About the SY0-801 Exam · Security+

This chapter covers the practical details of the exam itself: its format, its scoring, how it differs from the previous version, how to register, and how to keep your certification current once you pass. The Exam at a Glance

Item Detail
Exam code SY0-801 (Security+ V8)
Launch date November 17, 2026 (English)
Number of questions Maximum of 90

Question types Multiple-choice (single and multiple response) and performance-based Time limit 90 minutes

Passing score 750 on a scale of 100–900

Recommended experience Security administrator with about two years of hands-on experience Accreditation ISO/IEC 17024, accredited through ANAB

Expected retirement Approximately three years after launch
Delivery Pearson VUE test centers and online proctored testing
Domains and Weighting

The exam weighting tells you roughly how many questions to expect from each domain. On a 90- question exam, the approximate distribution is shown below. The actual number varies slightly from exam to exam, and some questions draw on more than one domain.

Domain Weight Approx. Questions

(of 90)

1.0 General Security Concepts 16% 14

2.0 Threats, Vulnerabilities, and Attacks 24% 22

3.0 Security Architecture 19% 17

4.0 Security Operations 27% 24

5.0 Security Program Management and Oversight 14% 13

Security Operations is the largest domain, and together Domains 2 and 4 account for just over half the exam. These two domains are also where most scenario-based and performance-based questions come from, because they focus on recognizing attacks and responding to them. Do not neglect the smaller domains, however. Domain 1 contains foundational material (controls and cryptography) that appears indirectly throughout the exam, and Domain 5 questions are often among the easiest points to earn if you have studied the definitions.

Question Types

Multiple-Choice Questions

Most questions are multiple choice. Some have a single correct answer; others ask you to choose two or three correct answers ("Select TWO"). Multiple-response questions tell you how many answers to select. There is generally no partial credit on multiple-response items, so read every option carefully. Many SY0-801 multiple-choice questions are scenario-based. Rather than asking "What is a honeypot?", a question might describe an organization that wants to observe attacker techniques without exposing production systems and ask which solution best meets that goal. To answer these questions you must understand what each control does, not just its definition.

Performance-Based Questions

Performance-based questions (PBQs) ask you to perform a task in a simulated environment. Common PBQ formats include:

Drag-and-drop matching — for example, matching attack types to their descriptions, or controls to the categories they belong to.
Configuration tasks — for example, ordering firewall rules, placing security devices on a network diagram, or selecting settings for a wireless network.
Log and output analysis — for example, reviewing firewall logs, authentication logs, or vulnerability scan output to identify an attack or a misconfiguration.
Ordering tasks — for example, placing incident response steps or certificate enrollment steps in the correct sequence.

PBQs usually appear at the beginning of the exam. They are worth more than a single multiple-choice question, but they can consume a lot of time. A widely recommended strategy is to flag the PBQs, skip them, complete the multiple-choice questions, and then return to the PBQs with the time remaining. This guide's PBQ Workshop walks through representative examples.

Scoring

CompTIA uses a scaled scoring model. Your raw score is converted to a scale of 100 to 900, and you need 750 to pass. Because the score is scaled, you cannot convert 750 directly into a percentage; different exam forms may have slightly different difficulty, and the scaling compensates for that. Some questions on your exam may be unscored items that CompTIA is evaluating for future use, and you will not know which ones they are. Treat every question as if it counts.

There is no penalty for wrong answers. Never leave a question blank: if you are unsure, eliminate what you can and choose the best remaining option.

How SY0-801 Differs From SY0-701

SY0-701 launched in November 2023. SY0-801 keeps the same five-domain structure and the same overall format, but it rebalances the domains, renames Domain 2, consolidates some objectives, and adds significant new content—most notably on artificial intelligence.

Domain Weighting Changes

Domain SY0-701 SY0-801 Change

1.0 General Security Concepts 12% 16% +4

2.0 Threats, Vulnerabilities, and Mitigations (701) / Attacks (801) 22% 24% +2

3.0 Security Architecture 18% 19% +1

4.0 Security Operations 28% 27% −1

5.0 Security Program Management and Oversight 20% 14% −6

The biggest shift is the reduction of Domain 5 from 20 percent to 14 percent and the corresponding increase in Domains 1 and 2. The exam has moved its emphasis further toward technical understanding of threats and controls.

Structural Changes

Domain 2 is renamed from "Threats, Vulnerabilities, and Mitigations" to "Threats, Vulnerabilities, and Attacks." The mitigation content that had its own objective in SY0-701 has been folded into Domain 4, where objective 4.1 now asks you to apply mitigating controls, techniques, and solutions in a scenario.
Domain 1 has three objectives instead of four. Security controls and fundamental security concepts (CIA, AAA, Zero Trust, and so on) are combined into a single objective, 1.1.
Domain 2 now has six objectives, including a new objective, 2.1, on the characteristics of threats and vulnerabilities (threat intelligence, CVSS scoring, CVE, and prioritization) and a new objective, 2.6, devoted entirely to AI-related threats.
Domain 4 has eight objectives instead of nine. Enterprise security capabilities (firewalls, IDS/IPS, filtering, email security, EDR/XDR) are consolidated into objective 4.1.
In total, SY0-801 has 27 objectives (3 + 6 + 4 + 8 + 6), compared with 28 in SY0-701.

Content to Pay Special Attention To

The following topics are either new to the Security+ objectives or are given explicit, prominent treatment in SY0-801. Expect them to be tested, and do not rely on older study materials for them.

Artificial intelligence threats (2.6): model manipulation, data poisoning, prompt injection, jailbreaking, evasion, hallucinations, bias, explainability, AI privacy and data loss, ethical considerations, and AI-related session hijacking and code execution.
Large language models as an attack surface (2.4) and AI in security operations (4.6): agentic AI, chatbots, predictive analysis, and AI-augmented baselines.
Expanded threat vector categories (2.3): message-based (including RCS and collaboration tools), image-based (QR codes, CAPTCHA abuse), browser-based (extensions, session tokens, password managers), living-off-the-land tools, IoT, OT, physical, and signal-based vectors.
Credential attacks (2.5): user enumeration, password spraying, replay, and MFA bypass, along with quishing and deepfakes as social engineering techniques.
Modern identity concepts: Group Managed Service Accounts (gMSAs), privilege creep, Security Service Edge (SSE), passkeys and passwordless authentication, emergency ("break-glass") accounts, and just-in-time access.
Third-party vendor selection (5.3): RFP, RFI, RFQ, and EOI processes, plus agreement types such as SLO and MSA.
Compliance training topics (5.4): anti-money laundering/counter-terrorism financing and anti-bribery training, and expanded privacy rights.
Incident response (4.7): explicit coverage of negotiation (for example, during ransomware incidents) and post-incident reporting.

Registering for the Exam

You purchase an exam voucher from CompTIA (or through an authorized partner or training provider) and schedule your exam with Pearson VUE. You can test at a Pearson VUE test center or online through Pearson's remote proctoring service. CompTIA had not published SY0-801 pricing at the time this guide was written, so check the CompTIA store for current pricing and any bundle offers that include a retake voucher.

If you choose online testing, review the technical and room requirements well in advance: you will need a private room, a clear desk, a webcam, a reliable internet connection, and a computer that passes Pearson's system test. Online exams can be ended by the proctor if your environment does not meet the rules, so do a full system check a few days before.

CompTIA's retake policy has historically allowed a second attempt with no waiting period and required a waiting period of at least 14 days before a third or subsequent attempt. Confirm the current retake policy on the CompTIA website before you schedule, because policies can change.

Should You Take SY0-701 or SY0-801?

When a new exam version launches, the previous version typically remains available for a period of months before it retires. Both versions lead to the same certification: your certificate will say CompTIA Security+, and it is valid for three years from the date you pass, regardless of which exam version you took.

As a rule of thumb, if you are already well into studying for SY0-701 and can test before it retires, finishing on SY0-701 is reasonable. If you are starting now, or if your realistic exam date falls well after SY0-801 launches, study for SY0-801. This guide is written for SY0-801, but because most of the material overlaps, it is also useful preparation for SY0-701 apart from the version-specific differences noted above. Check the CompTIA website for the official SY0-701 retirement date.

Keeping Your Certification Current

Security+ is valid for three years. You can renew it through CompTIA's Continuing Education (CE) program by earning continuing education units (CEUs) through activities such as training, industry work experience, and higher-level certifications, or by completing CompTIA's CertMaster CE course for Security+. Passing certain higher-level CompTIA certifications also renews Security+. Your CE requirements and fees are listed in your CompTIA account after you pass.