cross-site request forgery abuses a user’s authenticated session to trigger an unwanted action. Anti-CSRF tokens, origin checks, and appropriate cookie settings help protect state-changing requests. The scenario asks: A user clicks a link that silently submits a bank transfer request using the user’s active browser session. Which web attack is most likely? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Cross-site request forgery acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A user clicks a link that silently submits a bank transfer request using the user’s active browser session. Which web attack is most likely? |
| Selected response | Cross-site request forgery |
| Reason it fits | Cross-site request forgery abuses a user’s authenticated session to trigger an unwanted action. Anti-CSRF tokens, origin checks, and appropriate cookie settings help protect state-changing requests. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Cross-site request forgery because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. SQL injection |
|
| C. Directory traversal |
|
| D. DNS amplification |
|
References: OWASP Cheat Sheet Series; SY0-801 draft objectives.
A web page displays attacker-supplied script in another user’s browser. Which vulnerability is likely?
A. Cross-site scripting
B. Server-side request forgery
C. Password spraying
D. ARP poisoning
Why this is correct: Answer A — Cross-site scripting. Cross-site scripting occurs when untrusted content is rendered as executable script in a user’s browser. Context-aware output encoding and safe templating reduce the risk. The scenario asks: A web page displays attacker-supplied script in another user’s browser. Which vulnerability is likely? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A web page displays attacker-supplied script in another user’s browser. Which vulnerability is likely? |
| Selected response | Cross-site scripting |
| Reason it fits | Cross-site scripting occurs when untrusted content is rendered as executable script in a user’s browser. Context-aware output encoding and safe templating reduce the risk. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Cross-site scripting acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Cross-site scripting because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Server-side request forgery:
This option is primarily designed to address a different security objective.
The key clue is untrusted input executes in the browser, which makes Cross-site scripting the better response.
It would leave theft of session data or actions as the user unresolved.
Choose it when the main need is to address the different objective.
C. Password spraying:
This option is primarily designed to authenticate or protect access to an account.
The key clue is untrusted input executes in the browser, which makes Cross-site scripting the better response.
It would leave theft of session data or actions as the user unresolved.
Choose it when the main need is to secure account access.
D. ARP poisoning:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is untrusted input executes in the browser, which makes Cross-site scripting the better response.
It would leave theft of session data or actions as the user unresolved.
Choose it when the main need is to assess or control AI-related risk.
References: OWASP Cheat Sheet Series; SY0-801 draft objectives.
A company sees a sudden spike in traffic that makes its public service unavailable. What attack should be considered first?
A. Denial of service
B. Data masking
C. Key escrow
D. Privilege creep
Why this is correct: Answer A — Denial of service. A denial-of-service attack overwhelms resources or exploits a service so legitimate users cannot access it. The response should examine traffic patterns, service health, and upstream mitigation options. The scenario asks: A company sees a sudden spike in traffic that makes its public service unavailable. What attack should be considered first? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Denial of service acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company sees a sudden spike in traffic that makes its public service unavailable. What attack should be considered first? |
| Selected response | Denial of service |
| Reason it fits | A denial-of-service attack overwhelms resources or exploits a service so legitimate users cannot access it. The response should examine traffic patterns, service health, and upstream mitigation options. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Denial of service because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Data masking
- This option is primarily designed to control the handling, exposure, or lifecycle of information.
- The key clue is traffic spikes coincide with loss of service, which makes Denial of service the better response.
- It would leave legitimate users cannot reach the service unresolved.
- Choose it when the main need is to control data use or disclosure.
C. Key escrow
- This option is primarily designed to address a different security objective.
- The key clue is traffic spikes coincide with loss of service, which makes Denial of service the better response.
- It would leave legitimate users cannot reach the service unresolved.
- Choose it when the main need is to address the different objective.
D. Privilege creep
- This option is primarily designed to grant, restrict, or review user permissions.
- The key clue is traffic spikes coincide with loss of service, which makes Denial of service the better response.
- It would leave legitimate users cannot reach the service unresolved.
- Choose it when the main need is to limit or review identity permissions.
References: CISA Incident Response Resources; SY0-801 draft objectives.
An attacker uses a compromised workstation to move from one server to another using valid credentials. What behavior is this?
A. Lateral movement
B. Data classification
C. Key rotation
D. Failover
Why this is correct: Answer A — Lateral movement. Lateral movement is activity used to move through an environment after initial access. Monitoring authentication patterns, privileged access, and endpoint telemetry can expose it. The scenario asks: An attacker uses a compromised workstation to move from one server to another using valid credentials. What behavior is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Lateral movement acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An attacker uses a compromised workstation to move from one server to another using valid credentials. What behavior is this? |
| Selected response | Lateral movement |
| Reason it fits | Lateral movement is activity used to move through an environment after initial access. Monitoring authentication patterns, privileged access, and endpoint telemetry can expose it. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Lateral movement because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Data classification:
This option is primarily designed to control the handling, exposure, or lifecycle of information.
The key clue is a compromised host is used to reach other systems, which makes Lateral movement the better response.
It would leave expansion of attacker access across the network unresolved.
Choose it when the main need is to control data use or disclosure.
C. Key rotation:
This option is primarily designed to address a different security objective.
The key clue is a compromised host is used to reach other systems, which makes Lateral movement the better response.
It would leave expansion of attacker access across the network unresolved.
Choose it when the main need is to address the different objective.
D. Failover:
This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
The key clue is a compromised host is used to reach other systems, which makes Lateral movement the better response.
It would leave expansion of attacker access across the network unresolved.
Choose it when the main need is to assess or control AI-related risk.
References: MITRE ATT&CK knowledge base; SY0-801 draft objectives.
A log shows a service account authenticating interactively from a user workstation, despite policy forbidding that use. What is the best interpretation?
A. Potential misuse or compromise requiring investigation
B. A guaranteed false positive
C. Successful certificate renewal
D. Proof of a completed backup
Why this is correct: Answer A — Potential misuse or compromise requiring investigation. Service accounts should be used only for their approved purpose. Interactive logon from an unusual host is an anomaly that merits validation and containment based on evidence. The scenario asks: A log shows a service account authenticating interactively from a user workstation, despite policy forbidding that use. What is the best interpretation? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A log shows a service account authenticating interactively from a user workstation, despite policy forbidding that use. What is the best interpretation? |
| Selected response | Potential misuse or compromise requiring investigation |
| Reason it fits | Service accounts should be used only for their approved purpose. Interactive logon from an unusual host is an anomaly that merits validation and containment based on evidence. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Potential misuse or compromise requiring investigation acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Potential misuse or compromise requiring investigation because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. A guaranteed false positive
- This option is primarily designed to address a different security objective.
- The key clue is service account behavior violates its expected pattern, which makes Potential misuse or compromise requiring investigation the better response.
- It would leave unnoticed misuse of a high-privilege identity unresolved.
- Choose it when the main need is to address the different objective.
C. Successful certificate renewal
- This option is primarily designed to establish or verify cryptographic identity and trust.
- The key clue is service account behavior violates its expected pattern, which makes Potential misuse or compromise requiring investigation the better response.
- It would leave unnoticed misuse of a high-privilege identity unresolved.
- Choose it when the main need is to validate a key or signer.
D. Proof of a completed backup
- This option is primarily designed to restore data or services after loss or disruption.
- The key clue is service account behavior violates its expected pattern, which makes Potential misuse or compromise requiring investigation the better response.
- It would leave unnoticed misuse of a high-privilege identity unresolved.
- Choose it when the main need is to recover services after an outage.
References: NIST SP 800-61 Rev. 3 Incident Response Recommendations; SY0-801 draft objectives.
A company discovers an exposed remote management service with default credentials. What immediate action best reduces risk?
A. Restrict network exposure and replace the default credentials with strong unique credentials
B. Publish the service address for transparency
C. Turn off audit logging
D. Add the default credentials to a password vault and keep them
Why this is correct: Answer A — Restrict network exposure and replace the default credentials with strong unique credentials. The service should be isolated from unnecessary networks and the known default credentials replaced. The team should then review access logs for evidence of misuse. The scenario asks: A company discovers an exposed remote management service with default credentials. What immediate action best reduces risk? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Restrict network exposure and replace the default credentials with strong unique credentials acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company discovers an exposed remote management service with default credentials. What immediate action best reduces risk? |
| Selected response | Restrict network exposure and replace the default credentials with strong unique credentials |
| Reason it fits | The service should be isolated from unnecessary networks and the known default credentials replaced. The team should then review access logs for evidence of misuse. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Restrict network exposure and replace the default credentials with strong unique credentials because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. Publish the service address for transparency |
|
| C. Turn off audit logging |
|
| D. Add the default credentials to a password vault and keep them |
|
References: CISA Secure by Design and Secure by Default guidance; SY0-801 draft objectives.
A vulnerability report lists a severe flaw on a public-facing asset that is actively exploited, but a fix requires testing. What is the sound response?
A. Apply a compensating mitigation now, then test and deploy the patch promptly
B. Defer action until the next quarterly review
C. Delete the asset from inventory
D. Assume a firewall makes the flaw irrelevant
Why this is correct: Answer A — Apply a compensating mitigation now, then test and deploy the patch promptly. Active exploitation and internet exposure create urgency. A risk-approved mitigation can reduce exposure while the patch is tested and deployed as quickly as practical. The scenario asks: A vulnerability report lists a severe flaw on a public-facing asset that is actively exploited, but a fix requires testing. What is the sound response? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Apply a compensating mitigation now, then test and deploy the patch promptly acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A vulnerability report lists a severe flaw on a public-facing asset that is actively exploited, but a fix requires testing. What is the sound response? |
| Selected response | Apply a compensating mitigation now, then test and deploy the patch promptly |
| Reason it fits | Active exploitation and internet exposure create urgency. A risk-approved mitigation can reduce exposure while the patch is tested and deployed as quickly as practical. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Apply a compensating mitigation now, then test and deploy the patch promptly because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Defer action until the next quarterly review
- This option is primarily designed to address a different security objective.
- The key clue is the flaw is exposed and actively exploited, which makes Apply a compensating mitigation now, then test and deploy the patch promptly the better response.
- It would leave compromise during the patch testing delay unresolved.
- Choose it when the main need is to address the different objective.
C. Delete the asset from inventory
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is the flaw is exposed and actively exploited, which makes Apply a compensating mitigation now, then test and deploy the patch promptly the better response.
- It would leave compromise during the patch testing delay unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
D. Assume a firewall makes the flaw irrelevant
- This option is primarily designed to defer, remove, or bypass a control or response.
- The key clue is the flaw is exposed and actively exploited, which makes Apply a compensating mitigation now, then test and deploy the patch promptly the better response.
- It would leave compromise during the patch testing delay unresolved.
- Choose it when the main need is to follow an approved plan that calls for the action.
References: CISA Known Exploited Vulnerabilities Catalog; SY0-801 draft objectives.
| Page 5 out of 15 Pages |
PREPARE BY TOPICS
Choose a topic to practice questions related to that specific exam topic.