General Security Concepts

SY0-801 · 48 questions

• A retailer protects its customer-facing web application solely with a web application firewall (WAF). During a penetration test, the tester slips an encoded injection payload past the WAF and reaches the backend database directly. Which approach would BEST limit the damage from a future WAF bypass?
• An attacker gains write access to an accounting database and quietly changes the amounts on several outstanding invoices. Logs show that no records were exported and nothing was viewed beyond what was needed to make the edits. Which security property was PRIMARILY violated?
• During peak season, a travel company's online booking portal is flooded with traffic from thousands of compromised hosts and becomes unreachable for customers. No data was accessed or altered. Which control BEST addresses the security property that was affected?
• Network engineers share a single root login on all core switches. After an outage caused by a configuration change, an auditor cannot determine which engineer made the change. Which remediation addresses the gap?
• An employee signs in to the corporate domain with valid credentials and completes MFA, then receives an access-denied message when opening the payroll file share. Which function of AAA produced the denial?
• A manager approved a large wire transfer by email and later claims he never sent the approval. The organization wants future approvals to be provably attributable to the person who gave them. Which control provides this?
• A remote employee connects to the corporate VPN but is still prompted to authenticate and pass a device-health check before each internal application opens. The employee asks why being on the VPN is not enough. Which principle explains this behavior?
• An architect designing a Zero Trust model separates the component that evaluates identity, device posture, and policy to decide whether a request is allowed from the component that actually opens or blocks the connection to the resource. Which component makes the access decision?
• Help desk technicians were added to the Domain Admins group so they could reset user passwords. A security review flags the practice. Which change BEST applies the principle of least privilege?
• A security manager is cataloging three controls: a locked server-room door, a firewall rule that blocks inbound Telnet, and a written acceptable use policy. Which classification of these controls, in that order, is correct?
• Each quarter, IT operations staff follow a documented procedure to review user accounts and remove any access that managers no longer approve. The review is carried out by people rather than enforced automatically by a system. Which control category BEST describes this access review?
• A login screen on every corporate workstation displays a banner stating that activity is monitored and that unauthorized use will be prosecuted. Which control type does the banner represent?
• A legacy manufacturing control system cannot support multifactor authentication. The security team places it on an isolated VLAN reachable only through a hardened jump host that does enforce MFA. Which control type does this arrangement represent?
• After ransomware encrypts a file server, administrators wipe the server and restore the data from the previous night's immutable backup. Which control type does the restoration represent?
• A warehouse uses motion sensors that write an alert to the security log when movement occurs after hours, and guards review recorded camera footage after a break-in to identify the intruder. Which control type do both of these represent?
• A company security policy states that all laptops must be configured with full disk encryption before they are issued to employees. Which control type is the policy statement itself?
• A data center installs bollards and a perimeter fence to keep vehicles and pedestrians away from the building and posts signs warning of video surveillance. Which control type do the bollards PRIMARILY provide?
• An organization relies on a strong perimeter firewall but has a flat internal network with no endpoint protection. A malicious insider moves freely from a workstation to file servers and the HR database. What is the PRIMARY gap in the security design?
• At noon on a weekday, a network engineer modifies the edge firewall rules without submitting a change request, and remote VPN users lose connectivity for two hours. What was the ROOT process failure?
• A change ticket to replace a load balancer certificate has no named owner, and the application team whose mobile app relies on certificate pinning was never notified. After the change, the mobile app stops connecting. Which change management elements were missing?
• A critical patch is scheduled for a database server shared by finance, HR, and sales applications. Before the change advisory board approves it, which step identifies the services, users, and risks affected by the change?
• The change advisory board is reviewing a request to roll out a new endpoint agent to all workstations. Board members want evidence that the agent will not break line-of-business applications before they approve production deployment. What should the requester provide?
• Halfway through a scheduled maintenance window, a firmware upgrade on a core router fails and the device stops passing traffic. The window closes in one hour. What should the team do according to change management best practice?
• A database schema migration has converted production tables to a new format, and the old format cannot be restored without losing transactions entered since go-live. A defect appears shortly after the change. Which approach is the team MOST likely to take?
• An e-commerce platform runs 24x7 and must apply operating system patches that require a reboot. Which approach BEST balances security and business impact?
• IT deploys a new version of a reporting tool to finance workstations. The next morning users cannot launch it, and endpoint logs show the executable was blocked by application control. The change ticket made no mention of application control. What was overlooked in planning the change?
• An administrator plans to replace an expiring TLS certificate on a production web server. The web service loads certificates only when it starts. What should the change request account for?
• A security team disables TLS 1.0 on an internal web server. A legacy reporting application that connects to the server stops working because it supports only TLS 1.0. Which change management activity would MOST likely have caught this before the change?
• Months after a network was re-segmented into new VLANs, incident responders investigating malware follow outdated diagrams and isolate the wrong switch ports. Which step was missed when the segmentation change was closed out?
• Two administrators edit the same firewall configuration script stored on a shared drive. One overwrites the other's changes, and no one can tell which rules were removed or restore the earlier copy. Which practice BEST prevents this?
• A user wants colleagues to be able to send her encrypted email that only she can read. Which key will her colleagues use to encrypt messages to her?
• An organization encrypts sensitive project files with keys issued to individual employees. Legal requires that the company be able to recover the encrypted data if an employee leaves or loses a key. Which mechanism meets this requirement?
• A browser must check whether a server certificate has been revoked at the moment of connection, without downloading the certificate authority's entire list of revoked serial numbers. Which mechanism should it use?
• Customers visiting a company's new public storefront see browser warnings that the site is not trusted, even though the connection is encrypted. The administrator generated the certificate on the web server itself. What is the BEST fix?
• An IoT device verifies each stage of its firmware before running it, beginning with a public key permanently stored in tamper-resistant hardware. Why is that hardware-stored key essential to the design?
• An administrator needs a certificate from a public certificate authority for a new web server. What should the administrator do FIRST?
• An organization wants a single certificate covering shop.example.com, mail.example.com, and www.example.com, and it expects to add more first-level subdomains of example.com over time. Which certificate type fits BEST?
• An administrator must encrypt a very large nightly backup file quickly before sending it to an offsite storage provider. Which approach is MOST appropriate for encrypting the bulk data?
• Two systems that have never communicated before must agree on a symmetric session key over an untrusted network without ever transmitting the key itself. Which technique accomplishes this?
• Laptops used by field auditors hold client workpapers, and temporary files and swap space may contain sensitive fragments. If a laptop is stolen, no data on it can be readable. Which encryption level BEST meets this requirement?
• A customer table holds names, addresses, order history, and Social Security numbers. Policy requires that only the SSN values be encrypted so other fields stay searchable for support staff. Which encryption level fits this requirement?
• A web application's login page submits credentials over plain HTTP, and a packet capture on the local network shows usernames and passwords in cleartext. Which control directly protects the credentials while they are in transit?
• An auditor flags a VPN gateway that uses a short key length with an otherwise sound encryption algorithm. Why does increasing the key length improve security in this case?
• A software publisher wants customers to be able to verify that an installer genuinely came from the publisher and was not modified after release. Which solution provides both assurances?
• A review of a password database shows that two users with the same password have identical stored hashes, making both accounts easy targets for precomputed rainbow table lookups. Which change addresses this weakness?
• An administrator downloads an operating system ISO and wants to confirm the file was not corrupted or altered in transit. The vendor publishes a SHA-256 value for the file on its website. What should the administrator do?
• A developer minifies and renames the variables in a web app's client-side JavaScript to make it harder to reverse engineer. A manager then describes the code as encrypted. Which statement is accurate?
• A payment processor requires that cryptographic keys be generated and stored in dedicated, tamper-resistant hardware, with signing operations performed inside the device so the keys never leave it. Which tool meets this requirement?