CompTIA Security+ SY0-801 (V8) Exam Objectives
This page translates the official CompTIA Security+ SY0-801 (V8) objectives into clear, practical language. You’ll see what each domain covers, realistic task themes, and a focused study plan that turns objectives into repeatable labs, PBQs, and job-ready security skills.
The exam confirms your ability to support incident response, assess posture, secure modern environments (cloud/mobile/hybrid), operate with GRC awareness, and mitigate threats, vulnerabilities, and attacks.
Last updated: November 12, 2025. Always verify against the official CompTIA blueprint before your exam.
TL;DR: Security+ (V8) domains and weights: 1) General Security Concepts (16%) 2) Threats, Vulnerabilities, and Attacks (24%) 3) Security Architecture (19%) 4) Security Operations (27%) 5) Security Program Management & Oversight (14%)
Table of Contents
- What Is Covered on CompTIA Security SY0-801 (V8)?
- Objective-By-Objective Breakdown (with examples)
- Why Security+ for Early-Career Cyber Roles
- Study Plan: How to Master the SY0-801 Objectives
- Free Checklist & Next Steps
- Frequently Asked Questions
What Is Covered on CompTIA Security SY0-801 (V8)?
Security+ certifies you can: identify/interpret incident response activities; assess posture and apply appropriate controls; manage and monitor modern operating environments (cloud, mobile, hybrid); operate with governance, risk, and compliance awareness; and apply mitigation techniques for threats, vulnerabilities, and attacks.
Note
The wording below is learner-friendly. Map your prep directly to the official SY0-801 objectives before test day.
Objective-By-Objective Breakdown (with examples)
1) General Security Concepts — 16%
Focus: fundamentals you apply everywhere.
- Core principles: defense-in-depth, CIA triad, AAA, non-repudiation, Zero Trust, least privilege.
- Control categories/types: technical/managerial/physical/operational; preventive, deterring, corrective, detective, compensating, mitigating, directive.
- Change management impact: CAB approvals, impact analysis, stakeholders/ownership, test results, backout planning, fail-forward, maintenance windows, SOPs; technical implications (allow/deny lists, downtime, restarts, dependencies), documentation updates, and version control.
- Crypto essentials: PKI, CAs/CRLs/OCSP, certificate types (root/self-signed/third-party/wildcard), hashing, digital signatures, symmetric/asymmetric encryption, key exchange, levels (disk/file/volume/db/record), and common tools.
2) Threats, Vulnerabilities, and Attacks — 24%
Focus: understand actors, vectors, weaknesses, and patterns.
- Threats & vulns: threat intel sources, likelihood/impact, life cycle; CVE, CVSS/NVD, prioritization, vulnerability types.
- Actors & motives: APTs, crime syndicates, hacktivists, insiders, state-sponsored, accidental; motives include financial, IP, influence, notoriety, espionage, extortion, etc.; note sophistication/resources and internal/external origin.
- Vectors & sources: message-based (email/SMS/RCS/IM), image/QR/embedded, attachments (RTF/PDF/macros), browser-based (extensions/JS/cookies/tokens), network (infra/virtualized/remote access), endpoints (mobile/workstations/servers/tablets/trusted devices/LOLBins), supply chain (MSPs/SaaS), external media (malicious USB), human (impersonation/contractors/visitors/biometric), watering hole, IoT/OT, physical (locks, passes, vestibules), signal (Bluetooth/RF/NFC).
- Attack surfaces: unsupported/unpatched/obsolete/unmanaged systems; ports/services; app flaws (TOC/TOU race conditions, malicious updates), code issues (hardcoded secrets, unsafe exception handling), OS/virtualization, zero-days, crypto weaknesses, stale credentials, rogue devices.
3) Security Architecture — 19%
Focus: design secure, resilient systems.
- Network/security components and placement (firewalls, proxies, WAF, IDS/IPS, VPN, NAC, API gateways, taps/collectors, CDN) and availability patterns (load balancing, recoverability, interoperability, geo considerations, scaling, persistence).
- Secure SDLC & assurance: requirements (functional vs. non-functional), SAST/DAST/IAST/RASP, vuln analysis, SCA/SBOM, CI/CD testing (canary/regression/integration/unit).
- Data protection & classifications: labeling/tagging, DLP (at rest/in transit/discovery), centralized logging/continuous monitoring/alerting, sensor placement, hybrid/cloud integrations, and measuring control effectiveness. (Maps closely to how Security+ frames architecture choices.)
4) Security Operations — 27%
Focus: monitoring, analysis, response, and continuous improvement.
- Monitoring & analytics: SIEM parsing/duplication, missing data sources, retention, reducing false positives/negatives; correlation, audit-log reduction, prioritization, and trend analysis; baselines for network/systems/users/apps.
- Multi-source inputs: vuln scans, CVEs, third-party intel, DLP, endpoint/infrastructure/app logs, CSPM; alerting by criticality/impact/asset type/residual risk/data classification/malware/vulns; clear reporting.
- Vulnerabilities & mitigations: injection/XSS/CSRF/SSRF, unsafe memory use, race conditions, insecure configs, embedded secrets, deprecated functions, third-party risks, TOCTOU, deserialization, weak ciphers, confused deputy, implants; mitigations include input validation, output encoding, safe/memory-safe/atomic functions, patching OS/hypervisor/firmware, least privilege/functionality, defense-in-depth, dependency mgmt, code signing, encryption, allow-listing.
- Threat hunting & intel: UBA, adversary emulation, hypothesis-based searches, honeypots/honeynets; OSINT/dark web/ISACs; TIPs/vendors; STIX/TAXII; detection languages (Sigma/YARA/Snort/Rita); TTP-driven analysis.
- IR & forensics: detonation & IoC extraction, sandboxing, stylometry/variant matching/similarity; disassembly/decompilation; volatile/non-volatile storage, network/host analysis, metadata; data recovery/extraction; exercises, timeline reconstruction, root cause.
5) Security Program Management & Oversight — 14%
Focus: governance, risk, compliance, and program hygiene.
- Governance components: policies/standards/procedures/guidelines, awareness & training; frameworks and audits (e.g., ISO 17024 accreditation note, ongoing objective reviews), and program oversight.
- Risk & compliance awareness: appetite, prioritization, third-party/supply chain, BCDR, privacy; operate under applicable regs/policies while maintaining documentation and evidence. (Security+ emphasizes operating with GRC awareness across the lifecycle.)
Why Security+ for Early-Career Cyber Roles
SY0-801 validates practical breadth across architecture, operations, incident response, and GRC—perfect for roles like security administrator, SOC analyst (tier 1), systems/network admin with security duties, or junior risk/compliance associate. It’s also a common baseline for further paths (CySA+, PenTest+, SecurityX).
Study Plan: How to Master the SY0-801 Objectives
- Build an “evidence-first” lab
Deploy a small lab with a firewall/WAF, IDS/IPS, VPN, and SIEM. Add logging from endpoints, network devices, and cloud. For every control, keep proof (configs, screenshots, logs) and a rollback plan. This directly maps to PBQs. - Practice change + crypto fundamentals
Run a mini change process (CAB → impact analysis → test → backout plan → maintenance window). Generate a CSR, issue a cert, test OCSP/CRL behavior, and verify TLS on a service. - Threats & hunting reps
Simulate a phishing + QR campaign and a browser-based vector (malicious extension). Hunt the artifacts (headers, macros, LOLBins, registry/filesystem changes, DNS). Document indicators and write a Sigma or YARA rule. - Vulnerability → mitigation drills
Pick three vulnerability classes (e.g., TOC/TOU, hardcoded secrets, weak ciphers). Show the issue, fix it, and capture before/after evidence (linter/scan results, config diffs). - Governance habits
Create a short policy page (passwords, logging retention, change, acceptable use) and a risk register entry for one third-party SaaS. Tie every control to a control type/category so you can explain “why this control here.”
