Free Security+ study kit

Security+ SY0-801: what changed, and a four-week plan for V8

CompTIA Security+ V8 (SY0-801) is expected on or around 17 November 2026. Same format and pass mark as SY0-701, but different domain weights, a new objective on AI threats and a reworked incident response process. Here is what changed, a four-week plan weighted for V8 and a one-page review sheet you can print.

Start with the free diagnostic

SY0-701 or SY0-801?

ItemSY0-701 · V7SY0-801 · V8
Exam codeSY0-701 (V7)SY0-801 (V8)
AvailableSince 7 November 2023Expected on or around 17 November 2026
English retirement11 June 2027Estimated three years after launch
FormatUp to 90 questions, 90 minutes, pass at 750 (100–900)Up to 90 questions, 90 minutes, pass at 750 (100–900)
Domain weights (1 → 5)12 · 22 · 18 · 28 · 20 %16 · 24 · 19 · 27 · 14 %

If you are already studying and can sit the exam before June 2027, stay on SY0-701: CompTIA itself says V7 "remains a strong option". If you are starting from zero and booking late next year, plan for SY0-801, which adds coverage of AI-related risks. The five domains keep the same order in both versions, so most of the work carries over. CertSprint's question bank is mapped to SY0-701.

Checked 2 November 2026 on CompTIA Security+ V7 (SY0-701) and CompTIA Security+ V8 (SY0-801).

What changed from SY0-701

  • Weights moved: General Security Concepts 12 → 16 %, Threats 22 → 24 %, Architecture 18 → 19 %, Operations 28 → 27 %, Program Management 20 → 14 %.
  • Domain 2 is now "Threats, Vulnerabilities, and Attacks" (it was "…and Mitigations").
  • New objective 2.6 on AI threats: model manipulation, poisoning, prompt injection, data loss, bias, explainability, hallucinations, jailbreaking, evasion, privacy, ethics, session hijacking and code execution.
  • AI also appears in automation (4.6): agentic AI, chatbots, predictive analysis and AI-augmented baselines.
  • Incident response (4.7) is reorganised: preparation, identification, investigation, containment, negotiation, eradication/recovery, notification/external reporting, post-incident.

Source: CompTIA SY0-801 exam objectives (PDF, v2.0), checked 2 November 2026.

The plan

Four weeks, weighted by the exam

Plan on about an hour on weekdays. If a checkpoint fails, give that week a few more days: the weights tell you where extra time pays off most.

  1. Week 1 · The vocabulary, now worth more

    General Security Concepts · 16% of the exam · 83 SY0-701 practice questions on the matching domain

    • Take the free diagnostic first: most of SY0-701 carries over, so it still shows where you stand.
    • Defense in depth, CIA, AAA, non-repudiation, zero trust principles and least privilege (1.1).
    • Change management (1.2) and cryptographic solutions: PKI and key escrow, certificates, encryption levels, signatures, salting and hashing (1.3).

    Checkpoint: You can classify any control by category and by type, using the V8 names.

  2. Week 2 · Threats, including AI

    Threats, Vulnerabilities, and Attacks · 24% of the exam · 118 SY0-701 practice questions on the matching domain

    • Threat actors and motivations, threat vectors and sources, vulnerability types and attack surfaces (2.2–2.4).
    • Indicators of malicious activity, including deepfakes and protocol downgrade (2.5).
    • The new AI objective (2.6): for each item on the sheet, say what goes wrong and what limits it.

    Checkpoint: You can explain prompt injection, poisoning and jailbreaking without mixing them up.

  3. Week 3 · Architecture, then governance

    Security Architecture · 19% of the exam · 106 SY0-701 practice questions on the matching domain + Security Program Management & Oversight · 14% of the exam · 104 SY0-701 practice questions on the matching domain

    • Architecture models across cloud, hybrid, on-premises and operational technology (3.1–3.2).
    • Data types, states and classifications, and the methods on the sheet (3.3); resilience and the recovery metrics (3.4).
    • Governance artifacts, risk management, third-party risk, compliance, audits and awareness (5.1–5.6).

    Checkpoint: You can say which asset a control protects and which policy or role requires it.

  4. Week 4 · Operations, then a full timed run

    Security Operations · 27% of the exam · 135 SY0-701 practice questions on the matching domain

    • Mitigating controls, asset management, vulnerability management, monitoring and identity, including passkeys (4.1–4.5).
    • Automation and orchestration with AI (4.6), and the new incident response order on the sheet (4.7).
    • End the week with a timed run: 90 questions in 90 minutes, then review every miss by domain.

    Checkpoint: No domain is far below the others. Fix the weakest one before you book.

One-page review sheet · SY0-801

Insecure protocol → secure replacement

InsecureUse instead
Telnet · 23SSH · 22
FTP · 20/21SFTP · 22 (over SSH) or FTPS · 989/990
HTTP · 80HTTPS · 443
LDAP · 389LDAPS · 636
SNMP v1/v2c · 161/162SNMPv3 · 161/162 (adds authentication and encryption)
POP3 · 110POP3S · 995
IMAP · 143IMAPS · 993
SMTP · 25SMTPS · 465, or submission · 587 with STARTTLS
DNS · 53DNSSEC (integrity and origin, not confidentiality)

Controls: two separate axes

Categories
Technical/logical · Managerial/administrative · Physical/environmental · Operational
Types
Preventive · Deterring · Corrective · Detective · Compensating · Directive
Example
A firewall rule is technical and preventive; a security camera is physical and detective (deterring when visible).

Protecting data: is it reversible?

Encryption
Reversible with the key.
Hashing
One-way. Proves integrity; salted for stored passwords.
Tokenization
Value replaced by a token; the original lives in a separate vault.
Masking
Hides part of the value when displayed (•••• 4821).

Incident response, in order

  1. Preparation
  2. Identification
  3. Investigation
  4. Containment
  5. Negotiation
  6. Eradication/recovery
  7. Notification/external reporting
  8. Post-incident

AI threats (objective 2.6)

Model manipulation · Poisoning · Prompt injection · Data loss · Bias · Explainability · Hallucinations · Jailbreaking · Evasion · Privacy · Ethical considerations · Session hijacking · Code execution

Recovery metrics

RPO
How much data you can afford to lose, measured in time.
RTO
How long until the service must be back.
MTTR
Average time to repair.
MTBF
Average time between failures.

getcertsprint.com · CompTIA Security+ SY0-801

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. No account or card needed; create a free account only to keep your progress on every device.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

Practise each week's domain

546 Security+ questions mapped to SY0-701. Most of the content carries over to SY0-801; the new AI objective (2.6) is not in the bank yet. The first 20 are free.

Start free