Home / Flashcard library / Careers & certifications / CompTIA Security+ (SY0-801) / Practice Questions

Careers & certifications

CompTIA Security+ (SY0-801) — Practice Questions flashcards

6 of 60 questions free to study here · 24 topics · the whole deck is built into Willys

Scenario-style multiple-choice questions across all five SY0-801 domains, one best answer each: controls and cryptography, threats and AI risks, architecture and data protection, operations, identity and incident response, and governance, risk and compliance.

Get the app All CompTIA Security+ (SY0-801) decks

Practice deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list
  1. A ransomware gang copies a clinic's patient records and threatens to publish them unless paid. The clinic's systems keep running normally and no records were altered. Which security goal has been compromised?

    A) Integrity
    B) Availability
    C) Non-repudiation
    D) Confidentiality
    D) Confidentiality

    The records were disclosed to an unauthorized party, which is a loss of confidentiality. Integrity would require the data to be changed, and availability was untouched because the systems kept running.
    Security Controls
  2. Without asking IT, a marketing team signs up for an online file-sharing service to swap large files with an outside agency. Why does the security team treat this as a risk?

    A) It is shadow IT that bypasses security monitoring
    B) It is a supply chain attack by the outside agency
    C) It is a hacktivist campaign against the company
    D) It is a watering hole set up to infect the team
    A) It is shadow IT that bypasses security monitoring

    Shadow IT is technology used without approval. Even with good intentions it bypasses security controls and monitoring, so sensitive data can leak unnoticed.
    Attack Surfaces
  3. A Windows service runs on four load-balanced servers under one domain account. The team wants Windows to rotate the account's password automatically so no administrator ever handles it. Which account type fits?

    A) Emergency access account
    B) Local administrator account on each server
    C) Group Managed Service Account
    D) Domain user account with a non-expiring password
    C) Group Managed Service Account

    A gMSA is a domain account that a set of servers can share while Windows manages its password. A user account with a non-expiring password leaves a static secret for people to handle, and local or emergency accounts are not shared service identities.
    Infrastructure Security
  4. The monitoring team polls routers with SNMPv2c, and an audit finds the community strings readable in packet captures. Which change BEST fixes this?

    A) Upgrade the devices to SNMPv3
    B) Move SNMP polling from UDP over to TCP
    C) Change the community strings every month
    D) Use SNMP traps instead of regular polling
    A) Upgrade the devices to SNMPv3

    SNMPv3 adds user authentication, integrity and encryption. Versions 1 and 2c send community strings in cleartext, so rotating them only changes what an eavesdropper reads.
    Alerting & Monitoring
  5. Fileless malware is suspected on a production server that is still running. Which evidence should the investigator capture first?

    A) A memory dump
    B) A bit-level copy of the disk
    C) A recent vulnerability scan report
    D) Surveillance footage of the server room
    A) A memory dump

    Memory is the most volatile source and is where fileless malware lives, so it is collected before a reboot or shutdown wipes it. A bit-level disk copy matters too but lasts longer, and scans or footage do not hold the running code.
    Investigations
  6. An accounts payable clerk receives an email from a long-standing supplier's real mailbox announcing new bank details for all future invoices. The supplier's account has been compromised. Which control BEST prevents a fraudulent payment?

    A) Block every email attachment that suppliers send
    B) Require the clerk to use a longer password
    C) Enforce DMARC on the company's own domain
    D) Verify bank changes by calling a number on file
    D) Verify bank changes by calling a number on file

    This is business email compromise, and verifying through a known contact defeats it even when the sender's mailbox is genuine. A longer password or DMARC on the company's own domain does not stop a message sent from the supplier's real account.
    Security Awareness

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of CompTIA Security+ (SY0-801) — Practice Questions, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA Security+ (SY0-801) decks

General Security ConceptsThreats, Vulnerabilities & AttacksSecurity ArchitectureControls & MonitoringIdentity, Automation & ResponseProgram Management & OversightCloze: Acronyms

← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

  • Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
  • NIST SP 800-207, Zero Trust Architecture (public domain; reference only; no text copied).
  • NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (public domain; reference only; no text copied).
  • NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (public domain; reference only; no text copied).
  • NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (public domain; reference only; no text copied).
  • NIST SP 800-34 Rev. 1, SP 800-40 Rev. 4, SP 800-86, SP 800-88 Rev. 2 and SP 800-94 (public domain; reference only; no text copied).
  • NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (public domain; reference only; no text copied).
  • OWASP Top 10 for LLM Applications 2025 and OWASP Cheat Sheet Series (Password Storage, Virtual Patching) (CC BY-SA 4.0; reference only; no text copied).
  • IETF RFC 3414, RFC 3954, RFC 5280, RFC 6960, RFC 7011 and RFC 7489 (reference only; no text copied).
  • OASIS SAML 2.0 Core; FIRST CVSS v4.0 Specification; NVD CVE process page; MITRE ATT&CK (reference only; no text copied).
  • CISA Advisory AA24-038A and CISA living-off-the-land guidance (reference only; no text copied).
  • Microsoft Learn: Group Managed Service Accounts overview; Cloud Security Posture Management in Defender for Cloud (reference only; no text copied).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.