CompTIA Security+ (SY0-801) — General Security Concepts flashcards
10 of 49 cards free to study here · 3 topics · the whole deck is built into Willys
SY0-801 domain 1 as scenario questions: defense in depth, CIA, AAA, non-repudiation, zero trust and least privilege, control categories and types, change management and its technical effects, and cryptography: PKI and certificates, encryption levels, key exchange, signatures, salting and hashing.
Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
A company puts a firewall at the edge, EDR on every laptop, MFA on logins and encrypted backups. Which principle is it applying, and why bother with so many layers?Defense in depth — several independent layers of protection.Security Controls
If one layer fails or is bypassed, the next can still stop or reveal the attacker, so no single weakness exposes everything. -
An attacker alters the amounts in a batch of bank transfers in transit without ever reading them. Which part of the CIA triad has been violated?Integrity — the data was changed without authorization.Security Controls
Confidentiality was not breached because nothing was disclosed, and the service stayed available. -
In the AAA framework, what is the difference between authentication and authorization, and where does accounting fit?Authentication proves who you are; authorization decides what that proven identity may do.Security Controls
Accounting then records what was actually done, for example which admin changed a firewall rule and when. -
A company needs to prove that a specific employee approved a purchase order so the employee cannot later deny it. Which security property is this, and what typically provides it?Non-repudiation, usually provided by a digital signature.Security Controls
Only the holder of the private signing key could have produced the signature, so the signer cannot credibly disown it. -
An engineer submits a request to open a new port on the perimeter firewall. What does the change advisory board (CAB) do with it before any work starts?It reviews the request and approves, rejects or reschedules it.Change Management
The CAB weighs the impact analysis, the test results and the backout plan, and may demand extra safeguards before saying yes. -
In change management, what separates the change owner from the stakeholders?The owner is accountable for the change from request to verification; stakeholders are everyone it affects.Change Management
Affected groups, for example the help desk, end users and managers, get a say before approval and a heads-up before any outage or visible change. -
Before forcing TLS on an internal API, the team works out which clients will break and whether any security control gets weaker. Which change step is this?Impact analysis.Change Management
It is done before implementation so the board approves a change with known security and operational effects, not surprises. -
A backup system must encrypt terabytes of data quickly using a key both ends already hold. Symmetric or asymmetric, and which algorithm is the standard choice?Symmetric encryption with AES, which is fast and built for bulk data.Cryptography & PKI
Why: asymmetric algorithms are far slower, so protocols use them to set up a shared key and then switch to a symmetric cipher. -
Alice must keep a message secret from everyone but Bob and also prove she wrote it. Which key does she use for each job?Bob's public key to encrypt; her own private key to sign.Cryptography & PKI
Bob alone can decrypt, since he holds the matching private key, while anyone holding Alice's public key can check her signature. -
Two parties on an untrusted network need to agree on a shared secret without ever transmitting it. Which key exchange technique does this, and what is the idea?Diffie-Hellman key exchange.Cryptography & PKI
Each side combines its own private value with the other's public value; both reach the same secret, and an eavesdropper cannot work it out from the public values.
Unlock the whole deck
You are studying a free 10-card sample. All 49 cards of CompTIA Security+ (SY0-801) — General Security Concepts, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More CompTIA Security+ (SY0-801) decks
← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.
About these cards
Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.
Checked against:
- Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
- Checked against NIST SP 800-207 Zero Trust Architecture and NIST SP 800-53 Rev. 5 (public domain) for zero trust tenets, least privilege, impact analysis and allow lists (reference only; no text copied).
- Checked against NIST SP 800-128 (public domain) for configuration change control, rollback and documentation (reference only; no text copied).
- Checked against NIST SP 800-57 Part 1 Rev. 5, SP 800-111, SP 800-63B-4, FIPS 180-4 and FIPS 202 (public domain) for keys, key strength, storage encryption, salting and hash functions (reference only; no text copied).
- Checked against IETF RFC 5280, RFC 6960, RFC 2986, RFC 9525, RFC 8446 and RFC 6151 for certificates, revocation, CSRs, wildcard matching, TLS 1.3 and MD5 status (reference only; no text copied).
- Checked against NIST SP 800-12 Rev. 1 and the NIST CSRC Glossary (public domain) for control categories, defense in depth, compensating controls, key escrow, HSM and TPM (reference only; no text copied).
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.
Use of these pages is covered by our Terms of Use.