العربية

SY0-801

CompTIA Security+ (SY0-801): free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

750 on the 100–900 scale This is your practice accuracy. It cannot be converted to the exam’s scaled score or used to determine whether you pass.

Back to CompTIA Security+ (SY0-801)

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01An attacker gains access to a payroll database and changes several employees' bank account numbers, but no data is copied out and the system stays online. Which security goal was MOST directly violated?

Practice question Unit: General Security Concepts

  1. AAvailability

    Availability was not affected because the system stayed online and usable.

  2. BConfidentiality

    Confidentiality is about disclosure; the scenario states no data was copied out.

  3. CAccounting

    Accounting is a function of AAA that records actions; it is not the property that the attacker violated here.

  4. DIntegrity ✓ Correct answer

    Unauthorized modification of data is a loss of integrity, the assurance that information is accurate and unaltered.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 1.1, p.4; FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems), security objectives: confidentiality, integrity, availability

02A hospital joins its sector's information sharing and analysis center (ISAC) and wants new indicators of compromise to load into its SIEM automatically, in a machine-readable format. Which approach BEST meets this goal?

Practice question Unit: Threats, Vulnerabilities, and Attacks

  1. AWait for the annual sector report and update SIEM rules once a year

    Yearly updates are far too slow for indicators that change daily.

  2. BSubscribe to the ISAC's structured threat feed delivered over a standard sharing protocol ✓ Correct answer

    A structured feed (for example STIX content over TAXII) lets tools ingest indicators automatically and quickly.

  3. CSearch social media daily for posts about attacks on hospitals

    Social media searching is unstructured and does not deliver machine-readable indicators.

  4. DHave an analyst read the ISAC's weekly PDF bulletin and type each indicator into the SIEM by hand

    Manual re-typing is slow and error-prone and is not automatic.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 2.1, p.6; OASIS STIX Version 2.1 and TAXII Version 2.1; NIST SP 800-150 (Guide to Cyber Threat Information Sharing)

03Hours after a ministry announces a controversial policy, its public website is replaced with a page carrying a protest slogan. No ransom is demanded and no data is taken. Which threat actor is MOST likely responsible?

Practice question Unit: Threats, Vulnerabilities, and Attacks

  1. AHacktivist ✓ Correct answer

    Hacktivists attack to promote a cause, and defacement with a protest message is typical.

  2. BAccidental insider

    An accidental insider causes harm by mistake, not by posting a deliberate protest message.

  3. CCompetitor

    A competitor would seek business advantage, not post a political slogan.

  4. DOrganized crime

    Organized crime is financially driven; there is no ransom or data theft here.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 2.2, p.6; NIST SP 800-30 Rev. 1 (Guide for Conducting Risk Assessments), Appendix D Threat Sources

04An attacker compromises a supplier's guest account in the company's team collaboration platform and posts a link labelled 'updated project budget' in a shared channel. Several staff click it and enter their credentials. Which threat vector was used?

Practice question Unit: Threats, Vulnerabilities, and Attacks

  1. ASupply chain-based, through a hardware implant

    Although a supplier account was abused, no hardware or product was tampered with in the supply chain.

  2. BPhysical-based, through an access badge

    No physical access or badge was involved.

  3. CSignal-based, through a Bluetooth connection

    The attack did not use any wireless signal such as Bluetooth.

  4. DMessage-based, through a collaboration tool ✓ Correct answer

    The lure arrived as a message in a collaboration platform, a message-based vector that users often trust more than email.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 2.3, p.7; NIST SP 800-53 Rev. 5 (Security and Privacy Controls for Information Systems and Organizations), SC-15 Collaborative Computing Devices and Applications

05A cloud team deploys environments from Infrastructure as Code templates. An audit finds the same open management port on 40 environments, all traced to one template. Which control would BEST prevent this in future?

Practice question Unit: Security Architecture

  1. AGive every engineer admin rights to close open ports quickly

    Broad admin rights increase risk and do not prevent the error.

  2. BScan and peer-review templates in the pipeline before deployment ✓ Correct answer

    Because IaC repeats whatever is in the template, checking templates before deployment fixes the error at its source.

  3. CRun a vulnerability scan of each environment once a year

    Yearly scans find problems long after deployment.

  4. DStop using templates and configure each environment by hand

    Manual configuration loses consistency and adds human error.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 3.1, p.11; NIST SP 800-218 (Secure Software Development Framework (SSDF) Version 1.1)

06Over five years an employee moved from accounts payable to procurement to treasury. A review shows she still has access rights from all three roles. What is this called?

Practice question Unit: Security Architecture

  1. ASeparation of duties

    Separation of duties is a control that this situation actually violates.

  2. BImpossible travel

    Impossible travel is a sign-in location anomaly.

  3. CPrivilege creep ✓ Correct answer

    Accumulating permissions from past roles without removal is privilege creep.

  4. DFederation

    Federation links identities across organizations.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 3.2, p.12; NIST SP 800-53 Rev. 5 (Security and Privacy Controls for Information Systems and Organizations), AC-6(7) Least Privilege: Review of User Privileges

07A company has one WAF for its payment pages and another for its public marketing site. Policy: card data must never pass uninspected; the marketing site must stay online even if inspection fails. How should each WAF be configured to fail?

Practice question Unit: Security Architecture

  1. APayment fail-open; marketing fail-closed, so that inspection is strictest where traffic is highest

    This reverses both requirements.

  2. BPayment fail-closed; marketing fail-open ✓ Correct answer

    Failing closed blocks uninspected card traffic, while failing open keeps the low-risk site available, matching each stated priority.

  3. CBoth fail-open

    Fail-open on payments would let card data pass uninspected.

  4. DBoth fail-closed, because security must always come before availability for every system

    Fail-closed on marketing breaks the availability requirement for that site.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 3.2, p.12; NIST SP 800-53 Rev. 5 (Security and Privacy Controls for Information Systems and Organizations), SC-24 Fail in Known State

08A hospital's infusion pumps share a flat network with staff laptops. After a laptop was infected, the security team wants to limit which devices can reach the pumps without replacing them. What should it do FIRST?

Practice question Unit: Security Operations

  1. AGive each pump a static IP address so that it is easier to find in the logs

    Static addressing helps tracking but blocks nothing.

  2. BMove the staff laptops to a faster switch on the same network

    A faster switch on the same flat network keeps the exposure unchanged.

  3. CInstall antivirus agents on every infusion pump before the next maintenance cycle

    Medical devices usually cannot run standard antivirus agents, and this does not limit reachability.

  4. DSegment the pumps and allow only the management server ✓ Correct answer

    Segmentation with tight rules limits which hosts can talk to the pumps and contains spread.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 4.1, p.15; NIST SP 800-53 Rev. 5 (Security and Privacy Controls for Information Systems and Organizations), SC-7 Boundary Protection

09Quarterly scans keep missing new laptops, because the scanner only targets a fixed list of subnets. Which source would BEST keep the scan scope current?

Practice question Unit: Security Operations

  1. AData from IP address management (IPAM) ✓ Correct answer

    IPAM shows which subnets and addresses are in use now, so scan targets stay complete.

  2. BLast year's penetration test report

    An old report reflects last year's network.

  3. CThe help desk's printed phone directory

    A phone directory does not list network addresses.

  4. DA list of the public domains the company owns

    Public domains do not cover internal laptop subnets.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 4.3, p.16; NIST SP 800-53 Rev. 5 (Security and Privacy Controls for Information Systems and Organizations), RA-5 Vulnerability Monitoring and Scanning

10An architect designing a new zero trust network wants a vendor-neutral model showing typical components and how they connect. Which artifact should she use?

Practice question Unit: Security Program Management and Oversight

  1. AThe acceptable use policy

    The AUP governs user behavior.

  2. BA runbook

    A runbook describes operational steps.

  3. CA reference architecture ✓ Correct answer

    A reference architecture provides a proven design template.

  4. DA security advisory

    An advisory warns about a specific threat.

Reference: CompTIA Security+ SY0-801 (V8) Exam Objectives v2.0, Objective 5.1, p.20; NIST SP 800-207 (Zero Trust Architecture), Section 3 Logical Components of Zero Trust Architecture

Keep preparing for CompTIA Security+ (SY0-801)

See also: Engineering Exams

All Engineering Exams (15)