SY0-801 · Security+ V8

The Security+ SY0-801 exam objectives

The exam has 5 domains and 27 objectives. Each objective below lists the sub-topics CompTIA names for it and how many lessons in the SY0-801 course cover it. Mastery in the course is tracked at this level, so the dashboard shows you exactly which of these you still need.

This is the list for SY0-801 (Security+ V8), the newer exam, which CompTIA expects to launch on or around 17 November 2026. If you’re not sure which version to take, take this one. Already booked SY0-701? Its list is different: see the SY0-701 objectives. Every plan includes both courses.

The weights are the share of the exam each domain takes, as published by CompTIA. A domain’s weight is spread across its objectives, so each of the three objectives in General Security Concepts (16%) is worth more than twice as much as one of the six in Security Program Management and Oversight (14%). The objective titles and sub-topics follow CompTIA’s SY0-801 objectives document, version 2.0: each sub-topic is one of its headings with the bullets under it.

1.0 General Security Concepts

16% of the exam, 3 objectives

1.1 Explain security concepts and controls.

Defense in depth: confidentiality, integrity, and availability (CIA); authentication, authorization, accounting (AAA); non-repudiation; Zero Trust principles; least privilege
Control categories: technical/logical, managerial/administrative, physical/environmental, operational
Control types: preventive, deterring, corrective, detective, compensating, directive

10 lessons in the course

1.2 Given a scenario, demonstrate the impact of change management processes on security.

Business processes impacting security operations: change advisory board (CAB) (approval process), ownership, stakeholders, impact analysis, test results, backout planning, fail forward, maintenance window, standard operating procedures (SOPs)
Technical implications: allow lists/deny lists, restricted activities, downtime, service restart, application restart, legacy applications, dependencies
Documentation: updating diagrams, updating policies/procedures
Version control

3 lessons in the course

1.3 Explain the importance of using appropriate cryptographic solutions.

Public key infrastructure (PKI): public key, private key, key escrow
Certificates: certificate authorities, certificate revocation lists (CRLs), Online Certificate Status Protocol (OCSP), self-signed, third-party, root of trust, certificate signing request (CSR) generation, wildcard
Encryption: protocols, symmetric, asymmetric, level (full disk, partition, file, volume, database, record), transport/communication, key exchange, algorithms, key length
Digital signatures
Salting
Tools
Obfuscation
Hashing algorithms

10 lessons in the course

2.0 Threats, Vulnerabilities, and Attacks

24% of the exam, 6 objectives

2.1 Explain characteristics of threats and vulnerabilities.

Threats: threat feeds, likelihood, impact, intelligence sources, life cycle
Vulnerabilities: scoring (Common Vulnerability Scoring System (CVSS)), prioritization, vulnerability types, Common Vulnerabilities and Exposures (CVE)

3 lessons in the course

2.2 Describe common threat actors and motivations.

Threat actors: crime syndicate/organized crime, terrorist, unskilled attacker, hacktivist, insider, accidental/unintentional, competitor, state-sponsored
Motivations: financial, influence, intellectual property, notoriety, espionage, fear/chaos, extortion, general curiosity, revenge, ideological, political, ethical
Attributes of actors: internal/external, resources/funding, level of sophistication/capability

4 lessons in the course

2.3 Describe threat vectors and sources.

Advanced persistent threat (APT)
Message-based: email, Short Message Service (SMS), Rich Communication Services (RCS), instant messaging, collaboration tools
Image-based: quick response (QR) codes, embedded content, Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA)
Attachment-based: embedded macros, Rich Text Format (RTF) documents, Portable Document Formats (PDFs)
Browser-based: extensions, JavaScript, password managers, cookies, session tokens
Network-based: infrastructure devices, virtualized devices, session keys
Remote access: remote desktop, Virtual Network Computing (VNC), virtual private network (VPN)
Endpoint-based: mobile devices, workstations, servers, tablets, trusted devices, built-in tools, living-off-the-land tools
Supply chain-based: third-party providers, managed service providers, logistic providers, software as a service (SaaS) providers
External media-based: malicious Universal Serial Bus (USB)
Human-based: impersonation, contractor, visitor, biometric, watering hole
Internet of Things (IoT)-based: cameras, sensors, printers
Operational technology (OT)-based
Physical-based: lock and key, access vestibule, access passes
Signal-based: Bluetooth, radio frequency (RF), near-field communications (NFC)

15 lessons in the course

2.4 Explain types of vulnerabilities and attack surfaces.

Unsupported products
Unpatched systems
Obsolete systems
Unmanaged systems
Ports and services
Applications: race conditions (time-of-check (TOC), time-of-use (TOU)), malicious update
Code: hardcoded secrets, unsafe exception handling
Operating system (OS)-based
Virtualization
Zero-day
Cryptographic vulnerabilities
Unmanaged/stale credentials
Rogue devices
Shadow IT
Wireless and low-powered communications
Large language models (LLMs)
Identity providers
Mobile devices
Misconfiguration
Public repositories
Public object storage

9 lessons in the course

2.5 Given a scenario, analyze indicators of malicious activity.

Malware attacks: ransomware, trojan, worm, spyware, adware, virus, rootkit, keylogger, logic bomb, fileless malware
Physical attacks: tailgating, shoulder surfing, skimming, forced entry
Network attacks: distributed denial of service (DDoS), protocol downgrade, rogue, sniffing, spoofing, on-path, Domain Name System (DNS) attacks, cache poisoning
Social engineering attacks: smishing, vishing, phishing, whaling, spear phishing, quishing, impersonation, deepfake
Indicators of compromise: hash, Internet Protocol (IP) address, domain, malicious processes, file system artifacts, timestamp, log manipulation, excessive resource consumption, plaintext strings, account lockout, impossible travel, concurrent sessions
Application attacks: injection, buffer overflow, replay, privilege escalation, forgery, directory traversal
Credential attacks: password spraying, brute force, user enumeration, replay, multifactor authentication (MFA) bypass

13 lessons in the course

2.6 Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage.

Model manipulation
Poisoning
Prompt injection
Data loss
Bias
Explainability
Hallucinations
Jailbreaking
Evasion
Privacy
Ethical considerations
Session hijacking
Code execution

2 lessons in the course

3.0 Security Architecture

19% of the exam, 4 objectives

3.1 Compare and contrast security implications of different architecture models.

Architecture and infrastructure concepts: cloud (serverless, multicloud, deployment models (hybrid, private, public, community), Infrastructure as Code (IaC)), OT, on-premises infrastructure, air-gapped network, microservices, logical segmentation, physical segmentation
Technical considerations: availability, resilience, proprietary vs. open source, usability, responsibility, compute, power requirements, ease of recovery
Business considerations: data sovereignty, data classification, cost, ownership, environmental requirements, scalability, risk

7 lessons in the course

3.2 Given a scenario, manage the security architecture to best protect the infrastructure.

Infrastructure considerations: device placement, security zones, attack surface, diversity
Zero Trust architecture: user authentication, device management (health, inventory), application access control
Secure communication/access: virtual private network (VPN), remote access, tunneling, user management, user access (least privilege), end-to-end encrypted messaging, out-of-band management, file transfer, Security Service Edge (SSE)
Identity management: Group Managed Service Accounts (gMSAs), least privilege access accounts, privilege creep
Failure modes

9 lessons in the course

3.3 Summarize concepts and strategies used to protect data.

Data types: structured, unstructured
Data states: data at rest, data in use, data in transit
Data classifications: sensitive, secret, critical, confidential, public, top secret, restricted
Methods used to secure data: masking, hashing, filtering, tokenization, encryption, data transpose, deidentification, obfuscation
Data protection roles: data owner, data custodian, data steward, data operator, data controller, data subprocessor
Data handling: endpoints, marking and labeling, geofencing, data location, data placement
Data management life cycle: creation, management, distribution, retention, disposal
Data compliance: standards, health data, personal information, financial, child/minor data, intellectual property, legal data

8 lessons in the course

3.4 Explain the importance of resilience and recovery in security architecture.

Site considerations: hot, cold, warm, environmental
Platform diversity: vendor platform, hardware, virtualization
Redundancy strategies and solutions: load balancing, clustering, autoscaling, high availability, multicloud systems, power (uninterruptible power supply (UPS), redundant power supply (RPS), power generator, surge protector)
Storage
Backups: retention, immutability, scope, restoration testing
Testing: failover, simulation, parallel processing
Disaster recovery
Business continuity
Capacity planning
Recovery metrics: recovery time objective (RTO), recovery point objective (RPO), mean time to repair (MTTR), mean time between failures (MTBF)

8 lessons in the course

4.0 Security Operations

27% of the exam, 8 objectives

4.1 Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment.

Segmentation
Access controls
Hardening
Sandboxing
Deception and disruption technology: honeypot, honeynet, honeyfile, honeytoken, canary account
Monitoring/alerting
Mobile device management (MDM)
Application control: allow lists, block lists
Intrusion detection/prevention systems: network-based intrusion detection system (NIDS)/network-based intrusion prevention system (NIPS), host-based intrusion detection system (HIDS)/host-based intrusion prevention system (HIPS), wireless intrusion prevention system (WIPS)
Firewalls: rate-limiting requests, web application firewall (WAF), rule-based, unified threat management (UTM), Layer 4/Layer 7
Content filter: data loss prevention (DLP), agent-based, centralized proxy
Endpoint security: endpoint detection and response (EDR), extended detection and response (XDR), antivirus
Network access control: captive portals, 802.1X, endpoint posture/compliance
Repositories: secrets scanning
Application security: input validation, secure cookies, static code analysis, code signing
Email security: Domain-based Message Authentication, Reporting, and Conformance (DMARC); Sender Policy Framework (SPF); DomainKeys Identified Mail (DKIM); Brand Indicators for Message Identification (BIMI)
Operating systems security: Group Policy, Security-enhanced Linux (SELinux)

19 lessons in the course

4.2 Explain the security implications of proper hardware, software, and data asset management.

Asset management life cycle
Planning/scoping
Acquisition/procurement process
Assignment/accounting
Monitoring/asset tracking
Disposal/decommissioning

5 lessons in the course

4.3 Given a scenario, perform tasks associated with vulnerability management.

Identification methods: scanning, Internet Protocol Address Management (IPAM), cloud security posture management (CSPM), source code review
Prioritization: severity assessment, penetration test report review
Remediation
Verification
Reporting: internal, external (bounty program, responsible disclosure policies)

6 lessons in the course

4.4 Explain security alerting and monitoring concepts and tools.

Monitoring computing resources: systems, application, infrastructure
Activities: log aggregation, alerting, scanning, archiving, reporting, alert tuning
Tools: benchmarks, agents/agentless, security information and event management (SIEM), antivirus, DLP, vulnerability scanners, orchestration, packet analyzer
Protocols: NetFlow, Simple Network Management Protocol (SNMP), syslog, Security Content Automation Protocol (SCAP)
Automated alerts
Port mirroring
Dashboards
Network management systems

6 lessons in the course

4.5 Given a scenario, apply concepts related to identity and access management.

Provisioning/deprovisioning user accounts
Permissions assignments and implications
Identity proofing
Federation
Single sign-on (SSO): Security Assertions Markup Language (SAML), Lightweight Directory Access Protocol (LDAP), open authorization (OAuth)
Account types: user, privileged (global, local), service, third-party, emergency access
MFA: hard token, soft token, biometrics, one-time password (OTP), backup code
Access control models: rule-based, role-based, time-based, mandatory, discretionary, just-in-time
Access management: authentication, policies (logical/technical, administrative/business)
Access review
Password concepts: passkey, password managers, passwordless, password best practices (length, complexity, reuse, expiration, age, compromised credential monitoring, account auditing, policy report)

7 lessons in the course

4.6 Given a scenario, apply automation and orchestration solutions to secure operations.

Use cases of automation and scripting: user provisioning, resource provisioning, desired state management, anomaly detection, ticket management
Considerations: guardrails, automation logic, process engineering, complexity, financial, process risks, deployment
AI: capabilities (agentic, chatbot, predictive analysis, AI-augmented baselines)
Intended outcomes: efficiency/time saving, enforcing baselines, continuous improvements, productivity improvements, reduced downtime, increased proactivity
SecOps: continuous integration and continuous deployment (CI/CD)
Workflows: automation, integrations

6 lessons in the course

4.7 Summarize concepts associated with incident response activities.

Preparation: training, testing, tabletop exercises, playbooks, simulation, roles
Identification: detection, internal advisory, external advisory, threat hunting
Investigation: digital forensics, chain of custody, e-discovery, preservation
Containment: quarantine/isolation
Negotiation
Eradication/recovery
Notification/external reporting: stakeholders, customers, law enforcement, mandatory
Post-incident: lessons learned, root cause analysis, post-incident reporting (PIR)

9 lessons in the course

4.8 Given a scenario, use data, artifacts and sources to support a security investigation.

Log and trace data types: access and accounting (logical, physical), device, server, application, authentication, communication, audit, endpoint, network, metadata
Data sources: vulnerability scans, automated reports, NetFlow/Internet Protocol Flow Information Export (IPFIX), surveillance footage, security tools, dashboards, packet captures
File/log integrity
System image: memory dump, bit-level copy, snapshot
Stakeholders: Human Resources (HR), accounts, legal
Log-parsing techniques

6 lessons in the course

5.0 Security Program Management and Oversight

14% of the exam, 6 objectives

5.1 Explain the importance of governance, risk, and compliance artifacts.

Guidelines: benchmarks, advisories, implementation guides, reference architecture
Standards: baselines, passwords, physical security, request for comments (RFC), encryption
Procedures: standard operating procedure (SOP), runbooks
Plans: business continuity, disaster recovery
Policies: bring your own device (BYOD), acceptable use policy (AUP), clean desk, information security, incident response, data classification and retention, access control, data disposal, vulnerability disclosure, privacy

5 lessons in the course

5.2 Explain the impact of risk management processes on the security of the organization.

Risk identification: asset identification, stakeholder ownership
Risk assessment: scoring, categorization
Risk analysis: impact, likelihood/probability, owner, current mitigations, qualitative vs. quantitative
Risk register: communication, reviews
Risk treatment: transferring, accepting, avoiding, mitigating
Business-level considerations: business impact analysis, risk appetite, residual risk, stakeholder involvement, management oversight, regulatory, legal, single loss expectancy (SLE), annualized loss expectancy (ALE), annualized rate of occurrence (ARO)

8 lessons in the course

5.3 Explain the assessment and management processes associated with third-party risk.

Vendor selection: request for proposal (RFP), request for information (RFI), request for quote (RFQ), expression of interest (EOI), due diligence, conflict of interest
Agreement types: service-level agreement (SLA), service-level objective (SLO), memorandum of understanding (MOU), memorandum of agreement (MOA), non-disclosure agreement (NDA), master services agreement (MSA), statement of work (SOW)
Vendor monitoring: right to audit, service-level monitoring, vendor registry, vendor assessment, compliance attestation, penetration testing
Limitations/constraints: staffing limitations, resource availability, environment, legal and regulatory factors, geography/jurisdiction, financial/return on investment (ROI), vendor lock-in, assurance mechanisms
Rules of engagement

5 lessons in the course

5.4 Summarize elements of effective security compliance.

Compliance training: data handling, anti-money laundering/counter-terrorism financing (AML/CTF), anti-bribery
Compliance monitoring: attestations, acknowledgements
Consequences of non-compliance: reputational damage, financial, legal, contractual, sanctions, loss of license
Privacy: right to be forgotten, opt-in or opt-out, data correction, processing restrictions, processing prevention, controller vs. processor, ownership
Legal compliance: legal hold, legal orders, data retention requirements

9 lessons in the course

5.5 Explain concepts associated with audit and assessment activities.

Data gathering: sampling, questionnaires/surveys, interviews, assertion, reference sources (MITRE ATT&CK, Cyber Kill Chain, Diamond Model of Intrusion Analysis)
Scoping: audit charter, frequency
Engagement types: gap analysis, internal (compliance, audit committee, self-assessments), external (examinations, assessments, regulatory, independent third-party audits), benchmarking
Penetration testing: known environment, unknown environment, partially known environment, physical, offensive, defensive, integrated, reconnaissance (passive, active)
Frameworks and standards: industry-based standards, international standards, region-specific standards
Functional testing
Behavioral testing

9 lessons in the course

5.6 Given a scenario, apply security awareness concepts to improve organizational security.

Types of training: initial/onboarding, ongoing, targeted, corrective
Delivery mechanisms: learning management system (LMS), self-service portals, one-to-one, one-to-many
Reporting and monitoring of effectiveness: metrics, managerial reports, personnel behavior risk scoring
Common training topics: social engineering, emerging security topics, password and credential management, remote work/teleworking/hybrid, BYOD, business email compromise (BEC), removable media and cables, situational awareness, operational security

7 lessons in the course

What changed from SY0-701

The exam’s format is the same: up to 90 questions in 90 minutes, multiple-choice and performance-based, 750 to pass on a scale of 100 to 900. The content moves more than the domain names suggest:

Weights. General Security Concepts goes from 12% to 16% and Threats from 22% to 24%; Security Program Management and Oversight drops from 20% to 14%. Security Architecture (19%) and Security Operations (27%) change by a point each.
Artificial intelligence. A new objective, 2.6, covers the threats and vulnerabilities of AI usage: prompt injection, jailbreaking, poisoning, model manipulation, hallucinations, data loss and more. AI also appears in 4.6, as a capability in automation and orchestration.
Threats and vulnerabilities. A new 2.1 covers their characteristics: threat feeds, likelihood, impact, intelligence sources, CVSS scoring and CVE. Threat vectors (2.3) grow to fifteen headings, from browser-based and remote access to IoT, operational technology and signals. Attack surfaces (2.4) now include large language models, identity providers, public repositories and public object storage.
A different shape. SY0-701’s first two objectives (security controls and fundamental concepts) are merged into one, so Domain 1 has three objectives. Mitigations leave Domain 2, which is now Threats, Vulnerabilities, and Attacks, and join the firewall, endpoint and email controls in 4.1, “apply mitigating controls, techniques, and solutions”.
Acronyms. The official acronym list is much shorter: 106 terms on SY0-801’s, against 321 on SY0-701’s.

Much of what SY0-701 teaches is still on the exam, under the same or a new heading. In the course, 102 lessons and 1,514 exercises count for both exams, so progress made in one counts in the other wherever the material is shared.

How to use this list

Treat the objectives as a checklist, not a reading order. The verbs matter: compare and contrast, explain, summarize and describe objectives are tested with scenarios that ask which option is BEST or MOST likely, while given a scenario objectives are the ones most likely to appear as performance-based questions. If you can explain every sub-topic to someone else in a sentence or two, and tell it apart from its neighbours, you are ready for that objective.

In the course, every lesson and every exercise is tagged with the objective and sub-topic it covers, so the readiness estimate and the next-best-action picker work at this granularity. The exam guide covers the format, timing and scoring; the practice exams page explains how a full-length run is built to these weights.

CompTIA publishes the official objectives document on comptia.org. Check it for the current version: objectives can be revised, and CompTIA notes that the examples under each heading are not exhaustive.

Cover all 27 objectives by answering, not watching

145 interactive lessons and 2,020 original exercises for SY0-801, tracked per objective, and the SY0-701 course in the same plan. Try one lesson free first.

Try a free lesson See pricing