CompTIA SY0-801 Practice Test 2026
Updated On : 22-Oct-2026Prepare smarter and boost your chances of success with our CompTIA SY0-801 practice test 2026. These CompTIA Security+ V8 Exam test questions helps you assess your knowledge, pinpoint strengths, and target areas for improvement. Surveys and user data from multiple platforms show that individuals who use SY0-801 practice exam are 40–50% more likely to pass on their first attempt.
Start practicing today and take the fast track to becoming CompTIA SY0-801 certified.
11500 already prepared
150 Questions
CompTIA Security+ V8 Exam
4.8/5.0
Security principles and controls
A company stores customer records on a laptop used by field staff. Which control best protects the data if the laptop is stolen?
A. Full-disk encryption
B. A longer screen timeout
C. A web application firewall
D. A file integrity baseline
Why this is correct: Answer A — Full-disk encryption. Full-disk encryption protects data at rest even if an attacker removes the drive or boots another operating system. It should be paired with strong authentication and managed recovery keys. The scenario asks: A company stores customer records on a laptop used by field staff. Which control best protects the data if the laptop is stolen? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Full-disk encryption acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company stores customer records on a laptop used by field staff. Which control best protects the data if the laptop is stolen? |
| Selected response | Full-disk encryption |
| Reason it fits | Full-disk encryption protects data at rest even if an attacker removes the drive or boots another operating system. It should be paired with strong authentication and managed recovery keys. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Full-disk encryption because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. A longer screen timeout:
This option is primarily designed to control how long an unattended session remains usable.
The key clue is the laptop may be physically lost, which makes Full-disk encryption the better response.
It would leave unauthorized reading of stored files unresolved.
Choose it when the main need is to limit how long an unattended device stays unlocked.
C. A web application firewall:
This option is primarily designed to inspect and filter web application requests.
The key clue is the laptop may be physically lost, which makes Full-disk encryption the better response.
It would leave unauthorized reading of stored files unresolved.
Choose it when the main need is to filter malicious HTTP requests.
D. A file integrity baseline:
This option is primarily designed to detect whether data or files have changed.
The key clue is the laptop may be physically lost, which makes Full-disk encryption the better response.
It would leave unauthorized reading of stored files unresolved.
Choose it when the main need is to verify data integrity.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A security policy requires that only the payroll team can view salary data, while HR can update employee addresses. Which principle is being applied?
A. Least privilege
B. Open access
C. Non-repudiation
D. High availability
Why this is correct: Answer A — Least privilege. Least privilege grants each user only the access needed for assigned work. The policy separates permissions by job task instead of giving broad access to everyone. The scenario asks: A security policy requires that only the payroll team can view salary data, while HR can update employee addresses. Which principle is being applied? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Least privilege acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A security policy requires that only the payroll team can view salary data, while HR can update employee addresses. Which principle is being applied? |
| Selected response | Least privilege |
| Reason it fits | Least privilege grants each user only the access needed for assigned work. The policy separates permissions by job task instead of giving broad access to everyone. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Least privilege because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Open access
- This option is primarily designed to make information or access broadly available.
- The key clue is different job duties require different permissions, which makes Least privilege the better response.
- It would leave excessive access to sensitive records unresolved.
- Choose it when the main need is to share information broadly under an approved need.
C. Non-repudiation
- This option is primarily designed to address a different security objective.
- The key clue is different job duties require different permissions, which makes Least privilege the better response.
- It would leave excessive access to sensitive records unresolved.
- Choose it when the main need is to address the different objective.
D. High availability
- This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
- The key clue is different job duties require different permissions, which makes Least privilege the better response.
- It would leave excessive access to sensitive records unresolved.
- Choose it when the main need is to assess or control AI-related risk.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A service desk verifies a user with a password and a one-time code from an authenticator app. What security measure is this?
A. Multifactor authentication
B. Single sign-on
C. Federation
D. Role mining
Why this is correct: Answer A — Multifactor authentication. The password is something the user knows, and the authenticator code is something the user has. Using factors from different categories provides multifactor authentication. The scenario asks: A service desk verifies a user with a password and a one-time code from an authenticator app. What security measure is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A service desk verifies a user with a password and a one-time code from an authenticator app. What security measure is this? |
| Selected response | Multifactor authentication |
| Reason it fits | The password is something the user knows, and the authenticator code is something the user has. Using factors from different categories provides multifactor authentication. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Multifactor authentication acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Multifactor authentication because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Single sign-on:
This option is primarily designed to address a different security objective.
The key clue is the user must provide two factor types, which makes Multifactor authentication the better response.
It would leave account takeover through a stolen password unresolved.
Choose it when the main need is to address the different objective.
C. Federation:
This option is primarily designed to address a different security objective.
The key clue is the user must provide two factor types, which makes Multifactor authentication the better response.
It would leave account takeover through a stolen password unresolved.
Choose it when the main need is to address the different objective.
D. Role mining:
This option is primarily designed to grant, restrict, or review user permissions.
The key clue is the user must provide two factor types, which makes Multifactor authentication the better response.
It would leave account takeover through a stolen password unresolved.
Choose it when the main need is to limit or review identity permissions.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A team wants users to prove who approved a contract and prevent them from later denying the approval. Which property is most relevant?
A. Non-repudiation
B. Availability
C. Confidentiality
D. Obfuscation
Why this is correct: Answer A — Non-repudiation. A digitally signed approval can provide evidence of who signed and whether the content changed. That supports non-repudiation when signing keys and identity controls are managed properly. The scenario asks: A team wants users to prove who approved a contract and prevent them from later denying the approval. Which property is most relevant? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Non-repudiation acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A team wants users to prove who approved a contract and prevent them from later denying the approval. Which property is most relevant? |
| Selected response | Non-repudiation |
| Reason it fits | A digitally signed approval can provide evidence of who signed and whether the content changed. That supports non-repudiation when signing keys and identity controls are managed properly. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Non-repudiation because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Availability
- This option is primarily designed to manage risks from AI inputs, outputs, or model behavior.
- The key clue is the approval must be attributable to its signer, which makes Non-repudiation the better response.
- It would leave disputes about who authorized the contract unresolved.
- Choose it when the main need is to assess or control AI-related risk.
C. Confidentiality
- This option is primarily designed to address a different security objective.
- The key clue is the approval must be attributable to its signer, which makes Non-repudiation the better response.
- It would leave disputes about who authorized the contract unresolved.
- Choose it when the main need is to address the different objective.
D. Obfuscation
- This option is primarily designed to address a different security objective.
- The key clue is the approval must be attributable to its signer, which makes Non-repudiation the better response.
- It would leave disputes about who authorized the contract unresolved.
- Choose it when the main need is to address the different objective.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A company wants access decisions to consider user identity, device health, and the requested resource every time. Which model best fits?
A. Zero Trust
B. Perimeter-only security
C. Implicit trust for internal users
D. Air gapping
Why this is correct: Answer A — Zero Trust. Zero Trust treats access as an explicit decision rather than trusting a user solely because they are on the corporate network. Identity, device state, context, and resource sensitivity can all inform the decision. The scenario asks: A company wants access decisions to consider user identity, device health, and the requested resource every time. Which model best fits? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Zero Trust acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company wants access decisions to consider user identity, device health, and the requested resource every time. Which model best fits? |
| Selected response | Zero Trust |
| Reason it fits | Zero Trust treats access as an explicit decision rather than trusting a user solely because they are on the corporate network. Identity, device state, context, and resource sensitivity can all inform the decision. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Zero Trust because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. Perimeter-only security |
|
| C. Implicit trust for internal users |
|
| D. Air gapping |
|
References: NIST SP 800-207 Zero Trust Architecture; SY0-801 draft objectives.
A firewall blocks inbound traffic from an unapproved source by default, with only documented exceptions. Which control approach is this?
A. Default deny
B. Open by default
C. Job rotation
D. Data masking
Why this is correct: Answer A — Default deny. Default deny blocks traffic unless an explicit rule permits it. This reduces exposure from forgotten or overly broad rules. The scenario asks: A firewall blocks inbound traffic from an unapproved source by default, with only documented exceptions. Which control approach is this? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A firewall blocks inbound traffic from an unapproved source by default, with only documented exceptions. Which control approach is this? |
| Selected response | Default deny |
| Reason it fits | Default deny blocks traffic unless an explicit rule permits it. This reduces exposure from forgotten or overly broad rules. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Default deny acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Default deny because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Open by default
- This option is primarily designed to address a different security objective.
- The key clue is only approved traffic should pass, which makes Default deny the better response.
- It would leave unnecessary network access unresolved.
- Choose it when the main need is to address the different objective.
C. Job rotation
- This option is primarily designed to address a different security objective.
- The key clue is only approved traffic should pass, which makes Default deny the better response.
- It would leave unnecessary network access unresolved.
- Choose it when the main need is to address the different objective.
D. Data masking
- This option is primarily designed to control the handling, exposure, or lifecycle of information.
- The key clue is only approved traffic should pass, which makes Default deny the better response.
- It would leave unnecessary network access unresolved.
- Choose it when the main need is to control data use or disclosure.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
PBQ-style scenario: A planned firewall change could interrupt a critical service. Which sequence best controls the change?
A. Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed
B. Implement immediately, disable monitoring, then ask for approval
C. Make the change, delete the old rules, and document only if an outage occurs
D. Give all engineers permanent admin access, then test in production
Why this is correct: Answer A — Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed. This sequence follows controlled change practice: assess risk and dependencies, authorize the work, choose a suitable window, monitor implementation, verify the outcome, and use a prepared rollback if necessary. The scenario asks: PBQ-style scenario: A planned firewall change could interrupt a critical service. Which sequence best controls the change? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | PBQ-style scenario: A planned firewall change could interrupt a critical service. Which sequence best controls the change? |
| Selected response | Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed |
| Reason it fits | This sequence follows controlled change practice: assess risk and dependencies, authorize the work, choose a suitable window, monitor implementation, verify the outcome, and use a prepared rollback if necessary. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Implement immediately, disable monitoring, then ask for approval:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the change may affect a critical service, which makes Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed the better response.
It would leave an unapproved outage or an unrecoverable configuration error unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
C. Make the change, delete the old rules, and document only if an outage occurs:
This option is primarily designed to defer, remove, or bypass a control or response.
The key clue is the change may affect a critical service, which makes Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed the better response.
It would leave an unapproved outage or an unrecoverable configuration error unresolved.
Choose it when the main need is to follow an approved plan that calls for the action.
D. Give all engineers permanent admin access, then test in production:
This option is primarily designed to grant, restrict, or review user permissions.
The key clue is the change may affect a critical service, which makes Assess impact, obtain approval, schedule the change, implement with monitoring, verify, and roll back if needed the better response.
It would leave an unapproved outage or an unrecoverable configuration error unresolved.
Choose it when the main need is to limit or review identity permissions.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A system owner wants to know whether a security safeguard is preventing unauthorized actions. Which metric best answers that question?
A. Control effectiveness evidence tied to the control objective
B. Number of pages in the security policy
C. Total number of employees
D. The age of the server
Why this is correct: Answer A — Control effectiveness evidence tied to the control objective. Control effectiveness should be measured against the intended security outcome, such as blocked unauthorized access or timely detection. Document length and unrelated inventory facts do not show whether the safeguard works. The scenario asks: A system owner wants to know whether a security safeguard is preventing unauthorized actions. Which metric best answers that question? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Control effectiveness evidence tied to the control objective acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A system owner wants to know whether a security safeguard is preventing unauthorized actions. Which metric best answers that question? |
| Selected response | Control effectiveness evidence tied to the control objective |
| Reason it fits | Control effectiveness should be measured against the intended security outcome, such as blocked unauthorized access or timely detection. Document length and unrelated inventory facts do not show whether the safeguard works. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Control effectiveness evidence tied to the control objective because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Number of pages in the security policy
- This option is primarily designed to define or guide organizational requirements and actions.
- The key clue is the goal is to test the safeguard outcome, which makes Control effectiveness evidence tied to the control objective the better response.
- It would leave an unverified or ineffective control unresolved.
- Choose it when the main need is to document governance requirements or repeatable steps.
C. Total number of employees
- This option is primarily designed to address a different security objective.
- The key clue is the goal is to test the safeguard outcome, which makes Control effectiveness evidence tied to the control objective the better response.
- It would leave an unverified or ineffective control unresolved.
- Choose it when the main need is to address the different objective.
D. The age of the server
- This option is primarily designed to address a different security objective.
- The key clue is the goal is to test the safeguard outcome, which makes Control effectiveness evidence tied to the control objective the better response.
- It would leave an unverified or ineffective control unresolved.
- Choose it when the main need is to address the different objective.
References: NIST SP 800-53 Rev. 5 security and privacy controls; SY0-801 draft objectives.
A company needs to prove that a downloaded software package has not changed in transit. Which technique is most appropriate?
A. Compare a cryptographic hash with a trusted published hash
B. Encrypt the file with a shared key and discard the key
C. Rename the file and compare its extension
D. Compress the file twice
Why this is correct: Answer A — Compare a cryptographic hash with a trusted published hash. A cryptographic hash produces a digest that changes when the input changes. Comparing it with a digest obtained through a trusted channel helps detect alteration, though it does not by itself prove who created the file. The scenario asks: A company needs to prove that a downloaded software package has not changed in transit. Which technique is most appropriate? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
| Decision point | Application to this question |
|---|---|
| Scenario cue | A company needs to prove that a downloaded software package has not changed in transit. Which technique is most appropriate? |
| Selected response | Compare a cryptographic hash with a trusted published hash |
| Reason it fits | A cryptographic hash produces a digest that changes when the input changes. Comparing it with a digest obtained through a trusted channel helps detect alteration, though it does not by itself prove who created the file. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Compare a cryptographic hash with a trusted published hash acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Compare a cryptographic hash with a trusted published hash because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
B. Encrypt the file with a shared key and discard the key:
This option is primarily designed to protect data confidentiality when it is stored or transmitted.
The key clue is integrity during transfer must be checked, which makes Compare a cryptographic hash with a trusted published hash the better response.
It would leave undetected modification of the package unresolved.
Choose it when the main need is to protect data from unauthorized reading.
C. Rename the file and compare its extension:
This option is primarily designed to address a different security objective.
The key clue is integrity during transfer must be checked, which makes Compare a cryptographic hash with a trusted published hash the better response.
It would leave undetected modification of the package unresolved.
Choose it when the main need is to address the different objective.
D. Compress the file twice:
This option is primarily designed to address a different security objective.
The key clue is integrity during transfer must be checked, which makes Compare a cryptographic hash with a trusted published hash the better response.
It would leave undetected modification of the package unresolved.
Choose it when the main need is to address the different objective.
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
An organization needs to encrypt a large database efficiently and then share the decryption capability with authorized systems. Which approach is common?
A. Use symmetric encryption for the data and protect the key with an asymmetric method
B. Use only a public-key algorithm for every database block
C. Hash the database and treat the hash as reversible encryption
D. Encode the database with Base64
Why this is correct: Answer A — Use symmetric encryption for the data and protect the key with an asymmetric method. Symmetric algorithms are efficient for bulk data. An asymmetric mechanism can protect or exchange the symmetric key, combining performance with controlled key distribution. The scenario asks: An organization needs to encrypt a large database efficiently and then share the decryption capability with authorized systems. Which approach is common? The decisive point is the requirement stated in that situation. This option is correct because its function matches that requirement directly. Another security measure may still be useful in a larger plan, but the question asks for the best response to the specific condition given. Keep the answer tied to the facts rather than adding assumptions about systems, users, threats, or business rules that the prompt does not mention.
Reasoning steps
- Identify the condition: Name the specific risk, task, or constraint described in the prompt. Avoid turning a narrow question into a broader problem that was not asked.
- Match purpose to need: Check that Use symmetric encryption for the data and protect the key with an asymmetric method acts on that condition and can produce the stated outcome.
- Check scope and dependencies: Confirm which systems, identities, data, approvals, or timing considerations would matter before applying the choice.
- Look for evidence: Decide how the responsible team would verify that the action worked, and what it would review if the expected result did not occur.
| Decision point | Application to this question |
|---|---|
| Scenario cue | An organization needs to encrypt a large database efficiently and then share the decryption capability with authorized systems. Which approach is common? |
| Selected response | Use symmetric encryption for the data and protect the key with an asymmetric method |
| Reason it fits | Symmetric algorithms are efficient for bulk data. An asymmetric mechanism can protect or exchange the symmetric key, combining performance with controlled key distribution. |
| Check after selection | Confirm the outcome in the relevant scope; do not assume that choosing one control removes every related risk. |
Operational note: Correct selection is the start of a controlled action, not evidence that implementation succeeded. In a real environment, the team would identify an owner, limit the change or response to the systems in scope, document important decisions, and validate the result. If a dependency or exception changes the risk, it should be handled through the relevant approval or incident process. The precise check depends on the control, but it should be observable and connected to the objective in the question. This prevents a well-intended action from being applied too broadly or left without follow-up.
Exam takeaway: Read the scenario for its constraint and requested outcome. Compare the options by purpose, scope, and timing. The best answer is Use symmetric encryption for the data and protect the key with an asymmetric method because it matches the stated need; the separate notes below explain why each distractor is weaker. Do not choose an option only because it sounds familiar or could help in a different situation.
Why the other options are incorrect
| Option | Why it does not fit |
|---|---|
| B. Use only a public-key algorithm for every database block |
|
| C. Hash the database and treat the hash as reversible encryption |
|
| D. Encode the database with Base64 |
|
References: NIST Cryptographic Standards and Guidelines; SY0-801 draft objectives.
| Page 1 out of 15 Pages |