Free Security+ SY0-801 practice questions for the new V8 exam

A SOC analyst reviews the following EDR alert, raised minutes after an accounts payable clerk opened an emailed invoice on workstation WS-2291:

Which of the following BEST describes this malware?

• AA worm spreading itself to other hosts over port 443
  The only network activity is one outbound connection to a single external address, not scanning or spreading to internal hosts. Nothing indicates self-propagation.
• BA macro virus that is infecting other documents
  The alert records that no other documents were modified, so nothing shows the macro infecting files; it simply launched a hidden, encoded command. The document was the delivery method, not a self-replicating virus.
• CFileless malware running in memory through a built-in shell
  Correct. A trusted built-in interpreter ran an encoded command in memory, connected to a remote host, and stored its code in a registry Run key, all without writing an executable to disk. Living off the land this way is the hallmark of fileless malware, which evades file-based antivirus.
• DA rootkit hiding its files by using a hidden window flag
  The hidden-window flag only keeps a console from appearing on screen; it does not hide files or processes from the OS the way a rootkit does. The EDR tool saw the whole process chain.

A security team is reviewing a penetration test report. The findings table and attack narrative include:

Which action should the team prioritize FIRST?

• AEnforce SMB signing in P-2 because it affects the most servers
  SMB signing is worth enforcing, but it played no role in the demonstrated compromise. The number of affected servers does not outweigh a proven path to domain administrator.
• BFix P-1 and P-3, the chain that led to domain admin
  Correct. Reviewing a penetration test report means reading the attack narrative, not just the ratings. P-1 and P-3 together gave testers domain administrator access in four hours, so breaking that chain addresses the most serious demonstrated risk.
• CFix findings strictly by rating and treat P-1 as routine
  Ratings are assigned per finding. Treating P-1 as routine ignores that it was the entry point for the chain, which makes its real impact far greater than a standalone Medium.
• DRenew the TLS certificate in P-4 before it expires
  An expiring certificate needs attention before the deadline, but it is low risk and was not part of the path to domain compromise.

An auditor asks for evidence that the domain enforces the corporate password policy. The administrator generates this policy report:

Which deviation represents the GREATEST risk and should be remediated first?

• AMinimum length set to 12 instead of 14
  A 12-character minimum is weaker than policy and should be corrected, but 12-character passwords still resist most brute-force attacks. It is a moderate gap compared with recoverable passwords.
• BLockout threshold set to 15 instead of 10
  A threshold of 15 instead of 10 slightly increases the guesses allowed before lockout. That is a small change in online guessing risk.
• CReversible password encryption enabled
  Correct. Reversible encryption stores passwords in a form that can be decrypted back to plaintext, so anyone who obtains the directory database and key can recover every user's actual password. Fix it first, then reset passwords.
• DPassword history set to 12 instead of 24
  A shorter history lets users return to old passwords sooner, which is a minor weakening. It does not expose any current passwords.

A risk analyst scores four risks. Score = likelihood x impact, each rated 1 to 5. 15 or higher is High, 8 to 14 is Medium, 7 or lower is Low.

Which risk should be categorized as High?

• AR2 Flood at the data center
  R2 scores 1 x 5 = 5, which is Low. Maximum impact combined with very low likelihood does not produce a high score.
• BR4 Stolen unencrypted laptop
  R4 scores 3 x 2 = 6, which falls in the Low band. It would be monitored rather than prioritized.
• CR3 Unpatched VPN exploited
  Correct. R3 scores 3 x 5 = 15, which meets the threshold for High. Scoring combines likelihood and impact, and categorization groups the scores so the highest risks are treated first.
• DR1 Phishing leads to BEC
  R1 scores 4 x 3 = 12, which falls in the Medium band. Its high likelihood alone does not make it High.

During a security assessment, an analyst reviews an EDR alert that the tooling has already mapped to a framework:

The assessor wants to use the same framework to measure which adversary techniques the company can detect. Which reference source is being used?

• ACVSS base metrics
  CVSS scores the severity of vulnerabilities. The alert describes attacker behavior, not a vulnerability severity score.
• BDiamond Model
  The Diamond Model analyzes an intrusion through adversary, capability, infrastructure, and victim. It does not catalog named tactics and techniques for measuring detection coverage.
• CCyber Kill Chain
  The Cyber Kill Chain describes seven sequential phases of an intrusion. It does not use tactic and technique labels such as Credential Access and OS Credential Dumping.
• DMITRE ATT&CK
  Correct. MITRE ATT&CK organizes real-world adversary behavior into tactics (goals) and techniques (how). Assessors use it to map detections and find coverage gaps technique by technique.

A cloud engineer runs a drift report against a production environment that is deployed from approved Infrastructure as Code templates:

Which of the following is the BEST response?

• AReapply the approved template and route future changes through the pipeline
  Correct. The live security group drifted from the approved code through an untracked console change that exposes SSH to the internet. Reapplying the template restores the secure baseline, and routing changes through the reviewed pipeline prevents repeat drift.
• BDelete the template and manage this security group manually from the console
  Abandoning the template removes the consistency, review, and version history that IaC provides. Manual management is what caused the drift in the first place.
• CAdd the SSH rule to the template so the code matches the live environment
  Updating the template to match would make an unapproved change permanent and leave SSH open to the entire internet. Drift is corrected toward the approved baseline, not the other way around.
• DLeave the rule in place until the next scheduled deployment overwrites it
  SSH would stay open to the internet until the next deployment, and the untracked change would go unaddressed. Drift that creates exposure should be corrected right away.

During a quarterly access review of a company's ERP system, a reviewer sees the following:

Which of the following should the reviewer flag as a least privilege violation?

• Absole, because an approver has no need to see vendor records
  A supervisor approving invoices needs to confirm the vendor being paid, so View vendors supports the approval task.
• Bcdiaz, because only HR managers should run payroll reports
  Running payroll reports is a normal duty for a payroll analyst. Restricting it would block legitimate work without removing any unnecessary access.
• Cakim, because a clerk has no need to see vendor records
  An AP clerk who creates invoices needs to look up the vendors being billed, so View vendors is appropriate.
• Ddfox, because invoice rights from the old AP role were never removed
  Correct. dfox moved to Sales but still holds Create invoices and View vendors from the old AP role, a classic case of privilege creep. Access reviews exist to catch exactly this.

A company is redesigning how its database administrators receive elevated rights. Today, each administrator's single account holds permanent sysadmin rights on every production database.

Which of the following changes BEST align with least privilege access accounts? (Choose TWO.)

• AProvide time-limited elevation approved through a PAM workflow
  Correct. Just-in-time elevation grants privileged rights for a defined task and window, with approval and logging, so no account holds standing administrative access.
• BShare one privileged account among all database administrators
  A shared privileged account removes individual accountability and makes it impossible to tell who did what.
• CScope each admin account to the databases that person supports
  Correct. Limiting each account to the databases its owner actually supports reduces the blast radius if the account is compromised. Least privilege applies to scope as well as duration.
• DKeep the permanent rights but require longer account passwords
  Longer passwords make the accounts harder to guess but leave permanent sysadmin rights in place. The standing privilege is the problem.
• EGrant every admin sysadmin rights on the test databases as well
  Adding more sysadmin rights, even on test systems, expands privileges instead of reducing them.