Security+ SY0-801 Practice Questions: Security Operations

Correct answer: A. A DMARC policy of p=reject

A is correct because DMARC checks that the visible From domain aligns with SPF or DKIM results and tells receivers to reject messages that fail. B only validates the envelope sender used in delivery, so a forged visible From address can still pass. C displays a verified brand logo in the inbox and depends on DMARC already being enforced, so it blocks nothing itself. D adds another signing key, but without a DMARC policy receivers are not told what to do with unsigned spoofed mail.

Correct answer: B. Move the medical devices to a filtered, separate VLAN

B is correct because segmentation isolates the devices so a compromised workstation can only reach them through controlled, filtered paths. A makes workstation logins harder to guess, but a phished workstation would still reach every pump. C protects data at rest if a laptop is stolen, but does nothing to restrict network paths to the pumps. D is often not supported on embedded medical devices and does not stop workstations from reaching them.

Correct answer: B. Group Policy

B is correct because Group Policy Objects push and reapply security settings centrally to domain-joined Windows computers. A enforces mandatory access control policies on Linux systems, not Windows domain settings. C presents a web page that users must complete before getting network access, not configuration settings. D is a decoy file that alerts when opened, and it does not configure computers.

Correct answer: C. SELinux in enforcing mode

C is correct because SELinux confines each process to the types its policy allows, so even a root-owned web server cannot read unrelated files. A configures domain-joined Windows computers and does not govern Linux process permissions. B filters network connections to and from the host, not file access by a local process. D are bypassed by the root account, so they would not stop a process running as root.

Correct answer: A. Sandboxing

A is correct because it runs untrusted content in an isolated environment so malicious behavior cannot affect production systems. B produces a fixed-length digest of a file, which identifies it but does not reveal how it behaves. C replaces sensitive values with tokens to protect data, not to analyze attachment behavior. D separates networks into zones, rather than running individual files in isolation to observe them.

Correct answer: C. A honeynet

C is correct because a honeynet is a network of multiple decoy systems that lets defenders observe attacker behavior, including lateral movement. A is a single decoy system, which would not show how attackers move between several systems. B hosts real public-facing services between the internet and internal network, not decoys. D isolates individual files or programs for analysis rather than imitating a whole network for attackers.

Correct answer: C. Honeytoken

C is correct because it is a fake piece of data planted in a real data store, so any use of it signals that the data was taken. A is a decoy document that alerts when opened, rather than a fake record inside a production database. B is a decoy system that attracts attackers, not a single fake record placed among real data. D is a decoy user account that alerts on login attempts, rather than a fake record tracked when used.

Correct answer: B. A canary account

B is correct because it is a decoy account with no legitimate use, so any attempt to sign in to it indicates malicious activity. A is a real break-glass account kept for outages, not a decoy meant to trigger alerts. C is used by several people with one set of credentials, while this account has no legitimate users. D is used by an application or process to run automatically, while this account is never used at all.

Correct answer: C. Mobile device management

C is correct because MDM enforces policies, deploys apps, and can remotely lock or wipe managed mobile devices. A detects and blocks sensitive data leaving the organization, not lost phones or their settings. B checks devices before granting network access, but does not manage apps or wipe phones. D detects and blocks rogue wireless activity, not settings on individual phones.

Correct answer: D. An allow list of approved applications

D is correct because only explicitly approved programs can run, so any unknown executable is blocked by default. A detects known malware, but the problem programs are not malware and have no signatures. B controls web traffic, not programs launched from removable media on the kiosk. C only stops programs already on the list, so new or renamed executables would still run.