Free Asset Management practice questions
10 free SY0-801 questions on Asset Management, each with a full explanation — no account needed. This section sits in the Security Operations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
Which kind of repository stores configuration items such as servers, applications, services and cloud resources, together with the relationships between them?
A CMDB stores configuration items, which can be hardware, software, services or cloud resources, along with how they relate, so you can see which servers a payroll application runs on. An SBOM lists the components inside one product, a CASB helps discover the cloud services in use, and an approved catalog lists software users may install.
Six months after deploying a new building-sensor platform, a company learns that the sensors can't send logs to its SIEM and the vendor has no published schedule for security updates. Which practice would have prevented this?
Security requirements such as sending logs to the SIEM and publishing updates for a stated period are cheap to state during planning and become obligations when written into the RFP and contract. An owner, a discovery scan and an asset tag all come after the purchase, so they would only record a product that already can't meet the requirements.
Receiving staff notice that the tamper-evident tape on a shipment of new firewalls has been cut and resealed. Which step BEST addresses this before the firewalls are deployed?
Receiving checks exist for exactly this: confirm the serial numbers match the order and the manufacturer's records, and verify firmware hashes or signatures against the vendor's published values before deployment. Tagging and assigning owners record the devices without checking them, and a discovery scan after deployment won't catch tampered or counterfeit hardware.
When an employee leaves, IT can't tell which laptop, phone and security key she was issued, so none of them are recovered. Which practice was missing?
Assignment and accounting give each physical asset a unique tag linked to a record of who it is assigned to, which tells IT exactly which devices to recover when someone leaves. License and version tracking cover software, shadow IT discovery finds unapproved services, and an approved vendor list governs purchasing.
A critical flaw is announced in a widely used software library. The CISO asks which servers run the affected version, and nobody can answer within a day. Which asset management capability is missing?
Version tracking is the security half of software tracking: when a new vulnerability is published, it tells you within minutes which hosts run the affected version. License tracking also follows software, but it checks installs against what was paid for and reclaims unused seats rather than answering which version runs where, and asset tags and vendor lists deal with hardware identity and purchasing.
A discovery sweep finds a host answering at an internal address that has no matching record in the asset inventory. What should the team do?
The point of discovery is reconciliation: every host found should match a record, and anything without one is unknown and gets investigated, since it may be a forgotten test server, a contractor's device or a rogue access point. Waiting or excluding it leaves it unmanaged, and deleting records that don't match a live host is the wrong reflex too, because a device that stops checking in may be lost or stolen.
A payroll server is used daily by payroll clerks and patched by a systems administrator. The finance director approves who gets access to it and when it can be taken down for patching. Who is the server's asset owner?
The asset owner is the person or team accountable for the asset's security, which means approving access, accepting downtime for patches and deciding on risk; here that is the finance director. That role is different from the people who use the system day to day and from the administrator who maintains it, and a vendor supplies the product without answering for its security.
An organization is retiring several kinds of storage media. Which of them can be sanitized by degaussing?
Degaussing scrambles data that is stored magnetically, so it works on hard drives, backup tapes and older floppy disks. USB flash drives, SSDs and optical discs don't store data magnetically, so a degausser has no effect on them.
A laptop's hard disk drive will be reissued to another employee in the same department, and its data isn't highly sensitive. Which approach fits BEST?
A drive staying inside the organization for reuse by the same department can usually be cleared, and on a hard disk drive a single overwrite pass does that. Shredding wastes a usable asset, degaussing wipes the servo tracks so the drive won't work again, and deleting files leaves the data in place for recovery tools.
A hard drive holding patient records fails in a hospital server. It's under warranty, and the vendor's standard process is to ship the failed drive back in exchange for a new one. What should the hospital do?
A dead drive can't be overwritten, formatting is never sanitization, and returning the drive under an RMA sends patient data off-site, so the hospital keeps it, destroys it with a certificate, and uses a drive-retention option to keep the warranty. Trusting the vendor doesn't change the fact that the data would leave the hospital's control unsanitized.
Study this section
Every lesson that covers Asset Management on the SY0-801 exam.