CompTIA Security+ Study Guide (SY0-801)

CompTIA Security+ is one exam. SY0-801 (V8) has a launch date of November 17, 2026, and SY0-701 stays bookable in English until June 11, 2027; both earn the same certification. The exam has up to 90 questions in 90 minutes and passes at 750 on a 100–900 scale. This guide maps every SY0-801 domain, gives you a study path, and points you to free practice for each part.

How the Security+ exam works

One exam earns the certification. It mixes multiple-choice questions with performance-based questions (PBQs), the hands-on tasks where you configure, place or fix something instead of picking an answer. More of SY0-801's objectives ask you to apply a concept to a scenario rather than recall it, so practice with scenarios, not definitions alone. Not sure which version to take? See SY0-701 or SY0-801?.

Everything on the exam: the 5 domains

Each domain's weight is its share of the exam, so spend your time in proportion. The SY0-801 objectives overview breaks every domain into its objectives and marks the scenario ones.

What each domain covers:

• 1.0 General Security Concepts: Core security concepts, and the categories and types of controls; How change management protects security, applied to real changes; Choosing the right cryptography: PKI, certificates, encryption, and hashing.
• 2.0 Threats, Vulnerabilities, and Attacks: What makes a threat or vulnerability serious: intelligence, CVE, and CVSS; Threat actors and what drives them; Threat vectors, from phishing messages to the supply chain; Vulnerability types and attack surfaces, including AI models and the cloud; Reading the signs of malware, network, credential, and social engineering attacks; Threats that come with using AI.
• 3.0 Security Architecture: Security trade-offs of cloud, on-premises, OT, and air-gapped designs; Managing the architecture: zones, Zero Trust, secure access, and identity; Protecting data: types, classifications, methods, and data roles; Resilience and recovery: sites, redundancy, backups, and recovery metrics.
• 4.0 Security Operations: Putting controls in place, from hardening to firewalls and email security; Tracking every asset, from purchase to disposal; Running vulnerability management: find, prioritize, fix, verify, report; How security monitoring and alerting work, and the tools behind them; Identity and access management in practice; Automation, orchestration, and AI in security operations; Incident response, from preparation to post-incident review; Using logs, captures, and other evidence in an investigation.
• 5.0 Security Program Management and Oversight: Governance documents: policies, standards, procedures, and plans; The risk management process; Assessing and managing third-party risk; Security compliance, privacy, and legal obligations; Audits, assessments, penetration tests, and threat frameworks; Running a security awareness program.

A study path that works

• Learn one domain at a time. Start with General Security Concepts: the controls, cryptography and change-management ideas there come back in every other domain.
• Drill the acronyms early. Security+ leans on hundreds of acronyms, and a question you can't decode is a question you can't answer. The free SY0-801 acronym trainer drills all 106.
• Practice PBQs as you finish each domain. Firewall rules, placing security devices on a network and hardening a server are tasks you have to do, not recall, so do them as you go rather than saving them for the end.
• Finish with full practice exams. Take full-length timed exams, review every miss, and drill your weak objectives until your scores sit above the passing line.

Practice the hands-on part

PBQs usually come first on the exam and take the most time. ExamWizardz has free Security+ PBQs and hands-on Security+ labs you can play in the browser with no account: writing firewall rules, triaging overnight SOC alerts, hunting malware persistence and hardening a Linux web server.

Free study materials for every stage

• A free SY0-801 practice test with a 10-question test for every section
• Free Security+ PBQ practice and Security+ lab sims
• The SY0-801 objectives in plain language, and what changed from SY0-701
• The SY0-801 acronym trainer
• A glossary of CompTIA terms

A free ExamWizardz account adds the first 4 sections of the Security+ course (lessons, articles and PBQs), unlimited section quizzes there, every flashcard deck, and a full mock exam each month.

Are you ready to book?

• You have studied and practiced every domain, weighted by its share of the exam.
• Your full practice exam scores sit consistently above 750.
• You have practiced PBQs, not just multiple choice.
• You can expand the acronyms on sight.