Security Operations

SY0-801 · 81 questions

• Attackers compromised a lobby visitor kiosk and then reached the finance servers directly, because every device in the building sits on one flat network. Which mitigation most directly prevents an attacker from repeating that lateral path?
• A new server built from a vendor's default image goes live with the default administrator account enabled, sample web applications installed and several unused services listening on the network. Which action best reduces its attack surface?
• A security team wants to see what unknown email attachments actually do when opened, such as files they write or connections they attempt, without risking any production endpoint. Which mitigation should the team apply?
• After an intrusion in which attackers dumped stored credentials and reused them, a team wants an immediate, high-confidence alert the next time anyone tries to use harvested credentials. Which deception technique best meets this goal?
• A security research team wants to lure attackers into a convincing environment of several interconnected decoy servers and workstations so it can observe how they move laterally from one system to another. Which deception technology fits this goal?
• Public self-service kiosks in a store should run only the vendor's ordering application, yet staff keep finding unfamiliar executables on them that new malware variants have dropped. Which control most effectively prevents unauthorized programs from running on the kiosks?
• A network intrusion detection sensor connected to a mirrored switch port correctly alerted on exploit traffic aimed at a public web server, but it could not stop the traffic. The team now wants that traffic dropped automatically at the network perimeter. Which control should it deploy?
• Unauthorized wireless access points keep appearing in an office, plugged in by employees who want better coverage, and the security team wants them detected and automatically contained without walking the floor. Which control best fits?
• A public web API is being hit with sudden bursts of thousands of requests per second from a handful of clients, and the same application is also receiving SQL injection attempts in request parameters. Which single control best mitigates both problems?
• A perimeter firewall allows outbound TCP 443 for web browsing, but an unapproved file-sharing application and a tunneling tool both use port 443 and slip through. Staff must keep normal web access while those two applications are blocked. Which firewall capability is required?
• Employees' laptops frequently work from home and travel without connecting to the corporate VPN, and the company must stop sensitive files from being uploaded to personal cloud storage wherever the laptop happens to be. Which data loss prevention approach fits best?
• Analysts must manually stitch together alerts from endpoint, email, network and cloud tools to reconstruct each attack, and incidents are being missed between the tools. Which endpoint security approach best addresses this?
• Only corporate laptops that are authenticated and meet current patch and endpoint-protection requirements may connect to the wired network; non-compliant devices must be kept off until they are fixed. Which network access control approach meets this requirement?
• Developers keep accidentally committing cloud API keys and database passwords into the company's shared source code repository, and some of those keys were later abused. Which control most directly catches these credentials before they are exposed?
• Attackers are sending email that spoofs the company's exact domain to its customers. The company already publishes SPF and DKIM records, but receiving servers have no instruction on what to do when those checks fail, and the company receives no reports about such mail. Which step best addresses this?
• Linux web servers must confine the web server process with mandatory access control, so that even if the process is compromised it cannot read files outside its labeled context, regardless of standard file ownership. Which operating system security control fits?
• A company launches an asset management program, but one team tracks only hardware, another tracks software licenses and SaaS subscriptions, and nobody tracks datasets, so the inventories cannot be combined. Which asset life cycle activity was skipped?
• To save money, a team bought network switches from an unvetted online reseller, and an inspection later found counterfeit units running modified firmware. Which asset management control would most directly have prevented this?
• Several laptops have gone missing, and investigators cannot determine who last had them, because devices are handed out from a shared pool without any record of who receives them. Which asset management practice most directly fixes this accountability gap?
• Network scans keep discovering devices that are not in the asset inventory, while the inventory still lists hardware that was retired months ago. Which practice best keeps the inventory aligned with what actually exists?
• Hard drives from decommissioned servers were sold to an electronics recycler without any sanitization, and a researcher later recovered customer data from them. Which control should the company adopt for future disposal?
• A security manager is documenting the hardware asset management life cycle for new staff. Which sequence lists the stages in the correct order?
• A vulnerability scan run without credentials reports very few findings on a group of servers, yet administrators know those servers are missing several operating system patches and have weak local security settings. Which change will most improve the accuracy of future scans?
• A vulnerability manager discovers that the scanner's target list was built years ago from a spreadsheet, and a recent compromise involved an on-premises server on a subnet that had never been scanned. Which source would BEST establish the full set of address ranges and allocations in use so future scans cover every network?
• A company runs workloads in dozens of accounts across two public cloud providers. Audits keep finding storage buckets made public and security group rules opened to the internet, usually weeks after the change. Which solution would continuously detect these configuration problems across all accounts against defined policies?
• A development team is finishing a new payment module and wants to find insecure coding patterns and logic flaws, such as missing authorization checks, before the code is built and released. No test or production environment is running the module yet. Which vulnerability identification method fits this requirement?
• A vulnerability scan rates a flaw on an isolated lab host, which holds no sensitive data, at a CVSS base score of 9.8. The latest penetration test report shows testers chained two medium-severity findings on production servers to gain domain administrator rights. Which should the team remediate FIRST?
• A scan reveals a critical remotely exploitable flaw in a building management appliance that must stay in service. The vendor states that a patch will not be available for several months. Which action BEST reduces exposure now?
• An administrator deploys a vendor patch for a high-severity vulnerability to thirty servers, and the patch management console reports success on all of them. Which step provides verification that the vulnerability has actually been remediated?
• A CISO asks the vulnerability management team to prepare a quarterly report for the executive leadership committee, which decides on funding and risk acceptance. Which content is MOST appropriate for this internal report?
• An independent researcher emails a company's security team about a flaw in its public website. The company has no published process for outside reports, and management does not want to offer financial rewards. Which should the company establish so future reports arrive through a defined channel with agreed rules?
• A team already monitors CPU, memory, and disk usage on the hosts that run a customer portal. They now need to detect spikes in failed logins, error responses, and unusual transaction patterns produced by the portal itself. Which category of monitoring should they add?
• Analysts investigating incidents must log in to each of forty servers separately to read local logs, and correlating events across systems takes hours. Which activity would MOST improve their ability to investigate across all servers?
• A SIEM correlation rule fires hundreds of alerts every day when the organization's authorized vulnerability scanner runs its scheduled scans. Analysts have started ignoring the rule's alerts entirely. Which action BEST addresses the problem while preserving detection of real attacks?
• A regulation requires the organization to retain security logs for one year, but the SIEM's searchable storage holds only thirty days and management will not increase SIEM storage costs. Which activity BEST meets the requirement?
• A security team must routinely measure hundreds of servers against a published hardening benchmark and produce standardized, machine-readable compliance results. Which approach BEST fits this requirement?
• An organization needs to monitor the health and security events of network appliances and printers whose vendors do not allow third-party software to be installed on them. Which monitoring approach fits these devices?
• A network team needs months of data showing which internal hosts communicate with which external addresses, on which ports, and how much data moves, without storing packet payloads. Which source BEST meets this requirement?
• A network team must centralize event messages from routers and switches and also poll those devices for health statistics. Security policy requires that the polling protocol authenticate requests and encrypt its traffic. Which combination BEST meets these requirements?
• A security team deploys a passive network intrusion detection sensor and needs it to receive a copy of all traffic passing through an access switch without affecting the flow of production traffic if the sensor fails. Which configuration BEST meets this requirement?
• The executive leadership team wants a weekly at-a-glance view of the organization's security posture, including open critical vulnerabilities, incident counts, and patch compliance trends, without being interrupted by individual events. Which tool BEST meets this need?
• An audit finds that an employee terminated two weeks ago still has active VPN and SaaS accounts, and the help desk learned of the departure only through a later email. Which process change BEST ensures access is removed when people leave?
• A file server has thousands of permissions granted directly to individual user accounts. When employees change roles, their old permissions remain, and administrators cannot easily tell who should have what. Which approach BEST corrects this?
• A remote company issues laptops and accounts to new hires it has never met in person. A recent fraud case involved a person who used stolen personal details to get hired and obtain credentials. Which control BEST addresses this before credentials are issued?
• Employees need to sign in to a partner's browser-based SaaS application using their existing corporate credentials, and the company does not want user passwords stored by or sent to the partner. Which approach BEST meets this requirement?
• A third-party scheduling application needs to read users' corporate calendars through the provider's API. The company forbids users from giving their passwords to the application and wants access limited to calendar data and revocable by the user. Which technology BEST fits?
• An organization requires all administrative access through its cloud identity provider with MFA. Leadership worries that an outage of the identity provider or MFA service could lock administrators out of critical systems. Which control BEST addresses this concern?
• An attacker who compromised one workstation used its local administrator password to log in to dozens of other workstations, because every machine had the same local administrator password. Which control BEST prevents this lateral movement path?
• A user's phone, which held their only authenticator app, was lost on a trip, and they cannot complete MFA to sign in. During enrollment, the organization issued each user a set of single-use recovery values. Which response BEST restores access while keeping MFA in place?
• A government contractor's operating system assigns classification labels to files and clearance levels to users. A project lead who owns a secret-labeled file tries to share it with a colleague cleared only for confidential, and the system refuses. Which access control model is in use?
• Engineers occasionally need administrator rights on production servers to resolve change tickets. The security team wants no standing admin access, with elevation granted only for an approved ticket and removed automatically when the work window ends. Which access control approach BEST fits?
• A regulator requires the company to demonstrate each quarter that every user's access to its financial systems is still appropriate for their job. Which control BEST provides this evidence?
• Attackers using real-time phishing proxies have captured employees' passwords and the one-time codes from their authenticator apps. The organization wants an authentication method that a look-alike site cannot capture and replay. Which option BEST meets this goal?
• A password policy forces changes every thirty days, and an audit finds users choosing predictable patterns such as a season plus the year. Which policy change BEST aligns with current password best practices?
• New hires frequently start without the correct application access, while others receive access they should not have, because IT creates each account manually from email requests. Which automation use case BEST addresses this?
• Operations staff make undocumented changes to servers during troubleshooting, and over time many servers no longer match the approved security baseline. Which automation approach BEST keeps servers aligned with the baseline continuously?
• SOC analysts spend much of each shift copying SIEM alert details into the ticketing system by hand, and some alerts are never ticketed. Which automation BEST addresses this problem?
• An automated containment playbook isolated a production database server from the network after a false-positive alert, causing a significant outage. The team wants to keep automated containment for most endpoints. Which change BEST reduces this risk?
• An engineer proposes building custom orchestration code to automate a ten-minute manual task that runs twice a year. The code would need ongoing maintenance whenever the connected systems change. Which consideration should MOST influence the decision?
• A SOC deploys an AI tool that, without step-by-step prompting, pulls related logs, enriches indicators, decides whether an alert is benign, and closes or escalates the ticket on its own. Which AI capability is this, and what does it MOST require?
• A security team wants a system that learns each user's and host's normal activity patterns and flags deviations, such as unusual login times or data volumes, instead of relying on fixed thresholds. Which capability BEST matches this description?
• A development team deploys code to production many times a day, and security testing currently happens only in a manual review before each quarterly audit. Which change BEST integrates security into this delivery process?
• During a recent ransomware incident, responders argued over who could authorize taking systems offline, who would contact legal counsel, and in what order to act. Which preparation activity BEST prevents this confusion in future incidents?
• The executive team gathers in a conference room while a facilitator walks them through a hypothetical data breach, asking how they would respond at each stage. No systems are touched and no actions are actually taken. Which type of exercise is this?
• After reading a report about a new adversary technique, analysts form a hypothesis and proactively search endpoint and network telemetry for signs that the technique was used in their environment, even though no alert has fired. Which activity is this?
• A software vendor publishes a security advisory stating that its remote access product was exploited and listing indicators of compromise, including file hashes and attacker IP addresses. The organization runs that product. Which incident response activity should this advisory MOST directly support?
• During an internal investigation, a hard drive containing evidence was passed among four staff members over two weeks, with no record of who held it, when, or why. Defense counsel now challenges the evidence. Which problem does this situation MOST directly illustrate?
• An organization is sued, and its legal counsel asks IT to identify, preserve, collect, and produce all emails and documents relevant to a contract dispute for review by both parties. There is no indication of a security breach. Which process is this?
• An endpoint detection tool shows that a workstation infected with worm-like malware is actively scanning and attempting to infect other hosts on the same subnet. Which action should the responder take FIRST?
• A ransomware outbreak has been contained by isolating the affected servers. The team must now decide the order of the next activities. Which sequence is CORRECT?
• A company confirms that attackers stole an unencrypted database of customer names, addresses, and government identification numbers. Applicable privacy law requires breaches of this type of data to be reported. Which action BEST meets the organization's obligations?
• A phishing-driven account compromise has been eradicated and all systems are restored. Several weeks earlier a similar incident occurred. Which post-incident activity should the team perform to prevent another recurrence?
• An investigator needs to determine which accounts signed in to a specific Linux server last week, from which source addresses, and whether any attempts failed. Which data source should the investigator examine FIRST?
• Overnight, someone unplugged a storage array inside a badge-controlled server room. A contractor is suspected, but the contractor says they never entered the room. Which data sources should the investigator use to confirm or refute the contractor's statement?
• A workstation has started beaconing to an unfamiliar domain. The analyst needs to know which process launched the payload, what its parent process was, and the command-line arguments used. Which log source should the analyst examine first?
• An internal spreadsheet was leaked and posted on a public forum. Investigators want to identify which account created the file and when it was last modified, without relying on the forum poster's claims. What should the investigators examine first?
• The SOC suspects a database server has been sending large volumes of data to an unfamiliar external IP address for the past month. Full packet capture is retained for only 48 hours. Which data source most efficiently shows which hosts talked to that address, when, and how many bytes moved during the month?
• Before handing exported firewall logs to legal counsel, an investigator must be able to demonstrate later that the files have not been modified since they were collected. What should the investigator do at the time of collection?
• Responders suspect fileless malware is running only in memory on a live server. Management wants the server powered off right away to stop the spread. Which action should the responders take first to preserve the most relevant evidence?
• An investigation into data exfiltration points to a specific employee, and management wants to interview the employee and possibly take disciplinary action. Which stakeholders should the security team involve before any of those steps are taken?
• An analyst must find every failed login across several gigabytes of authentication logs collected from dozens of servers and then count the failures per source IP address. Which approach is most effective?