CompTIA Security+ SY0-801 study plan
A solid CompTIA Security+ SY0-801 study plan has four phases: study the five official domains in weight order, consolidate the vocabulary the objectives define, prepare specifically for the performance-based questions, then rehearse with timed mock exams until you clear the pass mark with margin. The exam rewards choosing the best control or response for a stated constraint, not reciting definitions, so practice questions should start early rather than after the reading is done.
Know which version you are sitting
CompTIA expects SY0-801 (V8) to launch on or around 17 November 2026, and the English SY0-701 (V7) exam remains available until 11 June 2027. The two versions overlap for several months, so check which one your booking is for before you choose material. This plan, and our lessons and questions, follow the SY0-801 objectives.
The V8 objectives reorganise the content and add an objective on threats to and from AI systems. Older study guides cover most of the field but not that objective, and they weight the domains differently.
Phase 1 — Orient (a day or two)
Read the official exam objectives once, end to end. They are the exam’s scope and its dictionary: every term listed there can appear in a question, and nothing outside them should. Note the five domains and how heavily each one is weighted.
Answer a short practice session cold. The result tells you which domains you already half-know from IT work and which are new, and it sets the order of everything that follows.
Phase 2 — Study the five domains (the bulk of the plan)
Work in weight order, starting with security operations, the largest and most varied domain. Pair every lesson with a practice session on the same topic the same day. The questions are short scenarios that end in "best" or "most likely", and reading alone does not build the habit of picking the option that fits the constraint.
- General security concepts: control categories and types, the CIA triad, Zero Trust, change management, and cryptography and PKI.
- Threats, vulnerabilities and attacks: threat intelligence and scoring, actors and motivations, threat vectors, vulnerability types, indicators of malicious activity, and AI-related threats.
- Security architecture: architecture models, securing infrastructure, data protection and resilience.
- Security operations: mitigation and hardening, asset and vulnerability management, monitoring, identity and access management, automation, incident response and investigation.
- Security program management and oversight: governance, risk management, third-party risk, compliance and privacy, audits and assessments, and security awareness.
Phase 3 — Consolidate the vocabulary (a few days)
CompTIA uses its terms precisely, and many of them sit close together: a detective and a corrective control, a vulnerability scan and a penetration test, recovery time and recovery point objectives, single and annualised loss expectancy. For each pair you blur, write the distinction in one sentence and check it against the lesson.
Then rebuild practice sessions from your incorrect and flagged questions until no topic keeps reappearing. The cheat sheet for this exam collects every lesson’s key takeaways in one place for the final pass.
Phase 4 — Prepare for performance-based questions, then rehearse
Performance-based questions are interactive tasks, such as matching controls to a scenario, reading a log or configuring a setting on a diagram, and they tend to come early in the exam. They test the same objectives as the multiple-choice items, so the preparation is the same knowledge applied, but practise one habit for them: if a task stalls you, flag it, answer the quick items, and come back with the time you have left.
Sit full-length timed mock exams under real conditions. Between mocks, work through every incorrect answer and the topic behind it. Book when consecutive mocks clear the pass mark with margin and no domain trails the rest.
Signals you are ready
Book the exam when all of these are true:
- Consecutive full-length timed mocks clear the pass mark with room to spare.
- No domain is clearly behind the others in your per-domain results.
- You can explain why the wrong options in a "best" question are worse, not just why the right one works.
- You can do the loss-expectancy arithmetic and name the incident-response phases in order without notes.
Plan your prep
Questions, answered
Sources
Exam facts in this guide come from the vendor's published exam guide. Vendors revise these — check the source for the current version before you book.