Free SY0-801 practice test: 20 questions
Twenty questions across the five SY0-801 domains, weighted roughly as the objectives are: three on general concepts, five on threats, four on architecture, five on operations and three on program management. These are original scenario questions. Find the keyword in each scenario before you read the options, and aim for 16 or more correct.
General Security Concepts
Question 1. A software vendor publishes a hash of each download beside the file so users can confirm it was not altered. Which security property does this protect?
- A. Confidentiality
- B. Integrity
- C. Availability
- D. Non-repudiation
Show answer
Answer: B
A published hash lets users verify that the file has not been changed, which is integrity. Confidentiality concerns secrecy, availability concerns access, and non-repudiation concerns proof of origin.
Want more questions like this? Full SY0-801 practice tests →
Question 2. An employee denies approving a payment, but the approval was signed with their private key. Which property does the digital signature provide?
- A. Availability
- B. Accounting
- C. Least privilege
- D. Non-repudiation
Show answer
Answer: D
A valid digital signature ties an action to the key holder, which is non-repudiation. Availability is about access to systems, accounting is the logging of actions, and least privilege limits permissions.
Want more questions like this? Full SY0-801 practice tests →
Question 3. Which description matches how a typical TLS session protects traffic?
- A. Symmetric keys exchange the secret and asymmetric keys encrypt the traffic
- B. Asymmetric encryption is used for all traffic
- C. Asymmetric cryptography establishes a session key and symmetric encryption protects the data
- D. Hashing exchanges the key and symmetric encryption protects the data
Show answer
Answer: C
TLS uses asymmetric cryptography to establish a shared session key and then symmetric encryption for bulk data because it is much faster. The other options reverse the roles or rely on hashing, which cannot encrypt data for later decryption.
Want more questions like this? Full SY0-801 practice tests →
Threats, Vulnerabilities, and Attacks
Question 4. A caller claiming to be a manager phones the help desk and asks for an urgent password reset. Which attack is this?
- A. Smishing
- B. Whaling
- C. Vishing
- D. Pharming
Show answer
Answer: C
A voice call used to trick someone is vishing. Smishing uses text messages, whaling targets senior executives, and pharming redirects users to fake sites through DNS or hosts manipulation.
Want more questions like this? Full SY0-801 practice tests →
Question 5. A program checks a file's permissions and then opens it, but an attacker swaps the file between the two steps. Which weakness is exploited?
- A. Race condition
- B. Buffer overflow
- C. Replay
- D. Privilege escalation
Show answer
Answer: A
A gap between time-of-check and time-of-use is a race condition. A buffer overflow writes beyond memory bounds, replay reuses captured messages, and privilege escalation is a result rather than this specific flaw.
Want more questions like this? Full SY0-801 practice tests →
Question 6. Web logs show hundreds of requests containing sequences such as ../../etc/passwd. Which attack is being attempted?
- A. Injection
- B. Buffer overflow
- C. Forgery
- D. Directory traversal
Show answer
Answer: D
Repeated parent-folder sequences aim to read files outside the web root, which is directory traversal. Injection inserts commands or queries, a buffer overflow sends oversized input, and forgery abuses trust in a request or token.
Want more questions like this? Full SY0-801 practice tests →
Question 7. Malware sits idle on a server until a specific date, then deletes files. Which type of malware is it?
- A. Worm
- B. Logic bomb
- C. Keylogger
- D. Rootkit
Show answer
Answer: B
Code that triggers on a condition such as a date is a logic bomb. A worm spreads by itself, a keylogger records keystrokes, and a rootkit hides its presence.
Want more questions like this? Full SY0-801 practice tests →
Question 8. Which standard gives vulnerabilities a numeric severity score used to help prioritise remediation?
- A. CVSS
- B. CVE
- C. IoC
- D. CSR
Show answer
Answer: A
CVSS scores severity. CVE is an identifier for a known flaw, an IoC is evidence of compromise, and a CSR is a certificate request.
Want more questions like this? Full SY0-801 practice tests →
Security Architecture
Question 9. A web server must be reachable from the internet, but a compromise must not expose the internal network. Where should it be placed?
- A. In the same VLAN as the database servers
- B. On the internal management network
- C. On an air-gapped network
- D. In a separate security zone behind firewall rules
Show answer
Answer: D
A separate security zone such as a screened subnet, with firewalls controlling traffic in both directions, limits the blast radius. Placing it in the database VLAN or the management network exposes sensitive systems, and an air-gapped network would make it unreachable.
Want more questions like this? Full SY0-801 practice tests →
Question 10. An application must be restored within two hours of an outage. Which metric expresses this?
- A. RPO
- B. RTO
- C. MTBF
- D. MTTR
Show answer
Answer: B
The recovery time objective is the maximum acceptable time to restore service. RPO measures acceptable data loss, MTBF the time between failures, and MTTR the average time to repair.
Want more questions like this? Full SY0-801 practice tests →
Question 11. Which measure best protects backups from being encrypted or deleted by ransomware?
- A. Longer retention alone
- B. Storing backups on the file server they protect
- C. Immutable backups with an offline copy
- D. Compressing the backup files
Show answer
Answer: C
Immutable backups cannot be changed or deleted during the retention period, and an offline copy adds protection. Longer retention alone does not stop deletion, and storing backups on the same file server or compressing them leaves them exposed.
Want more questions like this? Full SY0-801 practice tests →
Question 12. A company runs a virtual machine on an IaaS platform. Who is responsible for patching the guest operating system?
- A. The customer
- B. The provider
- C. Both equally, with no distinction
- D. No one, because patches are automatic
Show answer
Answer: A
In IaaS the customer manages the guest OS, applications and data. The provider handles the physical infrastructure and virtualisation layer, and nothing is patched automatically unless the customer configures it.
Want more questions like this? Full SY0-801 practice tests →
Security Operations
Question 13. A contractor needs administrative rights for two hours to fix an issue, after which the access should end automatically. Which access model fits?
- A. Role-based access
- B. Just-in-time access
- C. Mandatory access control
- D. Discretionary access control
Show answer
Answer: B
Just-in-time access grants privileges for a limited time and removes them automatically. Role-based, mandatory and discretionary models define how permissions are assigned but do not by themselves time-limit them.
Want more questions like this? Full SY0-801 practice tests →
Question 14. Employees should sign in once with their corporate identity to reach many cloud applications. Which solution fits?
- A. A local account in each application
- B. Reusing the same password everywhere
- C. Hard tokens with no identity provider
- D. Federated SSO using SAML
Show answer
Answer: D
Federation with single sign-on using a standard such as SAML lets one identity provider authenticate users to many applications. Separate local accounts, password reuse and hard tokens alone do not provide a single sign-in.
Want more questions like this? Full SY0-801 practice tests →
Question 15. Which tool detects suspicious behaviour on laptops, records telemetry and lets analysts isolate a host remotely?
- A. Signature-only antivirus
- B. A web application firewall
- C. Endpoint detection and response
- D. A unified threat management appliance
Show answer
Answer: C
EDR monitors endpoint behaviour and supports response actions such as isolation. Signature antivirus alone has no such response workflow, a WAF protects web applications, and a UTM appliance protects the network edge.
Want more questions like this? Full SY0-801 practice tests →
Question 16. A scan returns 500 findings. What is the best way to prioritise remediation?
- A. Rank by severity combined with asset criticality and exposure
- B. Fix in alphabetical order by hostname
- C. Ignore everything that is not rated critical
- D. Disable the scanner until staff are available
Show answer
Answer: A
Combine severity with asset criticality and exposure, then fix the highest risk first. Alphabetical order ignores risk, ignoring everything but critical scores misses exposed assets, and switching off the scanner removes visibility.
Want more questions like this? Full SY0-801 practice tests →
Question 17. An analyst wants metadata about which hosts communicated and how much data moved, without storing payloads. Which source fits?
- A. A memory dump
- B. A system image
- C. A full packet capture
- D. NetFlow or IPFIX records
Show answer
Answer: D
NetFlow or IPFIX records conversation metadata. A memory dump and a system image capture host state, and a full packet capture stores the payload.
Want more questions like this? Full SY0-801 practice tests →
Security Program Management and Oversight
Question 18. Which process identifies critical business functions and the impact of losing them?
- A. Risk register
- B. Business impact analysis
- C. Penetration test
- D. Gap analysis
Show answer
Answer: B
A business impact analysis measures the effect of disruption on functions. A risk register lists risks, a penetration test probes defences, and a gap analysis compares current and desired state.
Want more questions like this? Full SY0-801 practice tests →
Question 19. An asset is worth 200,000 dollars. An incident would damage 25% of it and is expected twice a year. What is the ALE?
- A. 50,000 dollars
- B. 200,000 dollars
- C. 100,000 dollars
- D. 400,000 dollars
Show answer
Answer: C
SLE is 200,000 x 25% = 50,000 and ALE is SLE x ARO = 50,000 x 2 = 100,000. 50,000 is only the SLE, 200,000 is the asset value, and 400,000 uses the asset value instead of the exposure.
Want more questions like this? Full SY0-801 practice tests →
Question 20. Which contract clause lets a customer inspect a vendor's security controls?
- A. Right to audit
- B. Non-disclosure agreement
- C. Memorandum of understanding
- D. Request for quote
Show answer
Answer: A
A right to audit clause gives that access. An NDA covers confidentiality, an MOU states shared intent, and an RFQ is a request for a price quote.
Want more questions like this? Full SY0-801 practice tests →
How to score yourself
Count your correct answers per domain. Below 80% in a domain, reread its page: general concepts, threats, architecture, operations or program management. Then return to the study plan.