Free SY0-801 practice questions

Defense in depth layers multiple, ideally different, controls around an asset so that a single failure does not lead to compromise.

The deciding detail is the stated goal: the failure of one control must not expose the application. That is the reason for layering. Zero Trust is tempting because it is also a modern architecture term, but it is about verifying every request rather than adding layers; least privilege and separation of duties are about permissions and people.

1. Notice that several controls protect the same asset.
2. Notice the goal: no single failure exposes it.
3. Match 'layers so one failure is not fatal' to defense in depth.
4. Rule out the permission- and people-focused principles.

Exam tip: Defense in depth = several layers, so one failed control is not a breach.

A vulnerability is a weakness that a threat could exploit; a threat is the potential cause of harm; risk is the likelihood and impact of the two meeting.

The library is the weakness in the organization's own system, so it is the vulnerability. The criminal groups scanning for it are the threat, and the chance that they succeed combined with the harm they would cause is the risk. A threat vector is the route an attacker uses to reach the target, and an exploit chain is a sequence of attack techniques - neither describes the weakness itself.

1. Separate the scenario into who could cause harm and what they could take advantage of.
2. The criminal groups are the source of potential harm - the threat.
3. The outdated library is the weakness they would use - the vulnerability.
4. Risk only exists as the combination of the two, so it does not describe the library alone.

Exam tip: Threat = who or what could cause harm; vulnerability = the weakness; risk = likelihood x impact.

Serverless computing runs event-driven code without the customer managing any servers.

The two clues are event-triggered execution and no host management at all. That is serverless: the provider runs and patches the hosts, operating system and runtime, and the customer supplies only code and configuration. Microservices and IaC are design and deployment approaches that still leave servers in the customer's hands, and a private cloud is a deployment model, not an execution model.

1. Note that the code runs only when an event triggers it.
2. Note that the team manages no hosts at all.
3. Match event-driven code with no server management to serverless.
4. Rule out options that describe design style, deployment tooling or a deployment model.

Exam tip: Event-driven code with no servers to manage is serverless.

Deception technology plants decoys that legitimate users never touch, so any interaction is a high-confidence alert.

The decoy is a single file on a real file share, and the alert fires when someone opens it. That is a honeyfile. A honeytoken is a fake credential or data value tracked when it is used, a honeypot is a fake system, and a canary account is a fake user account; all are deception tools, but only the honeyfile is a decoy file.

1. Identify what the decoy is: a file.
2. Note where it lives: on a real share, not a fake system.
3. Match a decoy file that alerts on access to a honeyfile.

Exam tip: Decoy file = honeyfile; decoy data or credential = honeytoken; decoy system = honeypot; decoy user = canary account.

Governance documents form a hierarchy: policies state mandatory intent, standards set measurable requirements, procedures give steps, guidelines advise.

The document is approved by top leadership, is mandatory, assigns responsibility to the CISO and deliberately avoids naming products or settings. That combination of high-level intent plus authority is what defines a policy. A standard would add measurable specifics, a procedure would add steps, and a guideline would be optional.

1. Note who approved it: senior leadership.
2. Note that it is mandatory and assigns responsibility.
3. Note that it names no technology, setting or step.
4. Match high-level mandatory intent with authority to a policy.

Exam tip: Policy = what and who, mandatory, no technical detail.