Free Deception and Physical Security practice questions
10 free SY0-801 questions on Deception and Physical Security, each with a full explanation — no account needed. This section sits in the Security Foundations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A security team places a spreadsheet named Executive-Bonus-Plan.xlsx on a finance share that nobody uses and turns on access auditing so that any attempt to open it raises a high-severity alert. What has the team created?
A decoy document with a tempting name, placed where it looks natural and audited so that opening it raises an alert, is a honeyfile. Honeytoken tempts because both are bait, but when the planted item is a document it is a honeyfile, while fake data such as a key or a record is a honeytoken. A honeypot is a whole decoy system.
A company wants a decoy on its server VLAN that alerts on lateral movement, with as little risk as possible that an attacker could take over the decoy and use it. Which option BEST fits?
Low-interaction honeypots emulate services and record connection attempts, and because there is no real operating system to take over they are cheap and safe, which is why they are the usual choice for internal detection. High-interaction honeypots can really be compromised, and joining one to the domain, loading real data or allowing outbound traffic makes that risk worse.
A canary account's alert fires every Sunday at 02:00. Investigation confirms the logons come from the company's scheduled credentialed vulnerability scan. What should the team do?
Canary accounts must be excluded from every legitimate process that touches accounts, such as credentialed scans, or those processes raise false alarms and teach the team to ignore the rule. A replacement canary would trip the same scan, lowering the severity wastes a high-fidelity alert, and a canary with real privileges becomes a backdoor.
A developer plants a cloud access key in a configuration file in a code repository. The key belongs to an identity with no permissions, and any attempt to use it raises an alert. Which deception technique is this?
A fake key planted in data, whose use is recorded in the provider's audit log and raises an alert, is a honeytoken. Canary account is the close distractor because the key belongs to an identity, but on the exam an account object in a directory is a canary account and a piece of data such as a key or record is a honeytoken. The config file isn't a decoy document, so it isn't a honeyfile.
Before deploying internal honeypots and honeyfiles, a manager worries that the program could count as entrapment. Which response is MOST accurate?
In the United States, entrapment is a defense when government agents induce someone to commit a crime, so an organization passively running decoys on its own network generally isn't entrapping anyone. Monitoring and recording activity can still raise privacy and interception questions that vary by jurisdiction, so legal counsel should be involved, which rules out skipping review.
When power fails, which electronic lock behavior keeps a server room door locked from the outside to protect the equipment inside?
A fail-secure lock stays locked from the outside when power fails, which protects assets and suits a server room door. A fail-safe lock unlocks to protect people, which is why exit doors use it; anti-passback stops a badge from admitting a second person, and request-to-exit is a sensor that unlocks a door for someone leaving.
A risk assessment notes that a car could be driven through the glass front of a company's lobby, which faces a busy road. Which control BEST addresses this risk?
Bollards are short, sturdy posts that stop vehicles, which is exactly the threat described, whether the crash is accidental or deliberate. An access vestibule controls people one at a time, cameras only record the crash, and lighting helps people see but can't stop a car.
An employee badges into a secure lab, then slides her badge back under the door so a friend outside can badge in with it. Which control would BEST stop this?
Anti-passback refuses a badge that is used to enter an area twice without exiting, so a badge passed back can't admit a second person. The door was never held open, so a held-open alarm stays silent, fail-secure locks only matter during a power failure, and a warning sign stops no one.
During a physical penetration test, a tester opens the standard pin tumbler lock on a supply room in seconds by tapping a specially cut key while turning it. Which change BEST addresses this weakness?
The tester used bumping, which jolts the pins of a standard pin tumbler lock, so the defense is a high-security cylinder built to resist picking and bumping. Rekeying tempts, but it answers lost or unreturned keys, and a bump key doesn't need the lock's own key. Hinge pins and latch guards defend against different bypasses.
The badge system shows the same employee's badge granted at the Dallas office at 10:01 and at the Austin warehouse, about 300 kilometers away, at 10:04. What does this MOST likely indicate?
One badge can't be in two places 300 kilometers apart within three minutes, so at least one of the reads came from a copy, which points to a cloned card. Tailgating and forced entry don't produce a granted read for the badge, and anti-passback would have denied the entry rather than granting it.
Study this section
Every lesson that covers Deception and Physical Security on the SY0-801 exam.