Home / Flashcard library / Careers & certifications / CompTIA Security+ (SY0-801) / Program Management & Oversight

Careers & certifications

CompTIA Security+ (SY0-801) — Program Management & Oversight flashcards

10 of 59 cards free to study here · 5 topics · the whole deck is built into Willys

SY0-801 domain 5 as scenario questions: policies, standards, procedures and plans, risk analysis and treatment with SLE, ARO and ALE, vendor selection and agreement types, GDPR-style privacy rights and legal holds, audits and penetration testing, and security awareness training.

Get the app All CompTIA Security+ (SY0-801) decks

Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. How does a security policy differ from a standard and from a procedure?
    A policy sets intent, a standard sets the measurable rule, and a procedure gives the steps.

    The policy is management's mandatory statement of what must be protected and why; a standard pins down specifics such as the approved disk encryption algorithm; a procedure walks a person through doing the task.
    Watch out: Guidelines are recommended practice, not requirements.
    Governance Documents
  2. An admin applies a published hardening benchmark but skips two items that break a payroll app, recording why. Why is that allowed when a benchmark is used as a guideline?
    Guidelines are recommendations meant to be tailored, not mandatory rules.

    Benchmarks, advisories, implementation guides and reference architectures describe good practice; the organization adopts what fits and documents its deviations. Once a setting is written into a standard or baseline, it becomes required.
    Governance Documents
  3. Why does risk identification start with an asset inventory and a named owner for each asset?
    You cannot assess risk to assets you do not know about, and every risk needs someone accountable for it.

    The owner is a business stakeholder, not just IT: they judge what the asset is worth, approve how it is protected and answer for the treatment chosen.
    Risk Management
  4. What separates a qualitative risk assessment from a quantitative one?
    Qualitative rates risk with categories such as low, moderate and high; quantitative uses numbers, typically money and frequencies.

    Qualitative results are quick and easy to communicate but hard to rank finely. Quantitative results support cost-benefit comparisons of controls but are only as reliable as their estimates.
    Risk Management
  5. A company shopping for a managed SOC first wants to learn what vendors can offer. Which request does it send, and what comes after?
    A request for information (RFI)

    Once the requirements are clear, a request for proposal (RFP) asks vendors how they would meet them, and a request for quote (RFQ) asks for pricing on a well-defined need.
    Third-Party Risk
  6. Before signing with a payroll SaaS provider, a company reviews its financial stability, security assessments, breach history and subcontractors. What is this?
    Due diligence

    It is the research done before entering a relationship to understand the risk a supplier brings, and it continues through monitoring after the contract is signed.
    Third-Party Risk
  7. A salesperson is told that a gift to a government official would speed up a contract award. Which compliance training topic covers this situation?
    Anti-bribery training

    It teaches staff to recognize improper payments, gifts and favors and to report the request. Financial staff get similar training on anti-money laundering and counter-terrorism financing to spot suspicious transactions.
    Compliance & Audits
  8. In compliance monitoring, what separates an acknowledgement from an attestation?
    An acknowledgement confirms someone received and read a requirement; an attestation formally declares the requirement is being met.

    Example: Staff acknowledge the updated AUP, while a manager attests each quarter that their team's access is still appropriate.
    Compliance & Audits
  9. An employee clicks a link in a simulated phishing email and is immediately shown a short lesson on spotting phishing. Which type of training is this?
    Corrective training

    It responds to a specific mistake right when it happens, which is when the lesson is most likely to stick.
    Security Awareness
  10. Accounts payable staff get extra sessions on payment fraud because they are the likeliest targets. Which type of training is this, and how does it differ from onboarding and ongoing training?
    Targeted training

    It focuses on the roles or people facing a particular risk. Onboarding gives every new hire the basics before access, and ongoing training refreshes everyone as threats change.
    Security Awareness

Unlock the whole deck

You are studying a free 10-card sample. All 59 cards of CompTIA Security+ (SY0-801) — Program Management & Oversight, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA Security+ (SY0-801) decks

General Security ConceptsThreats, Vulnerabilities & AttacksSecurity ArchitectureControls & MonitoringIdentity, Automation & ResponseCloze: AcronymsPractice Questions

← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

  • Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
  • Checked against NIST SP 800-30 Rev. 1, SP 800-37 Rev. 2, IR 8286 and SP 800-34 Rev. 1 (public domain) for risk assessment approaches, risk responses, residual risk, risk registers, risk appetite and business impact analysis (reference only; no text copied).
  • Checked against NIST CSF 2.0 and NIST SP 800-161 Rev. 1 (public domain) for policy, supplier due diligence and procurement steps (reference only; no text copied).
  • Checked against NIST SP 800-115, SP 800-12 Rev. 1 and SP 800-50 Rev. 1 (public domain) for rules of engagement, reconnaissance, test environments, functional testing and awareness program metrics (reference only; no text copied).
  • Checked against MITRE ATT&CK (reference only), the Lockheed Martin paper Intelligence-Driven Computer Network Defense (Hutchins, Cloppert and Amin) and The Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) (reference only; no text copied).
  • Checked against Regulation (EU) 2016/679 (GDPR) on EUR-Lex, IETF RFC 2026, the CISA Vulnerability Disclosure Policy Template and the NIST National Checklist Program (reference only; no text copied).
  • Checked against Federal Rules of Civil Procedure Rule 37(e) (US), via Cornell LII (reference only; no text copied).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.