Home / Flashcard library / Careers & certifications / CompTIA Security+ (SY0-801)

Careers & certifications

CompTIA Security+ (SY0-801) flashcards

8 decks · 533 cards · built into Willys · free samples below

Get the app Study a free sample

Written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

What's in it

Every deck follows the course outline, with tags you can study or suspend topic by topic. Open a deck to study its free sample right here.

Learn · 6 decks · 377 cards

Concepts, mechanisms and the questions a course or exam asks about them.

General Security Concepts SY0-801 domain 1 as scenario questions: defense in depth, CIA, AAA, non-repudiation, zero trust and least privilege, control categories and types, change management and its technical effects, and cryptography: PKI and certificates, encryption levels, key exchange, signatures, salting and hashing. 10 free · 49 cards in the app Threats, Vulnerabilities & Attacks SY0-801 domain 2 as scenario questions: threat intelligence, CVSS and actors, threat vectors from messages to signals, vulnerabilities and attack surfaces, indicators of malware, physical, network, application, credential and social engineering attacks, and threats to and from AI. 10 free · 80 cards in the app Security Architecture SY0-801 domain 3 as scenario questions: cloud, on-premises and OT architecture, segmentation, zero trust and secure access design, data states, classes, roles and protection methods, and resilience: sites, redundancy, backups, testing and recovery metrics. 10 free · 61 cards in the app Controls & Monitoring SY0-801 domain 4, part 1: mitigating controls from segmentation and hardening to EDR, NAC, firewalls, DLP, email authentication and OS security; the asset life cycle; vulnerability management; and alerting and monitoring tools and protocols. 10 free · 64 cards in the app Identity, Automation & Response SY0-801 domain 4, part 2, as scenario questions: account life cycle, federation, SSO, MFA, access control models and passwordless login, automation and AI in security operations, incident response from preparation to post-incident review, and investigation data sources. 10 free · 64 cards in the app Program Management & Oversight SY0-801 domain 5 as scenario questions: policies, standards, procedures and plans, risk analysis and treatment with SLE, ARO and ALE, vendor selection and agreement types, GDPR-style privacy rights and legal holds, audits and penetration testing, and security awareness training. 10 free · 59 cards in the app

Drills · 1 deck · 96 cards

Short answers and cloze blanks for the facts you simply have to know cold.

Cloze: Acronyms Cloze drills on 48 acronyms from the SY0-801 acronym list, in both directions: recall each acronym from its expansion, and the expansion from the acronym plus a one-line clue to what it does. 8 free · 96 cards in the app

Practice · 1 deck · 60 questions

Multiple-choice practice questions, one best answer each, with the reasoning.

Practice Questions Scenario-style multiple-choice questions across all five SY0-801 domains, one best answer each: controls and cryptography, threats and AI risks, architecture and data protection, operations, identity and incident response, and governance, risk and compliance. 6 free · 60 questions in the app

Cloze decks have one or more blanks per sentence; the app makes one card per blank.

Study guide

Topics covered

The decks follow the order of the course outline. Numbers are cards per topic.

  • Security Controls 24
  • Change Management 19
  • Cryptography & PKI 32
  • Threats & Threat Actors 21
  • Threat Vectors 17
  • Attack Surfaces 21
  • Indicators & Attacks 29
  • AI Threats 16
  • Architecture Models 22
  • Infrastructure Security 23
  • Data Protection 17
  • Resilience & Recovery 24
  • Mitigating Controls 63
  • Asset & Vulnerability Management 20
  • Alerting & Monitoring 20
  • Identity & Access 38
  • Automation & Orchestration 16
  • Incident Response 16
  • Investigations 15
  • Governance Documents 13
  • Risk Management 20
  • Third-Party Risk 14
  • Compliance & Audits 23
  • Security Awareness 10

A study plan

  • 20 new cards a day covers everything in a month, leaving the last weeks for review.
  • 10 new cards a day covers everything in two months, leaving the last weeks for review.
  • 7 new cards a day covers everything in three months, leaving the last weeks for review.

Willys schedules reviews for you (FSRS spaced repetition), so the daily number above is only for new cards; reviews of what you have learned come back on their own. Study a topic's cards right after you meet it in class, suspend topics you have not reached yet, and use the app's quiz mode in the final two weeks.

How to get these decks

  1. Install Willys on your iPhone, iPad or Mac — App Store. 14-day free trial, then $14.99 a year.
  2. In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
  3. Study. The exam comes in as its own collapsible folder, every card scheduled by FSRS spaced repetition. Nothing you already have is changed.

Every deck is built into Willys

All 8 CompTIA Security+ (SY0-801) decks (533 cards), with FSRS spaced repetition, quizzes and mock tests, on iPhone, iPad and Mac. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

  • Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
  • Checked against NIST SP 800-207 Zero Trust Architecture and NIST SP 800-53 Rev. 5 (public domain) for zero trust tenets, least privilege, impact analysis and allow lists (reference only; no text copied).
  • Checked against NIST SP 800-128 (public domain) for configuration change control, rollback and documentation (reference only; no text copied).
  • Checked against NIST SP 800-57 Part 1 Rev. 5, SP 800-111, SP 800-63B-4, FIPS 180-4 and FIPS 202 (public domain) for keys, key strength, storage encryption, salting and hash functions (reference only; no text copied).
  • Checked against IETF RFC 5280, RFC 6960, RFC 2986, RFC 9525, RFC 8446 and RFC 6151 for certificates, revocation, CSRs, wildcard matching, TLS 1.3 and MD5 status (reference only; no text copied).
  • Checked against NIST SP 800-12 Rev. 1 and the NIST CSRC Glossary (public domain) for control categories, defense in depth, compensating controls, key escrow, HSM and TPM (reference only; no text copied).
  • Checked against the OWASP Cheat Sheet Series and OWASP community attack pages (CC BY-SA 4.0; reference only; no text copied).
  • Checked against the OWASP Top 10 for LLM Applications 2025 (CC BY-SA 4.0; reference only; no text copied).
  • Checked against NIST AI 100-2 E2025 (adversarial machine learning taxonomy) and NIST AI 100-1 (AI RMF 1.0) (public domain; reference only).
  • Checked against NIST SP 800-150, SP 800-30 Rev. 1 and SP 800-63B-4 (public domain; reference only) for threat intelligence, risk factors and authentication defenses.
  • Checked against MITRE ATT&CK Enterprise and Mobile techniques and tactics (reference only; no text copied).
  • Checked against FIRST CVSS v4.0 and EPSS, the CVE Program, MITRE CWE and the NIST NVD (reference only; no text copied).
  • Checked against CISA advisories and guidance: the KEV catalog, #StopRansomware Guide, living off the land and OT mitigation guidance, ED 19-01 and insider threat definitions (reference only).
  • Checked against IETF RFC 8446, RFC 8996 and RFC 4033 (reference only).
  • Checked against NIST SP 800-145 (cloud deployment and service models), NIST SP 800-207 (zero trust tenets) and NIST SP 800-82 Rev. 3 (OT security) (public domain; reference only; no text copied).
  • Checked against NIST SP 800-204 and SP 800-204C (microservices, infrastructure as code) and NIST SP 800-215 (SASE) (public domain; reference only; no text copied).
  • Checked against NIST SP 800-34 Rev. 1 (contingency planning), NIST SP 800-88 Rev. 2 (media sanitization), NIST SP 800-188 (de-identification) and the NIST CSRC Glossary (public domain; reference only; no text copied).
  • Checked against IETF RFC 4301 (IPsec), Regulation (EU) 2016/679 (GDPR roles), Executive Order 13526 (classification levels), the FTC's COPPA FAQ and the CISA #StopRansomware Guide (reference only; no text copied).
  • Checked against Microsoft Learn documentation on group Managed Service Accounts and Global Secure Access (reference only; no text copied).
  • Checked against NIST SP 800-53 Rev. 5, SP 800-40 Rev. 4, SP 800-41 Rev. 1, SP 800-70 Rev. 4, SP 800-83 Rev. 1, SP 800-88 Rev. 2, SP 800-124 Rev. 2, SP 800-161 Rev. 1 and SP 800-167 (public domain) for decoys, sandboxing, allow-listing, firewalls, mobile management, asset inventory, sanitization and vulnerability response (reference only; no text copied).
  • Checked against NIST SP 800-92, SP 800-94, SP 800-115, SP 800-126 Rev. 3 (SCAP), SP 800-218 (SSDF) and SP 1800-5 (public domain) for log management, intrusion detection and prevention, testing, security automation and secure development (reference only; no text copied).
  • Checked against IETF RFC 7208 (SPF), RFC 6376 (DKIM), RFC 9989 (DMARC, May 2026), RFC 5424 and RFC 5425 (syslog), RFC 3410, RFC 3411 and RFC 3414 (SNMPv3), RFC 3954 (NetFlow v9), RFC 7011 (IPFIX), RFC 3580 (802.1X and RADIUS), RFC 5209 (NEA) and RFC 8952 (captive portals) (reference only; no text copied).
  • Checked against the OWASP Cheat Sheet Series (Input Validation, Session Management, Secrets Management), the OWASP Web Application Firewall page and the OWASP API Security Top 10 2023 (CC BY-SA 4.0; reference only).
  • Checked against FIRST CVSS v4.0 and EPSS, and CISA's Known Exploited Vulnerabilities catalog and Vulnerability Disclosure Policy Template, for prioritization and disclosure (reference only; no text copied).
  • Checked against the BIMI Group implementation guide and the IETF BIMI Internet-Draft (reference only; no text copied).
  • Checked against Microsoft Learn (Group Policy, IPAM, Defender for Cloud CSPM, Defender for Endpoint and Defender XDR) and Red Hat's RHEL 9 SELinux guide for product-specific behavior (reference only; no text copied).
  • Checked against NIST SP 800-63A-4, SP 800-63B-4 and SP 800-63C-4 Digital Identity Guidelines (public domain) for identity proofing, federation, MFA, look-up secrets, biometrics, phishing resistance and password rules (reference only; no text copied).
  • Checked against NIST SP 800-61 Rev. 3 (public domain) for the CSF 2.0-based response model, playbooks, exercises, root cause analysis, evidence preservation and notification (reference only; no text copied).
  • Checked against NIST SP 800-86 and SP 800-92 (public domain) for forensic phases, imaging, volatile data, log parsing, normalization and log integrity, and the NIST CSRC glossary for access control models and IR terms (reference only; no text copied).
  • Checked against IETF RFC 6749 (OAuth 2.0), RFC 4511 and RFC 4513 (LDAP), RFC 6238 (TOTP), RFC 4226 (HOTP), RFC 7011 (IPFIX), RFC 3954 (NetFlow v9) and RFC 3227 (evidence collection) (reference only; no text copied).
  • Checked against the OASIS SAML V2.0 Technical Overview and the FIDO Alliance passkeys pages (reference only; no text copied).
  • Checked against the OWASP Top 10 for LLM Applications 2025 (LLM06 Excessive Agency) and the OWASP CI/CD Security Cheat Sheet (CC BY-SA 4.0; reference only; no text copied).
  • Checked against the CISA #StopRansomware Guide and the U.S. Treasury OFAC advisory on ransomware payments (2021) (reference only; no text copied).
  • Checked against Microsoft Learn pages on emergency access accounts, Privileged Identity Management, access reviews, Desired State Configuration, group managed service accounts and minimum password age (reference only; no text copied).
  • Checked against NIST SP 800-30 Rev. 1, SP 800-37 Rev. 2, IR 8286 and SP 800-34 Rev. 1 (public domain) for risk assessment approaches, risk responses, residual risk, risk registers, risk appetite and business impact analysis (reference only; no text copied).
  • Checked against NIST CSF 2.0 and NIST SP 800-161 Rev. 1 (public domain) for policy, supplier due diligence and procurement steps (reference only; no text copied).
  • Checked against NIST SP 800-115, SP 800-12 Rev. 1 and SP 800-50 Rev. 1 (public domain) for rules of engagement, reconnaissance, test environments, functional testing and awareness program metrics (reference only; no text copied).
  • Checked against MITRE ATT&CK (reference only), the Lockheed Martin paper Intelligence-Driven Computer Network Defense (Hutchins, Cloppert and Amin) and The Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) (reference only; no text copied).
  • Checked against Regulation (EU) 2016/679 (GDPR) on EUR-Lex, IETF RFC 2026, the CISA Vulnerability Disclosure Policy Template and the NIST National Checklist Program (reference only; no text copied).
  • Checked against Federal Rules of Civil Procedure Rule 37(e) (US), via Cornell LII (reference only; no text copied).
  • Expansions follow the SY0-801 acronym list as printed, including "Security Assertions Markup Language" (OASIS writes "Assertion"), "Mean Time to Repair" and "Continuous Integration and Continuous Deployment" (expansions only; no text copied).
  • Checked against IETF RFC 7208 (SPF), RFC 6376 (DKIM), RFC 9989 (DMARC, which replaced RFC 7489), RFC 5280 (X.509 certificates and CRLs), RFC 6960 (OCSP), RFC 2986 (certification requests), RFC 7011 (IPFIX), RFC 4226 (HOTP) and RFC 6238 (TOTP), and OASIS SAML V2.0 Core (reference only; no text copied).
  • Checked against NIST SP 800-126 Rev. 3 (SCAP), SP 800-34 Rev. 1, SP 800-94, SP 800-41 Rev. 1, SP 800-124 Rev. 2, SP 800-63B-4, SP 800-47 Rev. 1, SP 800-61 Rev. 3, SP 800-204C and the NIST CSRC glossary (public domain; reference only).
  • Checked against FIRST's CVSS v4.0 specification, the CVE Program and MITRE CWE pages, and NIST's National Vulnerability Database (reference only; no text copied).
  • Checked against the BIMI Group's site, OWASP's Web Application Firewall page and Top 10 for LLM Applications 2025 (CC BY-SA 4.0), the FBI IC3 public service announcement on business email compromise, and Microsoft Learn documentation for gMSA, Security Service Edge, CSPM, EDR and XDR (reference only; no text copied).
  • NIST SP 800-207, Zero Trust Architecture (public domain; reference only; no text copied).
  • NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (public domain; reference only; no text copied).
  • NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (public domain; reference only; no text copied).
  • NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (public domain; reference only; no text copied).
  • NIST SP 800-34 Rev. 1, SP 800-40 Rev. 4, SP 800-86, SP 800-88 Rev. 2 and SP 800-94 (public domain; reference only; no text copied).
  • NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (public domain; reference only; no text copied).
  • OWASP Top 10 for LLM Applications 2025 and OWASP Cheat Sheet Series (Password Storage, Virtual Patching) (CC BY-SA 4.0; reference only; no text copied).
  • IETF RFC 3414, RFC 3954, RFC 5280, RFC 6960, RFC 7011 and RFC 7489 (reference only; no text copied).
  • OASIS SAML 2.0 Core; FIRST CVSS v4.0 Specification; NVD CVE process page; MITRE ATT&CK (reference only; no text copied).
  • CISA Advisory AA24-038A and CISA living-off-the-land guidance (reference only; no text copied).
  • Microsoft Learn: Group Managed Service Accounts overview; Cloud Security Posture Management in Defender for Cloud (reference only; no text copied).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.