Exam sources checked: . See source versions and claim types.
The CompTIA Security+ SY0-801 exam objectives cover five areas: security concepts, threats and attacks, architecture, operations, and program management and oversight. Security Operations has the largest weight at 27%. Use the domain table below to plan your attention, then use the individual objectives to decide what you can explain and apply.
This guide follows CompTIA’s official objectives PDF, version 2.0, checked November 7, 2026. The examples and practice activities below are original learning exercises, not actual exam questions. Keep the official document alongside your notes and check for updates before booking.
SY0-801 domain weights at a glance
| Domain | Exam weight | Your learning question |
|---|---|---|
| 1. General Security Concepts | 16% | Why is this protection appropriate? |
| 2. Threats, Vulnerabilities, and Attacks | 24% | What could go wrong, and what evidence supports that? |
| 3. Security Architecture | 19% | How should the environment be designed? |
| 4. Security Operations | 27% | What should the security team do next? |
| 5. Security Program Management and Oversight | 14% | Who owns the decision, and how is it documented? |
Domain names and percentages: CompTIA’s official objectives PDF (page 3). Learning questions: Trifectapp’s study interpretation.
The percentages describe blueprint emphasis; they are not a promise that your test will contain a particular number of questions on a topic. Start with broad coverage, then spend extra time where your explanations and practice results show gaps.
Domain 1: Build the security foundations
Official scope: Controls, safe change processes and cryptographic protections. See objectives 1.1–1.3 in the official PDF.
Understand: Connect a safeguard to the problem it solves. A locked cabinet can limit physical access; an access log can help establish who opened it. Both are useful, but they serve different purposes. Avoid treating every security tool as interchangeable protection.
Apply: Imagine a business replacing its remote-access gateway. Write down who approves the change, how it will be tested, when the work happens and how service can be restored if it fails. Security includes preserving availability during an improvement.
Practice: Make a three-column page: business requirement, proposed protection and reason. Include a confidential document, a downloaded software package and a website identity check. Explain why encrypting information, checking a digest and validating a certificate answer different questions.
Checkpoint: Can you explain your choice without relying on an acronym? If you can only name the technology, revisit its purpose before memorizing another list.
Domain 2: Recognize threats and interpret evidence
Official scope: Adversaries, attack routes, weaknesses, malicious indicators and AI-related risks. See objectives 2.1–2.6 in the official PDF.
Understand: Separate the weakness from the event. An exposed administrative interface is a condition that creates risk. An unauthorized sign-in is an event requiring investigation. A useful answer identifies what the evidence establishes and what remains uncertain.
Apply: A user receives a message directing them to scan a QR code to retain account access. Identify the trust claim, destination and requested action. Explain why a familiar logo does not establish that the destination is legitimate.
Practice: Read a short fictional incident and highlight three things: the possible entry point, the observed behavior and the evidence you would request next. Avoid jumping from one unusual event to a confident conclusion about the attacker.
For AI scenarios, ask whether the problem concerns instructions, data or an unreliable answer. For example, an assistant treating hostile text inside a retrieved document as an instruction illustrates an indirect prompt-injection risk. A convincing answer still needs verification.
Domain 3: Design protection into the environment
Official scope: Infrastructure choices, protected access, data safeguards and recoverability. See objectives 3.1–3.4 in the official PDF.
Understand: Start with the requirement and constraints. A system serving public customers has different access needs from an internal payroll database. Moving either one to another hosting environment does not remove the need to define who may reach it.
Apply: Sketch a small company with a public website, a staff application and a database. Draw only the connections each service needs. Describe how an unnecessary connection could let a problem in one system affect another. Use the ports and protocols reference when checking the service, transport and direction required by each connection.
Practice: Give the company two recovery requirements: service must return within four hours, and no more than one hour of recent data can be lost. Propose a backup and restoration approach, then explain how you would demonstrate that it meets both requirements.
Checkpoint: Can you defend a design in terms of exposure, business continuity and operational effort? A diagram becomes useful when you can explain the decisions behind it.
Domain 4: Turn security knowledge into action
Official scope: Defensive controls, assets, vulnerabilities, monitoring, identity, automation and incident work. See objectives 4.1–4.8 in the official PDF.
Understand: An alert begins a decision process. Establish what happened, which systems and users are involved, and which response fits the evidence. A high-volume alert can be less urgent than a quieter event affecting a sensitive system.
Apply: A staff account signs in unusually and starts downloading files it rarely accesses. Outline what you would check, who should be involved and how an authorized response could limit further exposure while preserving useful evidence.
Practice: Build a timeline from fictional authentication, endpoint and file-access records. Record timestamps consistently, distinguish observations from assumptions, and write a concise handover another analyst could continue. For a runnable starting example, work through the synthetic login-record timeline lab and keep its output with your evidence notes.
Also practice the end of a workflow: after fixing a weakness, explain how to verify the fix. After removing a departing employee’s account, consider remaining sessions and other assigned access. Completing a task requires evidence that the intended outcome occurred.
Domain 5: Explain business decisions and accountability
Official scope: Security documentation, risk, suppliers, compliance, assessment and awareness. See objectives 5.1–5.6 in the official PDF.
Understand: A technical recommendation needs an owner and a business reason. “Install a tool” is incomplete unless the team understands the risk, expected benefit, cost and responsibility for keeping the protection effective.
Apply: A department wants a new file-sharing supplier. Write five questions about the information being shared, permitted users, supplier assurance, incident notification and how data will be recovered or removed when the relationship ends.
Practice: Create a fictional risk-register entry with a risk description, likelihood, impact, owner, proposed treatment and review date. Then explain why accepting a risk should be an informed, recorded decision by the appropriate authority.
Checkpoint: Can you distinguish the rule a company sets, the steps someone follows and the evidence showing those steps occurred? That distinction makes document-heavy scenarios easier to interpret.
Turn the objectives into a usable study checklist
- Track understanding: Mark each objective as unfamiliar, explainable or demonstrated. Reading a lesson alone does not establish mastery.
- Add one example: Write an original workplace situation for each subject you review.
- Record the reason for mistakes: Separate missing knowledge from misreading a requirement or choosing the wrong sequence.
- Mix topics: Revisit older material alongside new lessons so that recognition does not depend on the chapter title.
- Retest with fresh tasks: Explain a new scenario after a gap, without checking notes first.
Begin with the free SY0-801 practice questions, then map missed concepts back to your checklist. Explore the Trifectapp Security+ V8 course for a structured preparation route. For launch information, read the SY0-801 release-date guide.
Original Trifectapp study tool
Build an objective-by-objective evidence record
Use the official objectives as your reference, then record what you have actually explained, practiced or produced. This tracker covers all 27 objective IDs in the SY0-801 V8 objectives document, version 2.0.
Keep the official wording beside you. This tool lists the IDs and domain names, not the complete objective text or every subtopic. Open the official CompTIA objectives PDF (SY0-801 V8, version 2.0) to decide what each entry must cover.
No account is required. Entries stay in this page session and are not saved automatically. Export a CSV before leaving or reloading. This tracker does not transmit your entries or use browser storage.
Give each status a concrete meaning
- Not started: I have not yet checked this objective against the official wording.
- Reviewing: I am learning it and collecting examples.
- Needs practice: a task or explanation exposed a specific gap.
- Demonstrated: I can point to evidence from a fresh task or explanation, with limitations noted.
These are your own study labels. One example rarely covers every subtopic, and “Demonstrated” does not certify mastery or predict an exam result.
Worked example: make evidence specific
Objective 1.1 · Needs practice. “In a fictional support-team scenario, I explained why only assigned staff should view a sensitive ticket. I justified the access restriction, but confused the purpose of the access log.”
Next action: “Write two separate explanations: who may open the ticket, and what the log helps an investigator establish. Revisit the full objective wording and identify the other concepts I have not demonstrated.”
This original example shows how to record a gap. It is not an official assessment or a complete answer to objective 1.1.
Not started: 27 · Reviewing: 0 · Needs practice: 0 · Demonstrated: 0. These are your own labels, not a readiness score.
Domain 1 · General Security Concepts (3 objectives)
Objective 1.1
Objective 1.2
Objective 1.3
Domain 2 · Threats, Vulnerabilities, and Attacks (6 objectives)
Objective 2.1
Objective 2.2
Objective 2.3
Objective 2.4
Objective 2.5
Objective 2.6
Domain 3 · Security Architecture (4 objectives)
Objective 3.1
Objective 3.2
Objective 3.3
Objective 3.4
Domain 4 · Security Operations (8 objectives)
Objective 4.1
Objective 4.2
Objective 4.3
Objective 4.4
Objective 4.5
Objective 4.6
Objective 4.7
Objective 4.8
Domain 5 · Security Program Management and Oversight (6 objectives)
Objective 5.1
Objective 5.2
Objective 5.3
Objective 5.4
Objective 5.5
Objective 5.6
Clear every entry? This removes all statuses, evidence and next actions from this session. Export first if you want to keep them.
Choose your next study session
- Find one entry marked Needs practice, or choose an objective you have not started.
- Read the complete objective and choose one small task that will expose your current understanding.
- Keep the output, explain why it is correct, and record any remaining uncertainty.
- Revisit it later using a different example. Update the evidence and your next action.
If every entry says “Demonstrated,” check the underlying examples for missing subtopics and repeat a varied selection after a gap. The labels alone are not a reason to book the exam.
Keep your evidence outside the browser
Download the objective evidence tracker ZIP with the offline tracker, a blank 27-row CSV, evidence-writing prompts and instructions. The offline tracker works without an account or internet connection; the official PDF link needs internet access.
Original Trifectapp tracking workflow. Objective identifiers and domain names reference CompTIA’s SY0-801 V8 objectives document, version 2.0. This independent study aid does not reproduce the complete objectives or official exam questions. Activity version 1.0.
SY0-801 objectives: frequently asked questions
Where should I download the official objectives?
Use CompTIA’s PDF linked above and the official V8 page. Keep a copy with your study notes and check whether CompTIA has published a newer revision.
Should I study the highest-weighted domain first?
Not necessarily. If the foundations are weak, later scenarios become harder. Build the basics, cover the full syllabus and use your performance to decide where to invest additional time.
Is reading the objectives enough to prepare?
No. Treat the document as your scope checklist. Add explanations, original questions and practical work that require you to choose, justify and verify an action.
Can I skip topics that feel less technical?
That creates avoidable gaps. Practice business decisions with the same care as technical tasks: identify the requirement, select the appropriate response and explain your reasoning.
Sources, versions and claim types
Exam-source check: November 7, 2026. Exam version SY0-801 / V8 and objectives revision 2.0 identify different things. The official PDF, page 3 supplies the five domain weights. The linked domain sections support the scope summaries; the tracker follows its 27 objective IDs.
- Official scope: use the complete CompTIA document for the objective wording and subtopics. The short summaries and tracker do not reproduce the entire syllabus.
- Technical explanation: OpenAI’s prompt-injection explanation (November 7, 2025) supports the distinction between untrusted retrieved text and an instruction the assistant should follow; it does not define CompTIA exam requirements.
- Trifectapp guidance: the learning questions, fictional situations, evidence labels and suggested tasks are our teaching interpretation. A completed tracker does not predict a certification result.