CompTIA SY0-801: CompTIA Security+ (V8)

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Security Operations

   A SIEM receives authentication failures from many hosts within minutes of each other, followed by a success from an unusual location. Which SIEM capability links these events into one alert?

   1. ACorrelation rules that combine related events across sources into a single incident
   2. BFull-disk encryption on the SIEM server, protecting stored logs with AES-256
   3. CA DHCP lease log archive kept on a file share, listing client MAC addresses
   4. DA printer status dashboard showing toner levels, paper trays, and job queue
   Show answer and explanationHide answer

   Correct answer: A

   Correlation rules join related events by time, source, and pattern, which reveals a probable password attack. Disk encryption, DHCP logs, and printer dashboards do not connect events across sources.

2. Question 2Threats, Vulnerabilities, and Attacks

   An attacker sends a convincing email to a finance manager, referencing a real vendor invoice and the manager's name, asking for an urgent wire transfer. Which attack type is this?

   1. ASQL injection
   2. BSpear phishing
   3. CRootkit installation
   4. DDenial of service
   Show answer and explanationHide answer

   Correct answer: B

   Spear phishing targets a specific person using tailored details, here a real invoice and the manager's name. Denial of service, SQL injection, and rootkits do not rely on targeted deception of a person.

3. Question 3Security Architecture

   A company wants to stop trusting users and devices simply because they are inside the corporate network. Which model does this describe?

   1. AAir gap
   2. BDefense in depth only
   3. CSecurity through obscurity
   4. DZero trust
   Show answer and explanationHide answer

   Correct answer: D

   Zero trust verifies every request based on identity, device health, and context regardless of network location. An air gap isolates a network, while defense in depth layers controls without changing the trust assumption, and obscurity is not a security model.

4. Question 4General Security Concepts

   A hospital ensures that a patient record cannot be altered without detection by using a cryptographic digest that is compared on each access. Which security goal is this?

   1. AIntegrity
   2. BConfidentiality
   3. CAvailability
   4. DNon-repudiation only
   Show answer and explanationHide answer

   Correct answer: A

   Digests detect unauthorized modification, which protects integrity. Availability concerns access when needed, and confidentiality concerns disclosure, while non-repudiation is about proving origin rather than detecting change.

5. Question 5Security Program Management and Oversight

   A risk register lists a vulnerability in a payment system with a likelihood of 4 out of 5 and an impact of 5 out of 5. What is the best next step under a risk management process?

   1. ADelete it from the risk register to clean up the list and reduce the number of items
   2. BIgnore it because a likelihood and impact score is merely a subjective estimate of risk
   3. CAccept the risk informally and leave the decision undocumented while the payment
   4. DPrioritize it for treatment, assign an owner, and set a remediation deadline
   Show answer and explanationHide answer

   Correct answer: D

   A high likelihood and impact score calls for prompt treatment with an accountable owner and deadline. Ignoring, undocumented acceptance, or deleting the entry removes oversight of a serious risk.