CompTIA Security+ (SY0-801) — Controls & Monitoring flashcards
10 of 64 cards free to study here · 3 topics · the whole deck is built into Willys
SY0-801 domain 4, part 1: mitigating controls from segmentation and hardening to EDR, NAC, firewalls, DLP, email authentication and OS security; the asset life cycle; vulnerability management; and alerting and monitoring tools and protocols.
Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
A flat office network lets the point-of-sale terminals talk directly to staff laptops and guest devices. Which control limits how far an intruder on one laptop can reach?Segmentation — divide the network into zones, such as separate VLANs or subnets, and put the payment terminals in a zone of their own.Mitigating Controls
Traffic between zones must then pass a firewall or ACL that permits only what the terminals need, which contains lateral movement. -
Segmentation has put the HR file server in a zone of its own. What do access controls add on top of that boundary?The rules for who and what may cross it — ACLs, firewall rules and file permissions give each user, group or host only the access its role requires.Mitigating Controls
Segmentation draws the line; access controls enforce least privilege at that line and on the server itself. -
A new Linux server arrives with default accounts, unused services and every feature the vendor enables. What is the process of stripping it down, and what guides it?Hardening — remove or disable everything the system does not need, then tighten the settings that remain.Mitigating Controls
A security configuration checklist or benchmark, such as those in NIST's National Checklist Program, supplies tested settings so every build comes out the same. -
Attachments from outside the company should be opened and watched for malicious behavior before users receive them. Which technique does this?Sandboxing — the file runs in an isolated, disposable environment, often a virtual machine, where its actions are observed away from production systems.Mitigating Controls
NIST calls this a detonation chamber. Its job is a quick verdict on the file, unlike a honeypot, which keeps an attacker busy over time. -
Before rolling out an asset management program, what does the planning and scoping stage settle?What counts as an asset and how it will be tracked.Asset & Vulnerability Management
It decides which hardware, software, cloud and data assets are in scope, what details to record and who owns the inventory. Anything left out of scope is never inventoried, patched or retired, so gaps here become blind spots later. -
A department buys a SaaS tool on a corporate card, and security learns of it months later. Which asset life cycle stage was bypassed, and why does it matter?Acquisition/procurement — the formal buying process where security and supply chain requirements are checked before purchase.Asset & Vulnerability Management
Bypassing it creates shadow IT: an unvetted vendor holding company data, with no contract terms, inventory record or owner. -
During an incident, responders find a compromised server that no team admits to running. Which asset management practice would have prevented this?Assignment/accounting — each asset in the inventory records a named owner or role accountable for it, plus details such as location and purpose.Asset & Vulnerability Management
With an owner on record, someone can be contacted to patch, isolate or replace the asset when it is implicated in a breach. -
A team watches CPU and disk on servers, response times and error rates in its web app, and the health of switches and firewalls. Which three resource categories are these?Systems, applications and infrastructure.Alerting & Monitoring
All three matter because an attack often shows first in one layer, such as an error spike from injection attempts in the app or odd traffic through a firewall. -
Firewall, server and cloud logs sit on separate systems, so nobody connects a burst of failed logins on one with a large transfer on another. Which tool fixes this, and how?A SIEM — it aggregates logs from many sources, normalizes them and correlates related events, so a pattern spread across systems raises one alert.Alerting & Monitoring
Orchestration tools (SOAR) can then run the response playbook, such as blocking an address and opening a ticket, automatically. -
Analysts have stopped trusting the SIEM because almost all of its alerts turn out to be harmless. What is the fix, and what must it balance?Alert tuning — adjust rules, thresholds and exclusions so alerts reflect real threats.Alerting & Monitoring
Tuning cuts false positives and alert fatigue, but tuning too far creates false negatives, where real attacks pass silently.
Unlock the whole deck
You are studying a free 10-card sample. All 64 cards of CompTIA Security+ (SY0-801) — Controls & Monitoring, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More CompTIA Security+ (SY0-801) decks
← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.
About these cards
Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.
Checked against:
- Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
- Checked against NIST SP 800-53 Rev. 5, SP 800-40 Rev. 4, SP 800-41 Rev. 1, SP 800-70 Rev. 4, SP 800-83 Rev. 1, SP 800-88 Rev. 2, SP 800-124 Rev. 2, SP 800-161 Rev. 1 and SP 800-167 (public domain) for decoys, sandboxing, allow-listing, firewalls, mobile management, asset inventory, sanitization and vulnerability response (reference only; no text copied).
- Checked against NIST SP 800-92, SP 800-94, SP 800-115, SP 800-126 Rev. 3 (SCAP), SP 800-218 (SSDF) and SP 1800-5 (public domain) for log management, intrusion detection and prevention, testing, security automation and secure development (reference only; no text copied).
- Checked against IETF RFC 7208 (SPF), RFC 6376 (DKIM), RFC 9989 (DMARC, May 2026), RFC 5424 and RFC 5425 (syslog), RFC 3410, RFC 3411 and RFC 3414 (SNMPv3), RFC 3954 (NetFlow v9), RFC 7011 (IPFIX), RFC 3580 (802.1X and RADIUS), RFC 5209 (NEA) and RFC 8952 (captive portals) (reference only; no text copied).
- Checked against the OWASP Cheat Sheet Series (Input Validation, Session Management, Secrets Management), the OWASP Web Application Firewall page and the OWASP API Security Top 10 2023 (CC BY-SA 4.0; reference only).
- Checked against FIRST CVSS v4.0 and EPSS, and CISA's Known Exploited Vulnerabilities catalog and Vulnerability Disclosure Policy Template, for prioritization and disclosure (reference only; no text copied).
- Checked against the BIMI Group implementation guide and the IETF BIMI Internet-Draft (reference only; no text copied).
- Checked against Microsoft Learn (Group Policy, IPAM, Defender for Cloud CSPM, Defender for Endpoint and Defender XDR) and Red Hat's RHEL 9 SELinux guide for product-specific behavior (reference only; no text copied).
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.
Use of these pages is covered by our Terms of Use.