SY0-801 Cheat Sheet: Key Facts to Review

The short answer

This sheet is a last-pass review for SY0-801, not a replacement for study. It lists the exam facts, then the ideas, term pairs and decision rules for each of the five domains. It does not cover everything on the exam, so check it against CompTIA’s published objectives before you rely on it.

Exam facts at a glance

Item	Detail
Exam code	SY0-801 (V8), expected on or around November 17, 2026
Questions	Maximum of 90, multiple-choice and performance-based
Time	90 minutes
Passing score	750 on a scale of 100 to 900
Language	English
Domain weights	16% / 24% / 19% / 27% / 14%

Full details: exam format.

Domain 1: General Security Concepts (16%)

Key concepts

Control categories: technical, managerial, operational, physical. Control types: preventive, deterrent, detective, corrective, compensating, directive.
CIA: confidentiality, integrity, availability. AAA: authentication, authorization, accounting.
Zero Trust: never trust by location, verify each request, give least privilege.
Change management: approval, impact analysis, test, backout plan, documentation.
Crypto: symmetric (one shared key, fast), asymmetric (key pair, key exchange and signatures), hashing (integrity), salting (stops precomputed tables).

Term pairs

Hash is for integrity. Digital signature is for integrity plus proof of who signed.
Encryption is reversible with a key. Hashing is not meant to be reversed.
Category says who runs the control. Type says what it does.
CRL is a downloaded list of revoked certificates. OCSP asks about one certificate on demand.

Decision rules

If the question asks to prove who sent it, think signature.
If the question says rollback is not possible, think fix forward.
If you cannot fully fix a problem, think compensating control.

Domain 2: Threats, Vulnerabilities, and Attacks (24%)

Key concepts

Threat actors differ by motive and resources: nation-state, organized crime, hacktivist, insider, unskilled attacker.
Vectors: email, messaging, removable media, supply chain, unpatched systems.
Indicators: impossible travel, account lockouts, unexpected outbound traffic, odd file changes.
Vulnerability scoring: CVE names a flaw, CVSS scores its severity.
AI risks (objective 2.6): prompt injection, jailbreaking, poisoning, hallucination.

Term pairs

Brute force: many guesses at one account. Password spraying: few passwords across many accounts.
Phishing is broad. Spear phishing targets a person. Whaling targets executives. Smishing is by text. Vishing is by voice.
Poisoning changes training data. Prompt injection manipulates a running model.
Vulnerability is a weakness. Threat is what could exploit it. Risk is the likelihood and impact together.

Decision rules

Name the actor from the motive in the story, not the tool.
If an update cannot be applied, think compensating control or segmentation.

Trap: matching on a single keyword. Read for the target and channel.

Domain 3: Security Architecture (19%)

Key concepts

Models: on-premises, cloud, hybrid, serverless, microservices, infrastructure as code, operational technology, air-gapped.
Placement: zones, screened subnets, segmentation, VPN, out-of-band management.
Data states: at rest, in transit, in use. Classification drives protection.
Resilience: hot, warm and cold sites; clustering; load balancing; immutable backups.

Term pairs

Tokenization replaces data with a token that a vault can map back. Masking hides part of the value. De-identification removes the link to a person.
RTO is how fast you must be back. RPO is how much data loss you accept.
Hot site is ready now. Warm site needs some setup. Cold site is space only.
MTBF is time between failures. MTTR is time to repair.

Decision rules

If the scenario stresses cost, do not choose the strongest option. Pick the cheapest that meets the requirement.
If low RPO is needed, think frequent replication, not weekly backups.

Domain 4: Security Operations (27%)

Key concepts

Hardening, patching, segmentation, sandboxing, endpoint protection, network access control.
Email authentication: SPF (which servers may send), DKIM (signed message), DMARC (policy and reporting).
Monitoring: SIEM correlates logs, SNMP polls devices, syslog carries messages, NetFlow shows traffic flows.
Access models: role-based, rule-based, mandatory, discretionary, time-based.
Incident response: preparation, detection, analysis, containment, eradication, recovery, lessons learned.
Evidence: collect the most volatile data first (memory before disk).

Term pairs

IDS alerts. IPS blocks.
Honeypot is a single bait system. Honeynet is a bait network. Honeytoken is bait data.
Vulnerability scan finds weaknesses. Penetration test tries to exploit them.

Decision rules

Contain before you eradicate. Capture evidence before you reimage.
If the question asks for the first step, look for the one that limits spread.

Trap: choosing a fix when the question asks for the next response phase.

Domain 5: Security Program Management and Oversight (14%)

Key concepts

Documents: policy (what and why), standard (required specifics), procedure (steps), guideline (advice).
Risk responses: accept, avoid, mitigate, transfer.
Calculations: SLE = asset value x exposure factor. ALE = SLE x ARO.
Third-party risk: due diligence, agreements, monitoring.
Testing types: known, partially known and unknown environment.

Term pairs

SLA sets measurable service. NDA protects information. MSA sets overall terms. SOW defines specific work.
Insurance transfers risk. It does not remove it.
Passive reconnaissance does not touch the target. Active does.

Decision rules

If the question names a calculation, write the formula first.

Last-day checklist

Re-read this sheet once, then stop adding new material.
Review the confusing pairs you still mix up.
Redo ten questions you missed earlier.
Check your ID and booking time. See the exam day guide.
Plan about one minute per question and flag long items.
Sleep.

More guides for SY0-801

Next step

For depth, use the domains explained page and the study plan. Try your recall on the sample questions, then test yourself under time pressure with the SY0-801 practice tests.

Try these practice exams