Free Security+ SY0-801 (V8) Practice Test

Correct answer: B. Compensating

B is correct because it provides an alternative safeguard that offsets a weakness the primary system cannot fix on its own. A discourages an attacker from trying, such as a warning banner, but does not add an authentication safeguard. C restores a system or limits damage after an incident has occurred, rather than offsetting a known gap in advance. D instructs people what to do through policy or procedure, rather than technically enforcing MFA.

Correct answer: D. Data sovereignty

D is correct because data is subject to the laws of the country where it is stored, so the regions must keep the records under EU jurisdiction. A divides security duties between the provider and the customer, but does not decide where the data may legally reside. B sets how sensitive the records are and how they must be handled, but not which legal jurisdiction they must stay in. C concerns how well the design grows with demand, which does not address the regulator's legal requirement.

Correct answer: A. A DMARC policy of p=reject

A is correct because DMARC checks that the visible From domain aligns with SPF or DKIM results and tells receivers to reject messages that fail. B only validates the envelope sender used in delivery, so a forged visible From address can still pass. C displays a verified brand logo in the inbox and depends on DMARC already being enforced, so it blocks nothing itself. D adds another signing key, but without a DMARC policy receivers are not told what to do with unsigned spoofed mail.

Correct answer: D. Acceptable use policy

D is correct because an AUP defines the permitted and prohibited uses of the organization's systems and network. A defines sensitivity labels and handling rules for data, not acceptable behavior on company systems. B sets how access rights are requested, approved, and reviewed, not what users may do once they have access. C requires employees to secure papers and media at their workspace, not govern how systems are used.

Correct answer: C. CVSS base score

C is correct because the Common Vulnerability Scoring System rates the severity of a vulnerability on a 0.0 to 10.0 scale. A is a unique name for a publicly known vulnerability and carries no severity rating. B classifies the type of underlying weakness, such as improper input validation, rather than scoring severity. D identifies a source of threat intelligence and does not rate individual scan findings.

Correct answer: B. Defense in depth

B is correct because layering different controls means an attacker who defeats one still faces the others. A records what users do for auditing, but does not describe layering several controls. C prevents someone from denying they performed an action, which is unrelated to layering controls. D limits each account to the minimum access it needs, rather than stacking several protective layers.

Correct answer: D. Community cloud

D is correct because the infrastructure is shared by several organizations with common concerns, such as the same compliance rules. A is open to any customer who signs up, not limited to a group of organizations with shared requirements. B is dedicated to a single organization, while this environment is shared by several credit unions. C combines two or more deployment models, such as private and public, rather than describing a shared group environment.

Correct answer: B. Move the medical devices to a filtered, separate VLAN

B is correct because segmentation isolates the devices so a compromised workstation can only reach them through controlled, filtered paths. A makes workstation logins harder to guess, but a phished workstation would still reach every pump. C protects data at rest if a laptop is stolen, but does nothing to restrict network paths to the pumps. D is often not supported on embedded medical devices and does not stop workstations from reaching them.

Correct answer: A. Clean desk policy

A is correct because it requires employees to remove or secure sensitive papers and media from their work areas when unattended. B explains how the organization collects and uses personal data, not how employees secure their desks. C defines permitted use of company systems and networks, not the handling of papers at a workspace. D governs how data and media are destroyed when no longer needed, not how they are stored at a desk overnight.

Correct answer: D. To give one publicly known vulnerability a unique, shared name

D is correct because CVE entries give each publicly disclosed vulnerability a standard identifier so different sources can refer to it consistently. A is the role of a CVSS score, while a CVE identifier carries no severity rating. B describes a CWE category, which groups weaknesses by type rather than naming one specific vulnerability. C is not recorded in a CVE identifier, which names the flaw and not any attacker.