CertificationsCompTIA Security+ SY0-801Labs
CompTIA Security+ SY0-801 hands-on labs
Policy and operations together: least privilege, alert triage, indicator blocking and the containment note an analyst writes.
47 labs you run in the browser: 14 guided, 28 assisted, 4 challenge, 1 capstone. About 7 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
47
labs
14
guided
steps in order
5
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- SIEM queue· you click16 labs
- Cloud panel with the matching CLI line· you click14 labs
- Linux bash console with OpenSSL· you type6 labs
- Linux bash console· you type4 labs
- Windows desktop· you click4 labs
- Assessment workspace· you click2 labs
- Risk register and control sheets· you click2 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Attest to the encryption standard for the field laptops
ProGuided · Quick · 5 min · Windows desktop
The annual attestation campaign asks every team lead to confirm their devices meet the encryption standard, version three…
policy versus standardattestationownershipgovernance artifacts
Keep the scanner out of the alert queue
ProGuided · Quick · 5 min · SIEM queue
At 01:04 one address made 1,900 connection attempts across 22 hosts in six minutes and the brute force rule fired. The vulnerability team booked that window for an authenticated sweep…
vulnerability scanningfalse positivealert recordscan window
Name the three digests on the export manifest
ProGuided · Quick · 5 min · Linux bash console with OpenSSL
The data platform publishes a weekly customer extract and writes a manifest beside it with three values. One is the digest of this week's export…
hashingdigest lengthintegrity checkinglegacy algorithm
Close a public export bucket
ProGuided · Quick · 6 min · Cloud panel with the matching CLI line
A quarterly billing export sits in the bucket billing-exports-2026. An external researcher sent a link to it, which means the bucket answers to anyone who knows the name…
object storagepublic accessencryption at restdata exposure
Close the forecast bucket and leave the image store public
ProGuided · Quick · 6 min · Cloud panel with the matching CLI line
Two buckets answer to the internet and only one of them should. The image store feeds the public shop front, so the browser has to be able to fetch those files…
data classificationobject storagepublic accessencryption at rest
Give the switch change a window and a fail forward plan
ProGuided · Quick · 6 min · Windows desktop
The building B core switch needs a firmware reload. The first attempt at the ticket was sent back by the change board because it named no window and left the failure case blank…
change managementmaintenance windowfail forwarddowntime
Name the three values in a release note
ProGuided · Quick · 6 min · Linux bash console with OpenSSL
Release 4.2 shipped with a note that lists three values. One is the checksum for the tarball, kept for the partner that still verifies with it. One is the digest for the component list…
hashingdigest lengthpassword storageintegrity checking
Put a storm risk on the insurer
ProGuided · Quick · 6 min · Risk register and control sheets
The edge site is a leased warehouse near the coast and the lease forbids structural work, so nobody is going to raise the floor or move the racks…
risk treatmentrisk transferinsurancerisk appetite
Stand up the press kit store for Thursday
ProGuided · Quick · 6 min · Cloud panel with the matching CLI line
The launch page on Thursday serves its images straight from object storage. Journalists fetch them by link and cannot be asked to sign in, so this store is public by design…
object storagedata classificationencryption at restpublic data
Stop the assistant link that followed a customer export
ProGuided · Quick · 6 min · SIEM queue
An account manager asked an external assistant to summarise a spreadsheet and pasted the whole export into the chat box instead of attaching it…
AI usage riskdata lossprompt handlingexternal assistant
Contain a harvested account after a mail shot
ProGuided · Quick · 7 min · SIEM queue
Forty mailboxes received an invoice attachment at 08:12, four people opened it, and one of them typed a password into a page that imitates the mail login…
phishingcredential harvestingindicator blockingalert triage
Quarantine the build host that calls out on a timer
ProGuided · Quick · 7 min · SIEM queue
BUILD-07 joined a task to the local administrator group at 14:02 and started sending a short request to a name the estate has never seen, every five minutes…
containmentquarantinebeaconingscheduled task
Stand up a store for settlement exports
ProGuided · Quick · 7 min · Cloud panel with the matching CLI line
The card partner wants quarterly settlement exports in their own store. Nothing exists yet. The data handling policy is short: card holder data stays private, sits encrypted at rest…
object storageencryption at restversioningdata protection
Check a clinic device fleet before the proxy swap
ProGuided · In-depth · 30 min · Linux bash console with OpenSSL
The clinic replaces its reverse proxy on Saturday, and every device that presents or accepts a certificate goes through the new path…
certificate statusself-signed certificateincomplete chaincertificate expiry
Clear the last user's secrets out of a returned laptop image
ProAssisted · Quick · 5 min · Linux bash console
A field laptop came back on 12 September and the disk was copied to the returns share so the reimage team could pull the build notes…
asset reassignmentdata handlingkey materialsession token
Coach the team that clicked the test lure
ProAssisted · Quick · 5 min · Windows desktop
This quarter's test lure went to the finance team and three people clicked, two of them on the same day and one twice…
security awarenesscorrective trainingreport ratephishing campaign
Pair two gaps with a written rule and a technical one
ProAssisted · Quick · 5 min · Risk register and control sheets
An internal review found two gaps in the same team. Restores are run from memory because nobody wrote the steps down, so the outcome depends on who answers the call. Separately…
control categoriesmanagerial controltechnical controlprocedures
Explain the print console warning to the service desk
ProAssisted · Quick · 6 min · Linux bash console with OpenSSL
The print server was rebuilt at the weekend and its administration console now shows a certificate warning in every browser…
certificate statusself-signed certificateroot of trustcertificate chain
Find why the partner endpoint rejects our EDI certificate
ProAssisted · Quick · 6 min · Linux bash console with OpenSSL
Our EDI endpoint and the freight partner's endpoint both present a certificate from the same issuing authority. Ours is rejected when the partner connects…
certificate chainintermediate authorityroot of trustcertificate inspection
Judge two sessions for one account in two countries
ProAssisted · Quick · 6 min · SIEM queue
A sales manager in Singapore shows two live sessions at once: one from her home address and one from an address in Sydney…
concurrent sessionsindicator of compromisevpn egressfalse positive
Move a partner to its new address range
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
The claims clearing partner moved its outbound range to 203.0.113.0/24 on Monday and told nobody until their file drops started timing out…
security groupsegment scopingingress rulespartner access
Move remote desktop off the internet for the build estate
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
The build estate group accepts remote desktop from every address because a migration partner needed to reach it in March. The partner has since moved to a fixed range, 198.51.100.64/29…
security groupsegmentationremote desktopleast privilege
Put the log collector back on one store
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A cleanup script rewrote the collector identity last month and replaced its one narrow policy with AmazonS3ReadOnlyAccess, which reaches every bucket in the account…
service identityleast privilegepolicy attachmenttenant wide access
Restore the gateway settings from last week
ProAssisted · Quick · 6 min · Linux bash console
Somebody edited the gateway configuration during Saturday's incident and put the service into maintenance mode with one retry…
restoration testingbackup copyrecoveryfile permissions
Take world read off the gateway integration file
ProAssisted · Quick · 6 min · Linux bash console
The payments gateway runs as appsvc and reads its upstream settings from one environment file. A support engineer copied the file out of the deployment bundle with the default mode…
data handlingfile permissionssecret storageleast privilege
A bulk copy before the last working day
ProAssisted · Quick · 7 min · SIEM queue
An account opened an evening session from an office desk, read three point four gigabytes from the deals folder in eleven minutes…
insider threatdata exfiltrationthreat motivationcontainment
Close the two alerts in the compliance pack
ProAssisted · Quick · 7 min · SIEM queue
The quarterly compliance pack samples two alerts and asks for a recorded verdict on each. One is the vulnerability scanner's service account signing in at 20:00…
compliance reportingattestationalert verdictsevidence
Contain the reception machine that ran the car park stick
ProAssisted · Quick · 7 min · SIEM queue
A memory stick was handed in at reception on Monday morning. It had been found in the car park over the weekend with a client name written on it in marker. Two reception machines saw it…
removable mediaexternal media threat vectorshortcut filescheduled task
Find the one archive job that does not match
ProAssisted · Quick · 7 min · SIEM queue
One alert covers two record room workstations that each wrote a large archive after hours. The inventory says both run the nightly archive job…
alert triagebaseline behaviourhost containmentalert tuning
Harden the new log collector before it goes live
ProAssisted · Quick · 7 min · Linux bash console
The collector host was built from the standard image and then someone widened its output folder so a script would stop failing…
host hardeningfile permissionsshared build accountleast privilege
Narrow the jump host to the office range
ProAssisted · Quick · 7 min · Cloud panel with the matching CLI line
The jump host in the operations zone has two rules that both cover the whole internet: one for remote desktop on 3389 and one for shell access on 22…
security groupleast privilegeingress rulesremote access
Separate a password spray from two ordinary lockouts
ProAssisted · Quick · 7 min · SIEM queue
The brute force rule fired at 02:14 on the access gateway. Sixty one failed sign-ins landed across fourteen accounts in three minutes, four attempts per account…
password sprayingaccount lockoutcredential attacksalert triage
Stop the playbook that turned MFA off
ProAssisted · Quick · 7 min · SIEM queue
At 01:00 the phishing response playbook ran from the automation host with a standing credential that never expires. One of its steps was meant to reset a mailbox rule…
automation guardrailsstanding credentialplaybook logicidentity changes
Take admin rights off the report job
ProAssisted · Quick · 7 min · Cloud panel with the matching CLI line
The nightly report job runs under a service role that accumulated policies over two years. Today it carries full administrator rights and write access to every bucket…
least privilegeservice rolepolicy attachmentaccess review
Take the object store console and API off the internet
ProAssisted · Quick · 7 min · Cloud panel with the matching CLI line
The team stood up its own object store during the migration and opened both ports to every address so nothing would block…
security grouplogical segmentationsecurity zonesmanagement plane
Fix an isolation that hit the wrong server
ProAssisted · Quick · 8 min · SIEM queue
At 02:01 a workstation renamed 3,120 files with a new extension. The on-call analyst ran the containment step and isolated the file server instead of the workstation…
containmentplaybookisolationincident response order
Set object history to match the retention rule
ProAssisted · Quick · 8 min · Cloud panel with the matching CLI line
Two stores in the same account, two opposite rules. The case evidence store must keep object history, must not be public and must hold encrypted objects…
versioningretentionrecoverystorage policy
Report inside the audit scope and nowhere else
ProAssisted · Quick · 10 min · Assessment workspace
The internal audit team asked for a known environment assessment of the backup tier, and the signed terms cover 198.51.100.0/24 only…
internal auditrules of engagementassessment scopebenchmark deviation
Report the flaw that ruins the weekend
ProAssisted · Quick · 10 min · Assessment workspace
The monthly scan of the Northbridge Health patient portal range turned up two candidates. One is a template library several versions behind…
CVSS scoreCVEknown exploitedprioritisation
Get FS-01 failed logons into the SIEM
ProAssisted · Quick · 14 min · SIEM queue; Windows desktop
Ticket SEC-8107 from Ines Duarte, IT manager: "The nightly backup on FS-01 has failed to sign in all week and nobody sees it…
audit policylog forwardingfailed logon eventSIEM ingestion
Trace an ended contractor session without blocking the whole office
ProAssisted · In-depth · 31 min · SIEM queue
Monday, 08:40. The contractor roster closed for the quarter three months ago and this morning the identity platform accepted a session for v.tan, whose engagement ended on 15 June…
stale credentialsdeprovisioningsaved session tokenshared egress address
Split a city data portal into a public shelf and a private vault
ProAssisted · In-depth · 36 min · Cloud panel with the matching CLI line
The city publishes air quality, transit and planning feeds from one account, and the open data portal is read by anyone with a browser. Four buckets sit in that account…
public object storagedata classificationdata at restsecurity group
Break up the QR sticker campaign in the warehouse
ProChallenge · Quick · 6 min · SIEM queue
Stickers advertising a shift swap app appeared on the notice boards at six in the morning. Each one carries a square code instead of a link…
image based vectorquishinglookalike pageindicator blocking
Name the two faults on the vendor download page
ProChallenge · Quick · 7 min · Linux bash console with OpenSSL
The vendor download portal showed a certificate warning on Monday and the package page prints a 40 character checksum next to each file…
certificate expiryhashing algorithmsSHA-1download integrity
Cut off a kiosk that calls home every minute
ProChallenge · Quick · 8 min · SIEM queue
A store kiosk opens a TLS session every 61 seconds, sends 312 bytes and gets 88 back. The domain behind it was registered eleven days ago. Nothing was dropped on disk…
command and controlbeaconingfileless malwareindicator blocking
Retire plaintext transfer on a file gateway
ProChallenge · Quick · 8 min · Cloud panel with the matching CLI line
The file gateway in the transfer zone has been running since the migration and nobody trimmed its rules. Four rules are in place: plain FTP from anywhere, Telnet from the support subnet…
attack surfacesecurity groupplaintext protocolmanagement access
Put a seven year hold on case records and close the old replication path
ProCapstone · In-depth · 37 min · Cloud panel with the matching CLI line
The housing casework service keeps every case file for seven years after closure because the regulator asks for them…
legal holdobject versioningretentionimmutability
Where to go next
Every certification with labsSY0-801 lab questions
There are 47 labs: 14 guided, 28 assisted, 4 challenge, 1 capstone. Together they carry about 7 hours of authored lab time, and none of them is a free taster yet.
Practise SY0-801 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.