Try these 20 free CompTIA Security+ SY0-801 practice questions with answers and detailed explanations. This original V8 practice test covers selected topics across all five Security+ exam domains. Select one answer per question, check your score and use the domain feedback to choose what to study next. No account is required.
20 free questions · Answers and explanations · Suggested practice time: 25–30 minutes
Exam basis: SY0-801 V8, CompTIA objectives, document version 2.0. The questions, objective mappings, suggested timing and review plan are Trifectapp teaching material. A practice score is not an official passing-score estimate.
Choose your answers before opening the explanations. You can review them at any time, but checking first makes the sample more useful. Review correct guesses as well as mistakes. These are independent practice questions, not actual CompTIA exam items.
Take the free SY0-801 practice test
Select your answers and compare them with the answer key below. Automatic scoring requires JavaScript; all questions and explanations remain readable without it.
Your score and domain breakdown appear after you check your answers. Unanswered questions earn no points. Choices stay on this page and are not saved when you leave or reload.
0 of 20 answered
Domain 1: General Security Concepts
1. An invoice changes without approval
An employee can still open a supplier invoice, and access logs show no unauthorized viewing. However, someone changed the payment account after approval without permission. Which security property has most directly been compromised?
Answer and explanation for Question 1
Correct answer: A. Integrity
Integrity concerns the accuracy and authorized modification of information. The invoice’s payment details were changed without approval, so the record can no longer be trusted as an accurate representation of the approved transaction.
Why the other options do not fit
- B. Confidentiality concerns unauthorized disclosure; the scenario identifies an unauthorized change, not evidence of someone viewing protected information.
- C. Availability concerns timely access to information or services, and the invoice is still accessible.
- D. Non-repudiation supports evidence that an action occurred and who performed it; the direct failure described is alteration of the record.
Remember: Identify whether the scenario primarily involves disclosure, unauthorized modification, or loss of access.
Technical reference: NIST CSRC glossary: integrity — definition of unauthorized modification.
2. Prepare for a failed firewall change
A firewall rule change passes laboratory testing. Before approving production deployment, the service owner asks how the team will restore the previous configuration if legitimate orders stop working. Which addition best answers that concern?
Answer and explanation for Question 2
Correct answer: C. A tested backout plan with rollback triggers, ownership, and recovery checks
A backout plan defines how to return to a known working state when a change causes unacceptable problems. Clear triggers and an assigned owner make the decision actionable during the maintenance window. Recovery checks confirm that the previous service behavior has actually been restored.
Why the other options do not fit
- A. Notifications coordinate people, but do not describe how to reverse the faulty configuration.
- B. The diagram documents the intended design rather than the steps for restoring the previous working state.
- D. A later review can improve future changes, but does not provide an immediate recovery method.
Remember: Change approval should consider both the intended result and a practical route back.
Technical reference: NIST SP 800-53 Rev. 5, CM-3 — configuration change control; the rollback trigger is an exercise assumption.
3. Verify a downloaded firmware package
A manufacturer distributes firmware publicly. Customers need to verify the publisher and detect changes to the package after release; they do not need to keep the firmware secret. Which approach best meets those requirements?
Answer and explanation for Question 3
Correct answer: B. Sign the package with the manufacturer’s private key and verify it with a trusted public key
A digital signature links the package to the corresponding signing key and allows recipients to detect subsequent modification. Customers must trust the association between the verification key and the manufacturer. A valid signature does not, by itself, establish that the software is free from malicious code.
Why the other options do not fit
- A. Encryption for the recipient provides confidentiality but does not establish which publisher created the package.
- C. An attacker who replaces both the package and its unprotected checksum could defeat this check.
- D. Compression and an extraction password do not provide reliable publisher authentication.
Remember: Use signatures for publisher verification and integrity; evaluate software safety separately.
Technical reference: NIST FIPS 186-5 (2023) — digital signatures and detection of modification.
Domain 2: Threats, Vulnerabilities, and Attacks
4. Prioritize risk beyond a severity score
Two fixes need the same maintenance effort. One addresses a CVSS 9.8 flaw in a disconnected test system with disposable data. The other addresses a CVSS 8.1 flaw in an internet-facing billing service; reliable threat intelligence reports active exploitation of that flaw. Which should normally receive priority?
Answer and explanation for Question 4
Correct answer: D. Prioritize the billing service using active exploitation, internet exposure, and business impact
Prioritization combines technical severity with the environment and current threat activity. The exposed billing service presents a more immediate business risk under the stated conditions.
Why the other options do not fit
- A. Severity helps rank findings, but the score alone does not account for the billing service’s active exploitation, external exposure, and business role.
- B. Time open can inform backlog management, but it does not establish the more urgent threat under the stated conditions.
- C. Implementation effort helps plan work, but equal effort does not imply equal likelihood or impact of compromise.
Remember: Prioritize vulnerabilities using severity, exposure, threat activity, and the value of affected services.
Technical reference: FIRST CVSS v4.0 User Guide — base severity versus contextual risk; no vector calculation is required here.
5. Recognize a pattern across many accounts
During an authorized exercise on an isolated training portal, an analyst observes one common password being tried against 80 different usernames. Each account receives only one attempt per round. Which credential attack is being simulated?
Answer and explanation for Question 5
Correct answer: B. Password spraying
Password spraying applies one or a small set of candidate passwords across many accounts. The defining clue is the reuse of the same guess across different usernames.
Why the other options do not fit
- A. Credential stuffing tests previously obtained username-and-password pairs; the scenario specifies one common guess rather than stolen pairs.
- C. Focused guessing would repeatedly test different passwords against the same account, rather than spreading one guess across accounts.
- D. Token replay reuses an authentication artifact; these requests are password-based login attempts.
Remember: Compare the number of targeted accounts with the number of guesses per account.
Technical reference: MITRE ATT&CK T1110.003 — password spraying.
6. A benefits notice hides its destination
An employee scans a QR code on a notice claiming to announce a benefits update. The code opens a convincing company sign-in page on an unrelated domain and requests work credentials. Which threat vector is central to this attempt?
Answer and explanation for Question 6
Correct answer: A. QR-code phishing, often called quishing
The QR code carries a link to an impersonated sign-in page, making it the delivery vector for phishing. The request for work credentials and unrelated destination are the key warning signs. The employee should verify the notice through an established company channel rather than submit credentials.
Why the other options do not fit
- B. Voice phishing relies on spoken interaction; no call or voice message appears in the scenario.
- C. Tailgating involves following an authorized person through a physical access boundary.
- D. A rogue access point impersonates a wireless network; the scenario describes a deceptive web destination.
Remember: A QR code is a delivery mechanism, not evidence that its destination is trustworthy.
7. A trusted update delivers malicious code
An investigation finds that attackers compromised a software vendor’s build pipeline. The vendor then distributed an update containing a backdoor through its normal channel, with a valid vendor signature. Which explanation best describes the customer’s exposure?
Answer and explanation for Question 7
Correct answer: D. A software supply-chain compromise delivered a malicious update
The compromised build process inserted malicious behavior before the vendor signed and distributed the update. Customers were exposed through a trusted software dependency and delivery channel. The signature can remain valid because it authenticates the released package, not the safety of the build process.
Why the other options do not fit
- A. A firewall configuration can affect exposure, but the evidence identifies malicious code introduced upstream.
- B. Changing the signed content after signing would normally invalidate its signature; this scenario places the compromise before signing.
- C. No external drive or other removable medium is involved.
Remember: A valid software signature does not rule out compromise of the supplier’s build process.
Technical reference: NIST SP 800-218, SSDF version 1.1 — separate practices for protecting software and verifying release integrity.
8. Instructions appear inside a document
A procurement assistant uses an LLM to summarize supplier documents. A supplier’s PDF contains instructions telling the assistant to ignore the evaluation rubric and award the highest rating. The assistant follows them. The model’s training data was not changed. What is the best classification?
Answer and explanation for Question 8
Correct answer: C. Indirect prompt injection through external content
The attacker placed instructions in a document the assistant was meant to analyze as data. The external content redirected the model’s behavior, making this indirect prompt injection. The authorized user’s legitimate request did not grant the supplier authority to replace the evaluation rules.
Why the other options do not fit
- A. Training-data poisoning changes data used to develop the model; that did not happen here.
- B. The altered rating follows the document’s instructions rather than an unsupported answer invented independently.
- D. Direct injection comes through the prompt input itself; here the instruction arrived inside retrieved material.
Remember: Treat instructions embedded in external documents as untrusted content, not operational authority.
- 01 · SourceSupplier documentThe PDF contains instructions that favour the supplier.
- 02 · Entry pointDocument processingThe assistant reads the PDF while carrying out the user’s legitimate task.
- 03 · EffectChanged evaluationThe assistant follows the document’s instructions instead of the evaluation rubric.
The instruction arrives through external content. The model’s training data is unchanged in this scenario.
Source: OWASP LLM01:2025: Prompt Injection.
Domain 3: Security Architecture
9. Assign responsibility for a cloud VM
A company rents unmanaged virtual machines from an infrastructure-as-a-service provider. Its contract assigns physical facilities and the virtualization platform to the provider, while the customer manages guest systems and applications. Which task belongs to the customer?
Answer and explanation for Question 9
Correct answer: C. Install security updates in the guest operating system
Under the stated IaaS arrangement, the customer administers the guest operating system and applications, including their security updates. The contract and chosen service model determine the actual division of responsibilities.
Why the other options do not fit
- A. Physical server hardware is part of the infrastructure assigned to the provider.
- B. The contract places the virtualization platform, including its hypervisor, with the provider.
- D. Data-center cooling is a physical facility responsibility rather than a guest-system administration task.
Remember: Map cloud security tasks to the service model and agreement, not the word cloud alone.
Technical reference: AWS shared responsibility model — an IaaS example; the question’s stated contract determines its answer.
10. Remove automatic trust in the office network
An internal application currently allows anyone connected to the office LAN to read its records. The security team wants a Zero Trust design that restricts access to authorized users on suitable devices. Which change best supports that goal?
Answer and explanation for Question 10
Correct answer: D. Evaluate resource access requests using identity, device posture, and authorization policy
Zero Trust avoids granting access solely because a request originates inside a network boundary. Resource access decisions should consider the requesting identity, relevant device state, and permitted actions. This does not mean asking the user to type credentials again for every network packet.
Why the other options do not fit
- A. Device ownership alone does not establish the user’s permission to access a particular resource.
- B. Strong initial authentication does not justify unrestricted access to unrelated applications.
- C. Password strength does not repair an authorization rule that trusts network location.
Remember: Authenticate and authorize access to resources instead of treating network location as permission.
11. Reference payment data without storing it
A retailer wants its application to reference a customer’s saved card without storing the card number. A payment processor can retain the number in a restricted vault and accept a substitute identifier from the retailer. Which protection method matches this design?
Answer and explanation for Question 11
Correct answer: A. Tokenization using a processor-issued substitute value
Tokenization replaces sensitive data with a surrogate identifier that can be used in the intended workflow. In this design, the processor controls the mapping to the original card number.
Why the other options do not fit
- B. Display masking does not remove the original sensitive value from the retailer’s storage.
- C. A hash is not a reversible mapping that retrieves the original number for authorized use.
- D. Encryption retains recoverable card data in the application, unlike the requested vault-and-token design.
Remember: Tokenization separates the operational reference from the sensitive value it represents.
Technical reference: PCI SSC Tokenization Guidelines (August 2011), section 1.3 — background definition of a surrogate token only; not current PCI DSS compliance advice.
12. Separate recovery time from data loss
A business requires its order service to be restored within two hours of an outage. It can tolerate losing no more than 15 minutes of recorded transactions. Which pair correctly expresses these requirements?
Answer and explanation for Question 12
Correct answer: B. RTO 2 hours; RPO 15 minutes
The recovery time objective concerns the target time to restore service, so it is two hours. The recovery point objective concerns the acceptable data-loss window, so it is 15 minutes.
Why the other options do not fit
- A. This reverses the service-restoration target and the acceptable data-loss window.
- C. MTBF and MTTR describe reliability and repair measurements; they do not express the two stated business recovery objectives.
- D. A two-hour recovery point permits a larger data-loss window than the business accepts.
Remember: RTO asks how long recovery may take; RPO asks how much recent data may be lost.
- 09:45Data recovery pointThe recovered records must be at least this recent.
- 10:00Outage beginsThe business can lose at most the previous 15 minutes of recorded transactions.
- 12:00Restoration deadlineThe order service must be available again within two hours.
RPO = 15 minutesHow much recent data loss is acceptable?
RTO = 2 hoursHow long may service restoration take?
Times illustrate the requirements in Question 12. The timeline is not drawn to scale.
Sources: NIST definitions of recovery point objective and recovery time objective.
Domain 4: Security Operations
13. A repository exposes an active secret
A developer accidentally commits an active production API credential to a public repository. The latest commit removes it, but the credential remains in the repository’s history and may have been copied. What is the most urgent next action?
Answer and explanation for Question 13
Correct answer: D. Revoke the exposed credential and deploy a securely stored replacement
The exposed credential must be treated as compromised because deletion cannot recover copies already obtained. Revoking it removes the old credential’s usefulness, while a controlled replacement restores legitimate access. The team should also investigate use, preserve relevant logs, and prevent further exposure.
Why the other options do not fit
- A. History cleanup reduces further exposure but does not invalidate copies of the existing credential.
- B. Changing repository visibility does not disable a credential that someone may already possess.
- C. Investigation matters, but delaying revocation leaves the known exposed credential usable.
Remember: Removing a leaked secret from view is not the same as invalidating it.
Technical reference: GitHub: removing sensitive data — revoking or rotating exposed secrets before repository-history cleanup.
14. Confirm that a patch solved the finding
An administrator reports that a vulnerable web-server package has been updated. The remediation ticket is ready for closure, but the security team has no evidence that the running service uses the fixed version. Which action best completes verification?
Answer and explanation for Question 14
Correct answer: B. Run credentialed vulnerability checks and verify the version used by the active service
Verification checks the actual post-change state rather than relying only on completion of an installation task. An appropriate rescan and running-service checks can reveal an unapplied restart, incorrect package, or remaining vulnerable configuration. Record the evidence before closing the finding.
Why the other options do not fit
- A. Installation logs show that an update task ran, but do not prove the active service is using the fixed version.
- C. A matching file on disk does not establish that the running process has loaded it; the service may still need a restart.
- D. Change approval and maintenance records establish process completion, not that the vulnerability has been removed from the running service.
Remember: A remediation ticket should close on verified results, not just reported activity.
Technical reference: NIST SP 800-40 Rev. 4 (2022) — verifying patch installation.
15. Resist a real-time phishing relay
Attackers lure users to a lookalike sign-in page and immediately relay captured passwords and manually entered one-time codes to the real service. Which replacement authentication method best addresses this phishing technique?
Answer and explanation for Question 15
Correct answer: C. FIDO2/WebAuthn authentication using a security key unlocked with a PIN
Correctly deployed FIDO2/WebAuthn authentication binds the cryptographic response to the legitimate relying party. A lookalike site cannot obtain a valid response for the real service simply by relaying a code the user types. The key’s local PIN activates the authenticator rather than becoming a password sent to the website.
Why the other options do not fit
- A. A shorter lifetime does not prevent an attacker from relaying a manually entered code immediately.
- B. A simple approval notification does not provide the specified WebAuthn origin binding and may be approved deceptively.
- D. Scheduled password changes do not bind authentication to the legitimate site.
Remember: Phishing resistance depends on the authentication protocol, not simply the presence of two factors.
Source: NIST SP 800-63B-4: Authenticator and Verifier Requirements.
16. Constrain an automated response
A proposed security playbook suspends accounts associated with a suspicious source address. During testing, a shared office gateway causes hundreds of legitimate users to match one alert. Which safeguard best limits the impact of another false positive?
Answer and explanation for Question 16
Correct answer: A. Cap automatic suspensions and require approval for changes beyond that scope
An action limit and an approval boundary constrain what the automation can do when its detection logic is wrong. These guardrails address the scale of impact rather than relying on perfect alerts.
Why the other options do not fit
- B. A stricter threshold may reduce false positives but leaves an unrestricted failure mode when one occurs.
- C. Scheduling changes does not prevent mass account disruption or account for users working at other times.
- D. An after-the-fact notification helps visibility but does not limit the initial damage.
Remember: Design automation for safe failure as well as correct detection.
Technical reference: NIST SP 800-61 Rev. 3 (2025), RS.MI — risks and controls for automated containment; the action cap is a teaching safeguard.
17. Contain an active ransomware incident
An analyst confirms ransomware is encrypting files on a workstation and accessing a shared drive. The incident playbook already authorizes EDR network isolation with an approved management channel retained. Which immediate action is best?
Answer and explanation for Question 17
Correct answer: B. Isolate the workstation using the approved control and preserve incident telemetry
Prompt isolation limits the host’s opportunity to spread or continue affecting network shares. Retaining the approved management channel supports response and evidence collection. Isolation does not prove local encryption has stopped; continue the authorized playbook’s containment and investigation steps.
Why the other options do not fit
- A. Waiting for full imaging while the host remains connected allows the observed activity to continue.
- C. Restarting can destroy volatile evidence and does not establish that the incident is contained.
- D. Notify the coordinator, but do not delay containment to seek approval that the playbook has already granted.
Remember: Contain active harm promptly while preserving useful evidence through the approved response process.
Technical reference: NIST SP 800-61 Rev. 3 (2025), RS.MI-01 — incident containment.
Domain 5: Security Program Management and Oversight
18. Translate policy into mandatory requirements
A company policy requires sensitive information to be encrypted. A supporting document specifies the approved cryptographic protocols and minimum key strengths that every applicable system must use. Which governance artifact best describes that supporting document?
Answer and explanation for Question 18
Correct answer: C. A standard defining mandatory technical requirements
A standard makes a policy enforceable through specific mandatory requirements. Here, the policy states the protection goal while the supporting document defines acceptable technical choices. A procedure could separately explain how administrators configure a particular system to meet that standard.
Why the other options do not fit
- A. A procedure provides an ordered method for performing work; this document defines required outcomes and parameters.
- B. Guidelines are advisory, whereas the stated cryptographic requirements are compulsory.
- D. A disaster recovery plan addresses restoration after disruption rather than approved encryption settings.
Remember: Distinguish the policy goal, mandatory standard, implementation procedure, and optional guideline.
19. Calculate expected annual loss
For a simplified risk exercise, an asset is valued at $200,000. A single incident is expected to cause a 25% loss, and the estimated annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?
Answer and explanation for Question 19
Correct answer: A. $10,000
Single loss expectancy is $200,000 × 0.25 = $50,000. Multiply that by the annualized rate of occurrence: $50,000 × 0.2 = $10,000. ALE is an estimate of annual expected loss under the model’s assumptions, not a prediction that exactly this amount will be lost next year.
Why the other options do not fit
- B. $50,000 is the estimated loss from one incident, before accounting for its annualized frequency.
- C. $40,000 multiplies the full asset value by 0.2 and omits the 25% exposure factor.
- D. $250,000 divides single loss expectancy by 0.2; ALE requires multiplication by the annualized frequency.
Remember: Calculate SLE from value and exposure, then multiply SLE by ARO to obtain ALE.
SLE = asset value × exposure factor
$200,000 × 0.25 = $50,000
ALE = single loss expectancy × annualized rate of occurrence
$50,000 × 0.2 = $10,000 per year
This is an expected value under the exercise’s assumptions, not a forecast of next year’s actual loss.
20. Check a supplier before sharing sensitive data
A payroll provider offers an attractive price and displays a security badge in its sales brochure. It will process employee personal data, but procurement has not reviewed evidence about the service’s controls. Which action best supports approval?
Answer and explanation for Question 20
Correct answer: D. Review current assurance evidence for the payroll service, including scope and unresolved findings
Due diligence evaluates whether the provider’s controls and operating practices fit the proposed service and data exposure. Assurance evidence must cover the relevant service and be assessed for scope, currency, and exceptions. Contractual safeguards and ongoing monitoring should follow the risks identified, rather than replacing this review.
Why the other options do not fit
- A. A genuine certification is useful evidence, but its scope and applicability to the payroll service must be checked before relying on it.
- B. Written policies describe intended requirements; they do not by themselves establish how controls operate for the payroll service.
- C. Evidence for a different service does not by itself demonstrate that the payroll service’s controls are covered or effective.
Remember: Evaluate evidence for the actual service and data flow before accepting third-party risk.
Technical reference: NIST SP 800-53 Rev. 5, SR-6 — supplier assessment and review.
Answer key
Open the complete answer key
Download the question review workbook
Turn a wrong answer into a specific next step. Download the 20 original questions, their detailed explanations and an editable question-by-question review journal.
Download the question review workbook (ZIP)
Inside: 20 printable questions; all original detailed explanations and answer key; editable 20-row review journal; one labeled worked journal example.
- Attempt exercises.html and record your choice and reasoning before consulting the explanations.
- Compare worked-solutions.html; identify the clue you missed and why a tempting option does not fit.
- Choose a small follow-up task and return later to explain the concept in your own words.
| Example | Evidence to record | Follow-up reasoning |
|---|---|---|
| Question 1: invoice change | The payment account changed without approval. | Review integrity versus confidentiality, then explain which fact would indicate disclosure. |
The example is a learning note, not a record of a real learner. Use the journal for your own reasoning; it does not calculate exam readiness. Extract the ZIP, open the HTML files in a browser and edit the CSV in a spreadsheet or text editor. Print from your browser if useful. No account or connection is needed to read the extracted workbook.
What to review next
Use your score breakdown to find missed and unanswered questions. If you are reviewing on paper or without JavaScript, give yourself one point per correct answer, for a total out of 20. Keep a separate list of correct guesses. Use those lists to choose your next study task:
| Missed or guessed | Your next study task |
|---|---|
| Questions 1–3 | Explain whether each scenario calls for confidentiality, integrity or availability. Then distinguish a signature from encryption and describe a safe rollback. |
| Questions 4–8 | Underline the clue that determines the attack type or priority: exposure, repeated credentials, delivery channel, supplier compromise or external instructions. |
| Questions 9–12 | Draw the responsibility or trust boundary. For recovery questions, label the acceptable data-loss window separately from the service-restoration target. |
| Questions 13–17 | State the first authorized action and what evidence would verify its result. Compare a stronger login with one that is actually phishing resistant. |
| Questions 18–20 | Separate a policy goal, a mandatory requirement and assurance evidence. Recalculate SLE and ALE with new values, showing each step. |
For each weak point, complete this sentence: “I chose ___ because ___. The decisive clue was ___. Next time I will check ___.” Change one fact in the scenario and ask whether the answer should change. This asks you to explain how a changed fact affects the decision.
Study that concept, choose a Security+ practical lab or work through a PBQ scenario with a worked explanation, and try a fresh question without notes. This short sample cannot predict a certification result or demonstrate every practical skill.
Continue your Security+ practice
The CompTIA Security+ SY0-801 (V8) Complete Course combines domain practice, original multiple-choice questions, performance-based activities, simulated labs and the matching study guide. Use your review notes to choose a domain, then practice applying it in an activity.
Coverage and exam details
The official SY0-801 objectives define five domains. This sample roughly reflects their weights with 3 / 5 / 4 / 5 / 3 questions. It samples selected topics rather than all 27 numbered objectives or the exam’s performance-based tasks.
| V8 domain | Official weight | Practice questions |
|---|---|---|
| 1. General Security Concepts | 16% | 1–3 |
| 2. Threats, Vulnerabilities, and Attacks | 24% | 4–8 |
| 3. Security Architecture | 19% | 9–12 |
| 4. Security Operations | 27% | 13–17 |
| 5. Security Program Management and Oversight | 14% | 18–20 |
How long is the official SY0-801 exam?
The published V8 specification lists a maximum of 90 questions, combining multiple-choice and performance-based formats, with 90 minutes to complete the exam. The suggested 25–30 minutes for this article is a study exercise, not an official timing rule. Source: CompTIA’s exam objectives.
What is the passing score?
CompTIA lists 750 on a scale of 100–900. This is a scaled score, not a published raw percentage of correct answers. Do not convert 750 ÷ 900 into a target percentage for this practice set. Source: CompTIA’s exam objectives.
Are these actual exam questions?
No. These are original Trifectapp questions written for learning and mapped to the published V8 objectives. They are not recalled exam questions or exam dumps, and CompTIA has not authored or endorsed this set.
Sources and editorial notes
Sources were checked on 7 November 2026. CompTIA’s SY0-801 V8 objectives, document version 2.0, provide the exam scope and specification. The objective labels are Trifectapp’s editorial mapping of each original scenario. The linked technical sources support definitions and principles, not an official answer key or additional exam requirements.
- CompTIA Security+ V8 overview and launch information.
- CompTIA SY0-801 V8 exam objectives, Document Version 2.0.
- OWASP LLM01:2025: Prompt Injection — Question 8.
- NIST SP 800-207: Zero Trust Architecture — Question 10.
- NIST: Recovery Point Objective and Recovery Time Objective — Question 12.
- NIST SP 800-63B-4: Authenticator and Verifier Requirements — Question 15.
Technical versions: NIST SP 800-207 (2020), SP 800-63B-4 (2025), SP 800-61 Rev. 3 (2025), SP 800-40 Rev. 4 (2022), FIPS 186-5 (2023), SP 800-218 / SSDF 1.1 and SP 800-53 Rev. 5 (base document updated December 2020); FIRST CVSS 4.0; OWASP LLM01:2025. The dated PCI SSC tokenization source is used only for its background definition. AWS, GitHub, MITRE ATT&CK and the NIST glossary are living references checked on the source-check date above.