CompTIA Security+ SY0-801 (V8) Exam Objectives: What to Expect and How to Prepare

By CertInstructor

CompTIA has published the exam objectives for the next version of Security+, SY0-801 (V8). If you are planning to certify in the coming months, this guide walks through what the objectives cover, where the exam puts its weight, and how to start preparing without wasting time on the wrong material.

A quick note before we begin: this article is our own summary of the publicly available objectives document. CompTIA's official document is the source of truth, so always check CompTIA for the confirmed launch date, pricing and any updates.

SY0-801 at a glance

• Exam code: SY0-801 (V8)
• Questions: up to 90
• Question types: multiple-choice and performance-based
• Time: 90 minutes
• Passing score: 750 on a scale of 100 to 900
• Recommended experience: a security administrator with about two years of hands-on experience

The objectives describe a candidate who can support incident response, assess an environment's security posture and recommend fixes, manage cloud, mobile and hybrid environments, work within governance, risk and compliance requirements, and apply mitigations against threats, vulnerabilities and attacks.

The five domains and how they are weighted

Security Operations is the biggest slice at 27%, followed by Threats, Vulnerabilities, and Attacks at 24%. Together they make up just over half of the exam, so they deserve the largest share of your study time.

What stands out in the SY0-801 objectives

AI is now an explicit exam topic. Objective 2.6 is dedicated to threats and weaknesses tied to AI usage, including model manipulation, data poisoning, prompt injection, hallucinations, jailbreaking, evasion, privacy and ethical concerns. Large language models also appear in the attack surface list, and objective 4.6 covers AI in security automation, including agentic AI, chatbots and predictive analysis.

Modern social engineering and attack vectors. The objectives mention QR-code phishing (quishing), deepfakes, RCS messaging, collaboration tools, browser-based risks such as session tokens and extensions, and living-off-the-land techniques.

Cloud, identity and zero trust. Expect topics such as serverless, infrastructure as code, Security Service Edge (SSE), group managed service accounts, privilege creep, just-in-time access, passkeys and passwordless authentication.

Operational depth. Cloud security posture management (CSPM), IP address management (IPAM), secrets scanning, email authentication (SPF, DKIM, DMARC and BIMI), NetFlow and IPFIX, and log-parsing techniques all show up in the list.

Domain-by-domain: where to focus

1.0 General Security Concepts (16%)

This domain builds the foundation: the CIA triad, AAA, non-repudiation, zero trust and least privilege, plus control categories and control types. It also covers how change management affects security (approval processes, impact analysis, backout plans, maintenance windows) and the essentials of cryptography: PKI, certificates and revocation, symmetric versus asymmetric encryption, hashing, salting and digital signatures.

Study tip: be able to tell control types apart in a scenario (for example preventive versus compensating), and know when to use each cryptographic tool.

2.0 Threats, Vulnerabilities, and Attacks (24%)

Here you need to recognize threat actors and their motivations, threat vectors, types of vulnerabilities and attack surfaces, and indicators of malicious activity. The indicators section is scenario-heavy: think malware types, network and application attacks, credential attacks, and signals such as impossible travel, concurrent sessions and unusual resource consumption. The AI-related objective sits here too.

Study tip: practice reading short scenarios and naming the attack from the clues. This is where performance-based questions can appear.

3.0 Security Architecture (19%)

This domain compares architecture models (cloud, on-premises, OT, air-gapped, microservices, segmentation), then moves into protecting infrastructure with zero trust, secure access and identity management. It also covers data protection (data states, classifications, masking, tokenization, data roles, life cycle, compliance) and resilience and recovery (site types, redundancy, immutable backups, RTO, RPO, MTTR and MTBF).

Study tip: learn the recovery metrics and site types well. They are easy to mix up and easy to test.

4.0 Security Operations (27%)

The largest domain focuses on applying controls in real environments: hardening, segmentation, deception technology, IDS and IPS, firewalls, EDR and XDR, network access control, application and email security. It continues with asset management, vulnerability management, monitoring tools and protocols (SIEM, SNMP, syslog, SCAP), identity and access management, automation and orchestration, incident response and investigation data sources.

Study tip: this domain rewards hands-on practice. If you can, work through labs where you read logs, configure access controls and walk through an incident from detection to post-incident review.

5.0 Security Program Management and Oversight (14%)

The final domain covers governance, risk and compliance: policies, standards and procedures, risk identification, assessment and treatment (including SLE, ALE and ARO calculations), third-party risk and vendor agreements, compliance and privacy, audits and assessments, penetration testing types, and security awareness training. It also references frameworks such as MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model.

Study tip: the risk formulas are a good source of quick, reliable points. Practice them until they feel automatic.

Comparing SY0-801 with SY0-701

If you have studied for SY0-701, much of the foundation carries over. One visible difference is the weighting. As far as we know, SY0-701 weighted its domains at 12%, 22%, 18%, 28% and 20%, so SY0-801 shifts weight toward General Security Concepts, Threats, and Architecture and reduces Program Management and Oversight. The addition of AI as a dedicated objective is the most noticeable content change. Compare both official objectives documents side by side to see every difference for yourself.

How to start preparing

1. Read the official objectives first. Download the SY0-801 objectives from CompTIA and use them as your checklist. The acronym list at the end is worth reviewing in full.
2. Match your time to the weights. Spend the most effort on Security Operations and Threats, Vulnerabilities, and Attacks.
3. Practice with scenarios. The exam leans on "given a scenario" questions and performance-based tasks, so passive reading is not enough.
4. Get hands-on. CompTIA's own sample equipment and software list includes Kali Linux, a SIEM, a vulnerability scanner, packet capture tools and cloud access, which gives a good idea of the skills expected.
5. Use legitimate study materials. CompTIA warns that candidates who use unauthorized materials risk having their certification revoked and being suspended from testing. Stick to official and reputable resources, and contact CompTIA if you are unsure about a source.

Frequently asked questions

How many questions are on Security+ SY0-801? Up to 90 questions, mixing multiple-choice and performance-based items, in 90 minutes.

What is the passing score? 750 on a scale of 100 to 900.

Who is the exam designed for? Security administrators with around two years of hands-on experience, although many people attempt it earlier with focused preparation.

Is AI really on the exam? Yes. The objectives include a dedicated objective on AI-related threats and vulnerabilities, and AI also appears in the automation objective.

When does SY0-801 launch? The objectives document does not state a date, so check CompTIA's website for the official launch and retirement schedule.

About the author: written by an instructor who holds Security+, CySA+, PenTest+ and SecurityX and has been delivering online IT security training for over 20 years.