The Security+ exam, explained: SY0-801 and SY0-701

At a glance

	SY0-801 (Security+ V8)	SY0-701 (Security+ V7)
Launch	On or around 17 November 2026	7 November 2023
Retirement	Estimated three years after launch	English: 11 June 2027. Japanese, Portuguese, Spanish and Thai: 13 August 2027
Questions	Up to 90, multiple-choice and performance-based
Time	90 minutes
Passing score	750 on a scale of 100 to 900
Content	5 domains, 27 objectives	5 domains, 28 objectives
Languages	English	English, Japanese, Portuguese, Spanish and Thai
Recommended experience	Two years of hands-on experience as a security administrator	CompTIA Network+ and two years in a security or systems administrator role

There are no prerequisites: the experience is a recommendation, not a requirement. The exam is delivered by Pearson VUE at a test centre or online with a proctor; the current voucher price is on CompTIA’s store and varies by country.

Which version to take

Both versions lead to the same certification, CompTIA Security+. Which one you sit depends mostly on when.

• SY0-801 if you’re unsure. It is the newer version, the one CompTIA will offer for the next few years, and the only one in English after 11 June 2027. Its objectives include the newest material, from AI threats to modern attack surfaces. The course opens in SY0-801 for everyone who hasn’t chosen.
• SY0-701 if your exam is already booked as SY0-701, or you will sit it before it retires. The exam code is on your booking confirmation. CompTIA’s own advice is that if you’re ready to certify now, V7 remains a strong option. For now, SY0-701 is also the version CompTIA lists in Japanese, Portuguese, Spanish and Thai.

Every Rabbit Courses plan includes both courses, and you can switch between them in the course at any time. An answer counts in both wherever the material is shared (1,514 of the exercises count for both exams), so changing your mind later doesn’t cost you that progress.

Question types

Multiple-choice

Most questions are a short scenario and four options, with one correct answer. Some ask you to choose two. The hard part is rarely the facts: it is the qualifier. “Which is the BEST control?”, “What should the analyst do FIRST?” and “Which is MOST likely?” each have several defensible options and one that the exam wants, and the one it wants follows a consistent logic: contain before you investigate, least privilege over convenience, the control that addresses the stated risk over the one that is merely good practice.

Performance-based

Performance-based questions (PBQs) put you in a simulated environment and ask you to do something: order firewall rules so that the right traffic is allowed and the rest dropped, read a log and identify the attack, drag a device to the right network segment, configure a wireless network securely. CompTIA’s simulations have limited functionality but accept several valid paths, include a reset button, and can be skipped and returned to. They usually appear at the start of the exam. Both versions use them. Security+ PBQs explained has a worked example and how to approach them.

Timing

Ninety minutes for up to ninety questions is one minute each on average, but PBQs can take five to ten minutes apiece. The strategy nearly everyone settles on: when the exam opens with PBQs, read each one, do it if it is quick, otherwise flag it and move on. Work through the multiple-choice at pace, flagging anything you are unsure of, then return to the flagged PBQs with the time you have left. Never leave a question blank; there is no penalty for a wrong answer.

Scoring

Both versions report a scaled score between 100 and 900, and 750 passes. CompTIA does not publish how your raw answers convert to that scale, so there is no reliable way to translate “I got 80% on a practice test” into a scaled score. Treat any practice estimate, including ours, as a labelled guess. What a practice exam can tell you reliably is which domain is dragging you down.

You get your result at the end of the exam. Candidates who do not pass can retake the exam; CompTIA’s retake policy sets the waiting periods, so check it if you need it.

The five domains

Both versions have five domains with the same numbers and nearly the same names, but the weights and some of the contents differ.

Domain	What it covers	SY0-801	SY0-701
1.0 General Security Concepts Security controls (categories and types), the CIA triad, AAA, non-repudiation, Zero Trust, change management, cryptography (PKI, certificates, encryption, hashing). SY0-701 also lists physical security and deception technology here.	16%	12%
2.0 Threats, Vulnerabilities, and Attacks (SY0-701: and Mitigations) Threat actors and motivations, threat vectors, vulnerabilities and attack surfaces, indicators of malicious activity. SY0-801 adds the characteristics of threats and vulnerabilities (threat feeds, CVSS, CVE) and AI threats, and moves mitigations to Domain 4.	24%	22%
3.0 Security Architecture Architecture models (cloud, on-premises, IoT, industrial and operational technology, virtualisation), securing infrastructure, protecting data, resilience and recovery.	19%	18%
4.0 Security Operations Hardening and security controls for systems, networks and email (SY0-801 gathers them with the mitigations in 4.1), asset and vulnerability management, alerting and monitoring, identity and access management, automation and orchestration (with AI in SY0-801), incident response, data for investigations.	27%	28%
5.0 Security Program Management and Oversight Governance, risk management, third-party risk, compliance, audits and assessments, security awareness.	14%	20%

Security Operations is the largest domain in both versions, and with Threats it makes up about half of either exam. Those two domains are also the most scenario-heavy, so they are where practice with realistic situations pays most. Every objective, with its sub-topics, is on the SY0-801 objectives page and the SY0-701 objectives page.

What’s new in SY0-801

CompTIA describes Security+ V8 as expanding coverage of areas such as AI-related risks, security operations and modern environments. In the objectives that means a new objective on the threats and vulnerabilities of AI usage (prompt injection, jailbreaking, poisoning, hallucinations and more), a new objective on the characteristics of threats and vulnerabilities, many more threat vectors, and large language models, identity providers and public repositories as attack surfaces. SY0-701’s first two objectives are merged into one, and the mitigations move from Threats into Security Operations. The SY0-801 objectives page lists the changes, domain by domain.

How to prepare

Two findings from memory research matter more than any study tip. The first is the testing effect: trying to recall something, and finding out whether you were right, produces far more durable learning than re-reading or re-watching it (Roediger and Karpicke, 2006, is the usual citation). The second is the spacing effect: the same amount of practice spread over days and weeks beats the same amount in one sitting, and the optimal gap grows as the memory strengthens (Cepeda and colleagues reviewed the evidence in 2006). Most Security+ preparation ignores both. Hours of video, a textbook read once, and a block of practice tests in the last week feel like work and produce familiarity, not recall.

A preparation that uses them looks like this:

1. Learn each objective actively. Short lessons that make you answer as you go. Draw the diagram yourself, or operate one: step through the TLS handshake, follow a request through a zero-trust policy enforcement point, place the sensors on a network. If you can’t reconstruct it, you don’t have it yet.
2. Review on a schedule, not a whim. Use spaced repetition so that each fact comes back just before you would forget it. Rate your confidence before you see the answer: a confident wrong answer is the most valuable thing a review session can surface, because it is a belief you would have taken into the exam.
3. Practise the qualifiers. BEST, FIRST and MOST questions reward a consistent way of thinking. Do enough scenario questions, with explanations for every option, that the exam’s logic becomes yours.
4. Rehearse the hands-on parts. Firewall rules, log reading, network placement and wireless configuration are the usual PBQ subjects. Do them in a simulator until the interface is boring.
5. Sit full-length exams under real conditions. 90 minutes, no notes, no pausing, PBQs first. Then review every question, including the ones you got right by guessing.
6. Track mastery per objective, not per chapter, and weight your time by the domain weights of the version you are sitting. A weak objective in Security Operations costs more than a weak one in General Concepts.

How long it takes depends on where you start. With a networking background and daily sessions of 20 to 30 minutes, two to three months is a common range; without one, longer. The honest answer is that you are ready when you can recall every objective and your practice exams are consistently clear of the pass mark, not when a calendar says so. The study plan page shows how to pace the work to an exam date.

After you pass

Security+ is valid for three years from the day you pass. You keep it current through CompTIA’s continuing education programme, which for Security+ means 50 continuing education units over the three years, or by passing a qualifying higher certification or the latest version of the exam. CompTIA’s site has the current rules and fees.