Free SY0-801 sample questions with answers
Here are five free SY0-801 sample questions, one from each domain, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official exam objectives, not questions from the real exam.
Question 1. A company puts signs on the server room door stating that all entries are recorded and that unauthorized access will be prosecuted. Which control type best describes the signs?
- A. Preventive
- B. Deterring
- C. Detective
- D. Corrective
Show answer
Answer: B
Signs meant to discourage someone from attempting an action are deterring controls. They do not physically stop anyone, so they are not preventive. They do not identify an event after it happened, so they are not detective, and they do not repair damage, so they are not corrective.
Want more questions like this? Full SY0-801 practice tests →
Question 2. Employees find printed flyers in the lobby with a QR code that opens a fake sign-in page for the company portal. Which attack is this?
- A. Smishing
- B. Vishing
- C. Quishing
- D. Whaling
Show answer
Answer: C
Phishing delivered through a QR code is quishing. Smishing uses text messages, vishing uses voice calls, and whaling is phishing aimed at senior executives, none of which is the delivery method here.
Want more questions like this? Full SY0-801 practice tests →
Question 3. The business says it can accept losing at most four hours of transactions after a failure. Which recovery metric does this statement define?
- A. MTBF
- B. MTTR
- C. RTO
- D. RPO
Show answer
Answer: D
The recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time, which dictates how often data must be backed up or replicated. RTO is how long recovery may take, MTTR is average repair time, and MTBF is average time between failures.
Want more questions like this? Full SY0-801 practice tests →
Question 4. A SIEM alert shows a user signing in from London and, ten minutes later, from Singapore. Which indicator of compromise does this describe?
- A. Impossible travel
- B. Account lockout
- C. Excessive resource consumption
- D. Log manipulation
Show answer
Answer: A
Sign-ins from locations too far apart for the elapsed time are called impossible travel and suggest stolen credentials. Account lockout is repeated failures, excessive resource consumption is about system load, and log manipulation is evidence being altered.
Want more questions like this? Full SY0-801 practice tests →
Question 5. A single incident would cost 20,000 dollars and is expected to occur once every two years. What is the annualized loss expectancy (ALE)?
- A. 40,000 dollars
- B. 10,000 dollars
- C. 20,000 dollars
- D. 1,000 dollars
Show answer
Answer: B
ALE equals SLE multiplied by ARO. An event every two years has an ARO of 0.5, so 20,000 x 0.5 = 10,000 dollars. 40,000 multiplies by two instead of one half, 20,000 is the SLE alone, and 1,000 is not derived from either figure.
Want more questions like this? Full SY0-801 practice tests →
Keep going
For more, take the 20-question practice test or work through the domain pages, starting with general security concepts. If a topic felt shaky, the study plan shows where it fits.