SY0-801 cheat sheet
Last-minute reference for SY0-801. Security Operations and Threats are the largest domains; program management is the smallest.
Exam facts
| Questions | Maximum 90, multiple choice and performance-based |
| Duration | 90 minutes |
| Passing score | 750 on a scale of 100-900 |
| Launch | Expected on or around November 17, 2026 |
| Price | Not published at time of writing |
| Recommended experience | Security administrator, two years hands-on |
Domains
| Domain | Weight |
|---|---|
| Security Operations | 27% |
| Threats, Vulnerabilities, and Attacks | 24% |
| Security Architecture | 19% |
| General Security Concepts | 16% |
| Security Program Management and Oversight | 14% |
Control types
| Type | Think |
|---|---|
| Preventive | Stops it |
| Deterring | Discourages it |
| Detective | Notices it |
| Corrective | Fixes it |
| Compensating | Stand-in for a missing control |
| Directive | Instructs people |
Clue to answer
| Clue | Answer |
|---|---|
| Near-real-time certificate status | OCSP |
| One password, many accounts | Password spraying |
| QR code leads to fake login | Quishing |
| Hidden instructions in content a model reads | Prompt injection |
| Two locations, impossible timing | Impossible travel |
| Time-limited admin rights | Just-in-time access |
| Maximum acceptable data loss | RPO |
| Maximum acceptable downtime | RTO |
| Real value in vault, reference elsewhere | Tokenization |
| Who handled the evidence | Chain of custody |
| Insurance | Transfer risk |
| Right to inspect vendor | Right to audit |
| Specific project work | SOW |
Formulas
- SLE = asset value x exposure factor
- ALE = SLE x ARO
Email authentication
SPF: allowed senders. DKIM: signature. DMARC: policy and reporting. BIMI: brand logo.
Sites
Hot: minutes. Warm: hours. Cold: longest.
Traps
- Category versus type of control.
- CVSS is a score; CVE is an identifier.
- NetFlow has no payload; packet capture does.
- Contain before you eradicate.
- RTO is time; RPO is data.
- Vouchers and study material must match the version you book.
Night-before checklist
Review the acronym list, redo missed practice questions, read the exam day guide and confirm your booking details. Fuller notes are in the exam format page.