CompTIA Security+ (SY0-801) — Identity, Automation & Response flashcards

10 of 64 cards free to study here · 4 topics · the whole deck is built into Willys

SY0-801 domain 4, part 2, as scenario questions: account life cycle, federation, SSO, MFA, access control models and passwordless login, automation and AI in security operations, incident response from preparation to post-incident review, and investigation data sources.

Get the app All CompTIA Security+ (SY0-801) decks

Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list

An employee resigns on Friday. Which account step matters most, and why tie it to the HR system rather than to a manager's email?

Deprovisioning: disable the account and revoke its access, sessions and keys as soon as employment ends.

Driven by the HR record, removal happens automatically and completely; manual requests get forgotten and leave orphaned accounts that an ex-employee or attacker can still use.
Identity & Access
A developer who moved from finance to engineering two years ago still has full access to the finance share. What is the problem, and which recurring process should catch it?

Privilege creep, which a periodic access review should catch.

The resource owner or manager confirms each person's access is still needed for the current job and removes the rest. Privileged roles, guests and partners deserve particular attention.
Identity & Access
Before issuing a remote worker's first credential, the provider checks that her ID document is genuine, that its details match records, and that she is the person it describes. What is this process?

Identity proofing: establishing that an applicant really is the person they say they are before any account or credential is issued.

NIST SP 800-63A-4 frames it as resolving the identity to one unique person, validating the evidence and attributes, and verifying the applicant owns them. Sign-in authentication comes later.
Identity & Access
New hires get accounts, group memberships and a mailbox within minutes of appearing in the HR system, with no ticket. Which automation use case is this, and what is the security gain?

Automated user provisioning.

Every account is built from the same role template, so access is consistent and least-privilege, and the same workflow removes it at departure. Manual setup invites copy-a-colleague access.
Automation & Orchestration
Why do teams build cloud servers and networks from version-controlled templates instead of clicking through a console?

Scripted resource provisioning gives repeatable, reviewable builds.

Every environment comes from the same definition, so security settings are not skipped, changes get peer review, and a compromised system can be redeployed quickly from a clean template.
Automation & Orchestration
A configuration tool checks every server each hour and reverts any setting that has drifted from the approved definition. Which automation use case is this?

Desired state management.

The target configuration is declared as code, and the tool detects drift and corrects it, as Microsoft's Desired State Configuration does. Baselines stay enforced without waiting for an audit.
Automation & Orchestration
In what order does the SY0-801 objectives document list incident response activities?

Preparation → Identification → Investigation → Containment → Negotiation → Eradication/recovery → Notification/external reporting → Post-incident.

That is SY0-801's own list. NIST SP 800-61 Rev. 3 instead organizes response around the CSF 2.0 Functions: Detect, Respond and Recover, with Govern, Identify and Protect as preparation.
Incident Response
What separates a tabletop exercise from a simulation?

A tabletop is a discussion; a simulation acts the scenario out.

In a tabletop, a facilitator presents a scenario and the team talks through its roles and the plan. In a simulation, people carry out their response steps against a realistic scenario without touching production.
Incident Response
An analyst needs to know which internal host sent 4 GB to an unfamiliar IP address last night, but nothing captured full packets. Which data source answers this?

NetFlow or IPFIX flow records.

Flows summarize each conversation, with addresses, ports, protocol, byte counts and times, but no payload. IPFIX (RFC 7011) is the IETF standard that grew out of Cisco's NetFlow version 9.
Investigations
When does an investigation need a packet capture rather than flow data, and what is the cost?

When you need the content: the actual payload, commands, files or protocol detail of a session.

Full captures are huge, so they are kept briefly or targeted, and encrypted traffic reveals little without the keys.
Investigations

Unlock the whole deck

You are studying a free 10-card sample. All 64 cards of CompTIA Security+ (SY0-801) — Identity, Automation & Response, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA Security+ (SY0-801) decks

General Security Concepts Threats, Vulnerabilities & Attacks Security Architecture Controls & Monitoring Program Management & Oversight Cloze: Acronyms Practice Questions

← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
Checked against NIST SP 800-63A-4, SP 800-63B-4 and SP 800-63C-4 Digital Identity Guidelines (public domain) for identity proofing, federation, MFA, look-up secrets, biometrics, phishing resistance and password rules (reference only; no text copied).
Checked against NIST SP 800-61 Rev. 3 (public domain) for the CSF 2.0-based response model, playbooks, exercises, root cause analysis, evidence preservation and notification (reference only; no text copied).
Checked against NIST SP 800-86 and SP 800-92 (public domain) for forensic phases, imaging, volatile data, log parsing, normalization and log integrity, and the NIST CSRC glossary for access control models and IR terms (reference only; no text copied).
Checked against IETF RFC 6749 (OAuth 2.0), RFC 4511 and RFC 4513 (LDAP), RFC 6238 (TOTP), RFC 4226 (HOTP), RFC 7011 (IPFIX), RFC 3954 (NetFlow v9) and RFC 3227 (evidence collection) (reference only; no text copied).
Checked against the OASIS SAML V2.0 Technical Overview and the FIDO Alliance passkeys pages (reference only; no text copied).
Checked against the OWASP Top 10 for LLM Applications 2025 (LLM06 Excessive Agency) and the OWASP CI/CD Security Cheat Sheet (CC BY-SA 4.0; reference only; no text copied).
Checked against the CISA #StopRansomware Guide and the U.S. Treasury OFAC advisory on ransomware payments (2021) (reference only; no text copied).
Checked against Microsoft Learn pages on emergency access accounts, Privileged Identity Management, access reviews, Desired State Configuration, group managed service accounts and minimum password age (reference only; no text copied).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.