Free SY0-801 Practice Test: 30 Security+ V8 Questions
30 free practice questions for Security+ V8, written against CompTIA's published SY0-801 objectives. They follow the exam's domain weights, and 24 of them test topics that were never on SY0-701, from prompt injection to passkeys and canary accounts. Every answer is explained. No account needed.
Written against the SY0-801 objectives, document version 2.0
SY0-801 launches on or around November 17, 2026, and SY0-701 stays bookable until June 11, 2027. Each card names the V8 objective it tests, and the ones marked new cover material a SY0-701 course will not teach you. Not sure which exam to book?
- Question 1Objective 1.1
An organization stops trusting devices just because they sit on the office network. Every request to an internal app is now checked against the user's identity, the device's health, and the context of the request, every single time. Which principle is the organization applying?
- ASeparation of duties
- BDefense in depth
- CNon-repudiation
- DZero Trust
Show answer and explanation
Correct answer: D. Zero Trust
Zero Trust never trusts a request because of where it comes from. Each request is verified on its own, using identity, device health, and context. Defense in depth layers several controls, non-repudiation proves who did something, and separation of duties splits critical tasks between people.
- Question 2Objective 1.1
A legacy payroll server cannot be patched, so the team moves it to an isolated network segment and watches it closely until it can be replaced. What type of control is the isolation?
- ACorrective
- BPhysical
- CDirective
- DCompensating
Show answer and explanation
Correct answer: D. Compensating
A compensating control is a substitute used when the primary control, here patching, cannot be applied. Corrective controls fix a problem after it happens, directive controls tell people what to do, and physical is a control category rather than a control type.
- Question 3Objective 1.2New in V8
During an approved maintenance window, a database upgrade partly fails. Rolling it back would take longer than the window allows, so the team applies a tested fix and finishes the upgrade instead. Which change management approach did the team use?
- AFail forward
- BImpact analysis
- CBackout plan
- DVersion control
Show answer and explanation
Correct answer: A. Fail forward
Failing forward means fixing the problem and completing the change rather than reverting it. A backout plan is the documented way to undo a change, impact analysis happens before the change is approved, and version control tracks revisions of code and documents.
- Question 4Objective 1.3
A hospital wants each patient's row in its database encrypted under a separate key, so that one exposed key does not expose any other patient. Which level of encryption is this?
- ATransport
- BRecord
- CVolume
- DFull disk
Show answer and explanation
Correct answer: B. Record
Record-level encryption protects individual rows or entries, and each can have its own key. Full-disk and volume encryption protect storage as a whole and decrypt everything once unlocked, and transport encryption only protects data while it crosses a network.
- Question 5Objective 1.3
Two systems use the same AES algorithm. One uses a 128-bit key and the other a 256-bit key. What does the longer key mainly change?
- AIt makes each encryption run take twice as long to finish
- BBrute-forcing the key takes far longer
- CIt switches the cipher from symmetric to asymmetric encryption
- DIt turns the cipher into a one-way hashing algorithm
Show answer and explanation
Correct answer: B. Brute-forcing the key takes far longer
Key length sets how many possible keys exist, and each added bit doubles the work of a brute-force search. AES-256 runs a few more rounds than AES-128, so it is a little slower, but nowhere near twice as slow. A longer key also does not change the algorithm type or turn encryption into hashing.
- Question 6Objective 2.1
A scanner report lists a finding as CVE-2026-1234 with a base score of 9.8. Which statement correctly describes the two parts of that line?
- ACVE scores how severe a flaw is; CVSS gives it a name
- BCVE lists available patches; CVSS lists affected products
- CCVE names the flaw; CVSS scores how severe it is
- DBoth are severity scores published by different vendors
Show answer and explanation
Correct answer: C. CVE names the flaw; CVSS scores how severe it is
A CVE entry is a unique identifier for a publicly known vulnerability. CVSS is the scoring system that rates severity on a 0.0 to 10.0 scale, so the 9.8 is a CVSS score. On SY0-701 these sat under vulnerability management; V8 moves them to the new objective 2.1.
- Question 7Objective 2.2New in V8
A rival manufacturer pays someone to break into a company's file server and copy its unreleased product designs. Which threat actor and motivation fit best?
- AHacktivist seeking notoriety
- BInsider threat seeking revenge
- CCompetitor seeking intellectual property
- DUnskilled attacker driven by general curiosity
Show answer and explanation
Correct answer: C. Competitor seeking intellectual property
A competitor is a rival business, and stealing unreleased designs is about intellectual property. Hacktivists act for a cause, unskilled attackers lack resources and are often just curious, and an insider acting from revenge works from inside the organization. Competitor is one of the actor types V8 added.
- Question 8Objective 2.3New in V8
An attacker with access to a Windows server avoids dropping any malware. Instead they move around with PowerShell and WMI, tools that were already installed on the system. Which threat vector is this?
- ACompromised managed service provider
- BLiving-off-the-land tools
- CWatering hole
- DMalicious USB media
Show answer and explanation
Correct answer: B. Living-off-the-land tools
Living-off-the-land attacks use trusted tools that are already present, such as PowerShell and WMI, so there is little new code for antivirus to flag. A watering hole compromises a site the targets visit, malicious USB media delivers code on a removable drive, and an MSP compromise arrives through a trusted provider.
- Question 9Objective 2.4New in V8
Customer export files were exposed because a cloud storage bucket allowed anonymous public reads. Which vulnerability does this describe?
- AUnsafe exception handling
- BPublic object storage
- CRace condition
- DHardcoded secrets
Show answer and explanation
Correct answer: B. Public object storage
Object storage, such as an S3 bucket or an Azure Blob container, becomes an attack surface when its access policy allows public reads. A race condition is a timing flaw, hardcoded secrets are credentials written into code, and unsafe exception handling leaks details when errors occur.
- Question 10Objective 2.5New in V8
A login page answers "Unknown username" for accounts that do not exist and "Wrong password" for accounts that do. An attacker scripts thousands of attempts to build a list of valid usernames. Which attack is this?
- AUser enumeration
- BReplay
- CDirectory traversal
- DPassword spraying
Show answer and explanation
Correct answer: A. User enumeration
User enumeration reads differences in a system's responses to learn which accounts exist, and the list then feeds password spraying or brute force. Password spraying tries a few common passwords across many accounts, a replay attack resends captured authentication data, and directory traversal reaches files outside a web root.
- Question 11Objective 2.6New in V8
An AI assistant at a software firm summarizes incoming support emails. An attacker sends an email with hidden text telling the assistant to forward every summary to an outside address. Which AI threat is this?
- APrompt injection
- BHallucination
- CEvasion
- DTraining data poisoning
Show answer and explanation
Correct answer: A. Prompt injection
Prompt injection hides instructions inside content the model processes, so the model follows attacker text as if it were a command. Poisoning corrupts the training data before the model is built, a hallucination is a confident but false answer, and evasion crafts inputs that slip past a model's detection.
- Question 12Objective 2.6New in V8
Over several months, attackers submit thousands of mislabeled samples to a malware classifier's public feedback portal, which feeds its retraining. The model then starts treating the attackers' malware as clean. Which AI threat does this describe?
- AEvasion
- BPoisoning
- CJailbreaking
- DPrompt injection
Show answer and explanation
Correct answer: B. Poisoning
Poisoning corrupts the data a model learns from, so the weakness is built into the model itself. Evasion also gets malware past a model, but it does so by crafting inputs at run time against an unchanged model. Jailbreaking talks a model past its safety rules, and prompt injection smuggles instructions into its input.
- Question 13Objective 2.6New in V8
An employee pastes a confidential merger memo into a public AI chatbot to get a quick summary. The provider's terms allow chats to be used for training future models. Which AI risk does this create?
- AHallucination
- BBias
- CExplainability
- DData loss
Show answer and explanation
Correct answer: D. Data loss
Sending sensitive data to an outside AI service can move it out of the organization's control for good, which is the data loss risk in the AI objective. Bias is skewed or unfair output, explainability is how hard it is to see why a model decided something, and a hallucination is confident but false output.
- Question 14Objective 3.1
A European company is told its customer data must stay subject to EU law, so it can only use cloud regions physically located in the EU. Which business consideration is driving this?
- APower requirements
- BScalability
- CEase of recovery
- DData sovereignty
Show answer and explanation
Correct answer: D. Data sovereignty
Data sovereignty means data is subject to the laws of the country where it is stored, so its location becomes a legal requirement. The other three are real architecture concerns, but none of them decides which country's law applies.
- Question 15Objective 3.2New in V8
Most of a firm's staff work remotely. It wants a cloud-delivered secure web gateway, cloud access security broker, and zero trust network access, without changing how its own network routes traffic. Which architecture fits best?
- APhysical network segmentation
- BAn air-gapped network for remote staff
- CSoftware-defined wide area network (SD-WAN)
- DSecurity Service Edge (SSE)
Show answer and explanation
Correct answer: D. Security Service Edge (SSE)
SSE is the security half of SASE: a cloud-delivered SWG, CASB, and ZTNA, without the SD-WAN networking piece. SD-WAN is about routing traffic between sites, and an air gap or physical segmentation would cut remote staff off rather than secure their access.
- Question 16Objective 3.2New in V8
Windows admins want service accounts with long random passwords that change on their own, so that no person ever has to know or rotate them. What should they use?
- AShared local administrator accounts
- BGuest accounts with password expiration
- CGroup Managed Service Accounts (gMSAs)
- DEmergency access accounts
Show answer and explanation
Correct answer: C. Group Managed Service Accounts (gMSAs)
A gMSA is an Active Directory account whose password the domain generates and rotates automatically, which removes a long-lived service password that people know. Shared admin and guest accounts weaken accountability, and emergency access accounts are reserved for break-glass situations.
- Question 17Objective 3.3New in V8
A payroll company processes employee data on behalf of its client companies, and it hires a cloud provider to host that data. Which data protection role does the cloud provider hold?
- AData owner
- BData steward
- CData subprocessor
- DData controller
Show answer and explanation
Correct answer: C. Data subprocessor
The client companies decide why the data is processed, which makes them controllers. The payroll company processes it on their behalf, and a provider it brings in to handle that same data is a subprocessor. A data owner is accountable for data inside an organization, and a data steward looks after its quality.
- Question 18Objective 3.4New in V8
After a ransomware attack, a company finds its backups were encrypted too, because the attacker used a stolen admin account to reach them. Which backup property would have prevented this?
- AImmutability
- BLonger retention
- CReal-time replication
- DWider scope
Show answer and explanation
Correct answer: A. Immutability
Immutable backups cannot be changed or deleted for a set period, even by an administrator, so stolen admin rights cannot encrypt them. Longer retention and wider scope do not stop changes, and real-time replication would copy the encrypted files along with everything else.
- Question 19Objective 4.1New in V8
A security team creates a convincing but unused domain admin account named svc_backup_admin and raises an alert on any attempt to log in to it. What kind of account is this?
- AA canary account
- BA honeynet
- CAn emergency access account
- DA service account
Show answer and explanation
Correct answer: A. A canary account
A canary account exists only as bait. No legitimate user should ever touch it, so any use is a high-confidence alert. A real service account runs software, an emergency access account is for break-glass use, and a honeynet is a whole network of decoy systems.
- Question 20Objective 4.1New in V8
A developer accidentally commits a cloud API key to a company Git repository. Which control would catch this automatically?
- ASecrets scanning
- BInput validation
- CA web application firewall
- DCode signing
Show answer and explanation
Correct answer: A. Secrets scanning
Secrets scanning checks repositories for credentials such as API keys, tokens, and private keys, ideally blocking the push before the secret is exposed. Code signing proves who published code, input validation checks the data an application receives, and a WAF filters web traffic.
- Question 21Objective 4.1New in V8
Which email standard lets a domain display its verified brand logo in supported inboxes, but only once the domain enforces DMARC?
- ABIMI
- BSPF
- CS/MIME
- DDKIM
Show answer and explanation
Correct answer: A. BIMI
BIMI (Brand Indicators for Message Identification) shows a sender's verified logo, and mailbox providers only honor it when the domain's DMARC policy is set to quarantine or reject. SPF lists the servers allowed to send for a domain, DKIM signs messages, and S/MIME encrypts and signs individual messages.
- Question 22Objective 4.3New in V8
A cloud team wants continuous, automatic checks for misconfigurations such as storage left public or logging turned off, across every one of its cloud accounts. Which tool fits?
- AIPAM
- BSOAR
- CCSPM
- DNetFlow
Show answer and explanation
Correct answer: C. CSPM
Cloud security posture management (CSPM) continuously compares cloud configurations against policies and benchmarks and flags drift such as public storage or disabled logging. IPAM tracks IP address allocation, SOAR automates response workflows, and NetFlow records traffic flow data.
- Question 23Objective 4.5New in V8
A company replaces passwords with passkeys for its web apps. Why are passkeys resistant to phishing?
- AThey are longer than passwords, so attackers cannot guess one before the account locks
- BThey are bound to the site they were created for, so a fake site cannot use them
- CThey expire every 30 days, so stolen passkeys stop working before attackers use them
- DThey are sent by text message, so they never travel over the internet with a password
Show answer and explanation
Correct answer: B. They are bound to the site they were created for, so a fake site cannot use them
A passkey is a key pair. The private key stays on the user's device, and the browser only offers it to the exact site it was registered with, so a look-alike phishing domain gets nothing it can use. Passkeys do not expire on a schedule, are not sent by text message, and do not rely on length the way a password does.
- Question 24Objective 4.6New in V8
A SOC plans to deploy an agentic AI that can act on its own, such as disabling accounts and isolating hosts, when it spots an attack. Which consideration matters most before turning it on?
- ARunning it only in business hours, when analysts are at their desks
- BGuardrails that limit what it may do without a person's approval
- CPicking the model that scored highest on public accuracy benchmarks
- DFeeding it every log source on day one so it can see the whole estate
Show answer and explanation
Correct answer: B. Guardrails that limit what it may do without a person's approval
An agentic AI takes actions by itself, so guardrails, such as approval steps, a list of allowed actions, and limits on scope, keep one bad decision from locking out the whole company. Benchmark scores, more log sources, and limited hours can all help, but none of them stops the agent from taking a harmful action on its own.
- Question 25Objective 4.7New in V8
Ransomware has encrypted a hospital's systems. While the affected systems stay isolated, the hospital hires a specialist firm to communicate with the attackers and buy time. Which incident response activity is this?
- ANegotiation
- BThreat hunting
- CE-discovery
- DEradication
Show answer and explanation
Correct answer: A. Negotiation
V8 lists negotiation under containment: talking to the attackers, often through a specialist, to buy time and learn what they took while systems stay isolated. Eradication removes the threat, threat hunting searches for undetected activity, and e-discovery collects data for legal proceedings.
- Question 26Objective 4.8New in V8
Investigators suspect fileless malware that runs only in RAM on a compromised server. Which data source must they capture before the server is powered off?
- AA memory dump
- BA vulnerability scan
- CA bit-level copy of the disk
- DThe firewall logs
Show answer and explanation
Correct answer: A. A memory dump
Fileless malware lives in memory, so a memory dump is the only place to capture it, and RAM is lost when the power goes off. A bit-level copy of the disk is still worth taking, but it misses code that never touched the disk, and firewall logs and scans show activity around the malware rather than the malware itself.
- Question 27Objective 5.1New in V8
An on-call engineer restarts a failed payment service by following a document that lists the exact commands in order. Which artifact is this?
- AA reference architecture
- BA guideline
- CA policy
- DA runbook
Show answer and explanation
Correct answer: D. A runbook
A runbook gives exact, step-by-step instructions for one operational task. A policy states what must happen and why, a reference architecture is a model design to build from, and a guideline offers recommendations rather than steps you must follow.
- Question 28Objective 5.3New in V8
A retailer knows it needs a managed SOC service and has written down its requirements. It now wants vendors to submit full solutions with pricing it can compare. Which document should it send?
- ARequest for proposal (RFP)
- BRequest for information (RFI)
- CMemorandum of understanding (MOU)
- DService-level objective (SLO)
Show answer and explanation
Correct answer: A. Request for proposal (RFP)
An RFP asks vendors for a complete proposed solution and price against known requirements. An RFI comes earlier, to learn what options exist, an MOU records a non-binding understanding between parties, and an SLO is a target inside a service agreement.
- Question 29Objective 5.5New in V8
Before an internal audit program starts, leadership approves a document that sets out the audit function's authority, scope, and independence. Which document is this?
- AA risk register
- BA gap analysis
- CA statement of work
- DAn audit charter
Show answer and explanation
Correct answer: D. An audit charter
An audit charter formally establishes the audit function: its purpose, authority, scope, and independence. A gap analysis compares the current state with a target, a statement of work defines one engagement's deliverables, and a risk register tracks identified risks.
- Question 30Objective 5.6New in V8
An employer's training platform raises the rating of employees who keep clicking simulated phishing links, then assigns them extra targeted training. What is this practice?
- AAn acceptable use policy review
- BData classification and labeling
- CPersonnel behavior risk scoring
- DOnboarding training for new hires
Show answer and explanation
Correct answer: C. Personnel behavior risk scoring
Personnel behavior risk scoring rates people by how they handle security, such as clicks in phishing simulations, so training can be aimed where it is needed. Onboarding training is for new hires, an acceptable use policy sets rules for company systems, and data classification labels information by sensitivity.
Taking SY0-701 before it retires?
Our course and mock exams cover SY0-701, the exam you can book today. A free account opens all of Domain 1, and Lifetime includes the Security+ V8 update at no extra cost.
FAQ
Are these SY0-801 practice questions free?
Yes. All 30 questions on this page are free, with the correct answer and an explanation for each. You don't need an account or a card.Are the questions based on the real SY0-801 objectives?
They are written against CompTIA's published SY0-801 exam objectives, document version 2.0, and each one names the objective it tests. They are original questions, not copied from the exam, which CompTIA keeps confidential.What is new on SY0-801 compared with SY0-701?
The five domains stay, but most objectives were rewritten and two are new: one on threat and vulnerability characteristics, and one on the security risks of AI, such as prompt injection and data poisoning. 24 of the 30 questions here test a topic that was not on the SY0-701 objectives.When can I take SY0-801?
CompTIA expects Security+ V8 to launch in English on or around November 17, 2026. SY0-701 stays available until it retires on June 11, 2027, so you can book either one in between.Does SecPlus Mastery teach SY0-801 yet?
Not yet. The full course teaches SY0-701 today, mock exams included, and Domain 1 is free. The Lifetime plan includes the Security+ V8 update at no extra cost when it ships.
More on the exam change
Original practice questions aligned to the CompTIA Security+ SY0-801 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.