In this guide: at a glance · release date · exam format · passing score · objectives and topics · SY0-701 vs SY0-801 · study time · study plan · practice tests · how to pass
Security+ SY0-801 at a glance
| Item | Details |
|---|---|
| Exam code | SY0-801 (Security+ V8) |
| Release date | November 17, 2026 |
| Questions | Maximum of 90, multiple-choice and performance-based |
| Length | 90 minutes |
| Passing score | 750 on a scale of 100–900 |
| Recommended experience | Security administrator with two years of hands-on experience |
| Where to take it | At a Pearson VUE test center or online |
| Exam cost | Check the current voucher price on CompTIA's website |
Security+ is CompTIA's core cybersecurity certification. It is a defensive exam: you are asked how to recognize a threat, reduce risk and respond when something goes wrong, not how to break into systems. In short, someone who passes knows how to take part in handling an incident, check how well an organization is protected and suggest improvements, look after systems in the office, in the cloud and on phones, follow the company's policies and risk rules, and reduce the impact of common attacks.
SY0-801 release date
CompTIA releases Security+ V8, exam code SY0-801, on November 17, 2026. It replaces SY0-701. Until that date, SY0-701 is the only version you can sit, and CompTIA keeps it available for a while after V8 launches.
Which one should you take? If your timeline allows it, go for SY0-801: it is the version that will stay current the longest, and studying only from SY0-701 material leaves gaps in the new topics. If you need the certification before mid-November, SY0-701 is still a valid choice, and most of what you study carries over.
Security+ exam format
You get up to 90 questions in 90 minutes, in two types:
- Multiple-choice. Some have a single answer, others ask you to pick two or three. The hardest are scenario questions that ask for the BEST, FIRST or MOST likely action: several options are technically correct, but only one fits that moment in the process.
- Performance-based questions (PBQs). Instead of choosing a letter, you complete a task: put the steps of a process in order, match concepts, sort items into categories or work in a simulated environment.
With roughly a minute per question on average, time management matters. PBQs take several times longer than a multiple-choice question, so many candidates flag them and come back at the end. Formats, examples and timing strategies are covered in the guide to Security+ and Linux+ PBQs.
Security+ passing score
The passing score is 750 on a scale of 100 to 900. It is a scaled score, not a percentage, so 750 does not translate to "getting 75% right" or any fixed number of questions. What you can control is the margin: aim to score well above 750 on full-length, timed practice tests before you book the real exam.
Security+ exam objectives and topics
The SY0-801 objectives are split into five domains. The weight is the share of the exam that comes from each one:
| Domain | Weight | Key topics |
|---|---|---|
| 1.0 General Security Concepts | 16% | Control categories and types, CIA, AAA, non-repudiation, Zero Trust, least privilege, change management, PKI, certificates, encryption, digital signatures, hashing and salting |
| 2.0 Threats, Vulnerabilities, and Attacks | 24% | Threat actors and motivations, threat vectors, vulnerability types and attack surfaces, indicators of malicious activity, AI-related threats |
| 3.0 Security Architecture | 19% | Cloud, hybrid, IaC, OT and microservice architectures, secure remote access, data protection, resilience and recovery |
| 4.0 Security Operations | 27% | Hardening, asset and vulnerability management, alerting and monitoring, identity and access management, automation, incident response and investigations |
| 5.0 Security Program Management and Oversight | 14% | Policies, standards and procedures, risk management, third-party risk, compliance and privacy, audits and security awareness |
Domains 4 and 2 make up 51% of the exam, so that is where most of your hours should go. Domain 4 is the most hands-on: firewalls and WAFs, IDS/IPS, EDR/XDR, email security (SPF, DKIM, DMARC), SIEM and log monitoring, SSO, SAML, OAuth, MFA and passkeys, and the full incident response process. Domain 2 is heavy on scenarios: you see indicators such as impossible travel, concurrent sessions or log manipulation and decide what is happening.
Domain 5 carries less weight, but its risk calculations (SLE, ALE and ARO) are easy points once you have practiced the formulas. In domain 1, cryptography is about judgment rather than math: when to use symmetric or asymmetric encryption, what a digital signature proves, CRL versus OCSP.
The objectives document also includes an acronym list that CompTIA recommends knowing. Turn it into flashcards early: acronyms show up everywhere, unexplained.
SY0-701 vs SY0-801: what changed
CompTIA does not publish V8 as a list of differences, but reading the objectives side by side, four changes stand out:
- AI gets its own objective. Objective 2.6 covers threats and vulnerabilities tied to the use of AI: model poisoning and manipulation, prompt injection, jailbreaking, evasion, data leakage, bias, hallucinations and privacy. LLMs also appear as an attack surface in 2.4, and on the defensive side, 4.6 includes agentic capabilities, chatbots, predictive analytics and AI-augmented baselines.
- More cloud and modern environments. Serverless and multi-cloud, public object storage and public repositories as attack surfaces, cloud security posture management (CSPM), secrets scanning, Security Service Edge (SSE), group Managed Service Accounts (gMSAs), privilege creep and passwordless access are all named explicitly.
- A fuller incident response process. Objective 4.7 lays out preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and external reporting, and post-incident activities. Negotiation and external notification are the most notable additions: the exam expects you to know who must be told, and when.
- A renamed domain and new weights. Domain 2 is now "Threats, Vulnerabilities, and Attacks", and the domain weights changed. Splitting your study time with the SY0-701 table will put your hours in the wrong places.
Threat vectors were also updated: RCS, collaboration tools, QR-code phishing (quishing), deepfakes, browser extensions, session tokens and living-off-the-land tools are all listed.
How long to study for Security+
It depends on where you start, not on a magic number of hours:
- Already working in IT support, networking or systems administration: about 15 days at two hours a day works as an intensive review.
- New to IT security, or limited time on weekdays: plan for four to six weeks, with time to repeat labs and take more than one practice exam.
- New to IT altogether: build networking and operating system fundamentals first. The CompTIA certification path explains where Security+ fits.
The real signal that you are ready is not the calendar but your practice test results (see how to pass).
A six-week Security+ study plan
This plan follows the domain order and leaves the last week for review. If you are short on time, compress it into 15 days, one study block per day.
| Week | What to study | How to practice |
|---|---|---|
| 1 | Domain 1: controls, Zero Trust, change management, cryptography and PKI | Make acronym flashcards; sort ten real controls by category and type |
| 2 | Domain 2: threat actors, vectors and vulnerabilities | Take recent security news stories and name the actor, the vector and the vulnerability |
| 3 | Domain 2 indicators, AI threats and domain 3 architecture | Take a sample exam and note which domain you miss most |
| 4 | Domains 3 and 4: data protection, resilience, mitigations, vulnerability management, monitoring | Work through log and alert labs until you can solve them without hints |
| 5 | Domains 4 and 5: identity, automation, incident response, governance and risk | Put the incident response stages in order from memory; drill SLE, ALE and ARO |
| 6 | Full review | Timed practice test, review your weakest domain, second practice test |
Book the real exam at the end of week 5. A fixed date stops the "I'll start next week" cycle and still leaves a week of review.
Security+ practice tests
A practice test is only useful if it behaves like the real exam where it counts: a 90-minute clock, English wording with BEST and FIRST questions, PBQs, and a score on the same 100–900 scale. Look for explanations of why each wrong option is wrong, not just which one is right.
Avoid "brain dumps." The official objectives are explicit: candidates who use unauthorized materials have their certifications revoked and are suspended from future testing. Practice with original questions written from the public objectives.
HacksinCodigos' Security+ practice exams work that way: full-length, timed, in English, with flagging, multi-select questions, PBQs in a terminal plus ordering, matching and classification tasks, a 100–900 score and a per-domain report. You can take the free SY0-801 practice test (timed, with a terminal PBQ and interactive questions) to see the format, and read five sample questions with explanations first.
How to pass Security+ on the first try
- Score above 800 on full practice tests, timed and closed-book, before you sit the real one. 750 is the minimum; the margin absorbs exam-day nerves.
- Leave no weak domain. A good overall score with a shaky domain 4 is a risk: it is 27% of the exam.
- Explain why the other options are wrong. If you can only say which answer is right, you are recognizing, not understanding.
- Read the last line first on long scenario questions. The actual question is at the end; the rest is context, and sometimes a distraction.
- Flag PBQs that stall you and come back after the multiple-choice questions. Never leave one blank.
About the HacksinCodigos Security+ course
To be clear about the language: the HacksinCodigos Security+ course is taught in Spanish. The practice exams are in English, like the real one, with explanations in Spanish. It follows the SY0-801 objectives over 15 days, with a defensive security lab that runs in the browser. You can try the first lesson for free, and the sample exam is open to everyone.