CompTIA Security+ exam objectives 2026: the SY0-801 checklist

1. 1.1 Core security principles and control families

   The building blocks: control categories and types, the CIA triad, non-repudiation, AAA, Zero Trust, defense in depth and least privilege.

   9 key topics

   • Control categories
   • Control types
   • Compensating controls
   • Confidentiality, integrity, availability
   • Non-repudiation
   • Authentication, authorization and accounting (AAA)
   • Zero Trust principles
   • Defense in depth
   • Least privilege

   Study objective 1.1What changed in objective 1.1

2. 1.2 Making changes without opening security gaps

   Scenario-based

   How approvals, impact analysis, testing, backout plans and documentation stop a change from causing an outage or a gap in your defenses.

   12 key topics

   • Approval and the change advisory board (CAB)
   • Ownership and stakeholders
   • Impact analysis
   • Testing and test results
   • Backout plan
   • Fail forward
   • Maintenance window
   • Standard operating procedures (SOPs)
   • Allow/deny list updates and restricted activities
   • Downtime and service or application restarts
   • Legacy applications and dependencies
   • Documentation updates and version control

   Study objective 1.2What changed in objective 1.2

3. 1.3 Choosing and using cryptography

   When to encrypt, hash or sign, how keys are agreed, and how certificates are issued, trusted and revoked.

   12 key topics

   • Symmetric vs asymmetric encryption
   • Key exchange
   • Algorithms and key length
   • Encryption levels (disk, partition, volume, file, database, record)
   • Transport and communication encryption
   • Hashing algorithms
   • Salting
   • Digital signatures
   • PKI roles, root of trust and key escrow
   • Certificate types and CSRs
   • Certificate revocation (CRL and OCSP)
   • Obfuscation and crypto tooling in general

   Study objective 1.3What changed in objective 1.3

Nothing in this domain matches the filter.

1. 2.1 Threat intelligence and vulnerability scoring

   New in SY0-801

   Where threat intelligence comes from, and how to judge a vulnerability with likelihood, impact, CVE IDs and CVSS scores.

   8 key topics

   • Threat feeds
   • Intelligence sources
   • Intelligence and vulnerability life cycles
   • Likelihood and impact
   • CVSS scoring
   • CVE identifiers (and NVD, CWE)
   • Vulnerability types
   • Prioritization

   Study objective 2.1What changed in objective 2.1

2. 2.2 Who attacks and why

   The main kinds of attacker, the clues that tell them apart, and what drives them, from money to ideology.

   11 key topics

   • State-sponsored actors
   • Crime syndicates (organized crime)
   • Hacktivists
   • Unskilled attackers
   • Insider threats (malicious)
   • Accidental or unintentional insiders
   • Competitors
   • Terrorists
   • Actor attributes
   • Financial and strategic motivations
   • Personal and ideological motivations

   Study objective 2.2What changed in objective 2.2

3. 2.3 How attacks arrive: delivery channels and entry points

   The routes attacks take in: messages, files, QR codes, browsers, remote access, USB devices, suppliers and radio signals.

   17 key topics

   • Message delivery channels
   • Collaboration tools
   • File and image vectors
   • QR codes
   • CAPTCHA abuse
   • Browser-based vectors
   • Session tokens, cookies and session keys
   • Remote access tools
   • Living-off-the-land tools
   • Removable media and malicious USB devices
   • Unsecure networks and signal-based vectors
   • IoT and OT entry points
   • Supply chain and third-party sources
   • Advanced persistent threats (APTs) as a source
   • Watering hole
   • Network and endpoint entry points
   • Human and physical access routes

   Study objective 2.3What changed in objective 2.3

4. 2.4 Weak spots and exposed attack surfaces

   What leaves a system exposed: missing patches, unsupported software, hardcoded secrets, stale credentials, shadow IT, LLM apps and public cloud storage.

   18 key topics

   • Unsupported and obsolete systems
   • Unpatched systems
   • Unmanaged and rogue devices
   • Shadow IT
   • Hardcoded secrets
   • Unsafe exception handling
   • Unmanaged and stale credentials
   • Default credentials and open service ports
   • Misconfiguration
   • Application flaws
   • Cryptographic weaknesses
   • Large language models as an attack surface
   • Identity providers
   • Public repositories
   • Public object storage
   • Operating-system, virtualized and mobile surfaces
   • Wireless and low-power surfaces
   • Zero-day exposure

   Study objective 2.4What changed in objective 2.4

5. 2.5 Reading the signs of an attack

   Scenario-based

   Matching evidence such as log lines, alerts and user reports to the attack behind it, from malware to MFA bypass.

   18 key topics

   • Ransomware
   • Worms, viruses and trojans
   • Rootkits, spyware, keyloggers, adware and logic bombs
   • Fileless malware
   • Physical attacks
   • Distributed denial of service
   • On-path, sniffing, spoofing, DNS/cache poisoning and rogue devices
   • Protocol downgrade
   • Application attacks
   • Phishing, spear phishing and whaling
   • Smishing, vishing and impersonation
   • Quishing
   • Deepfakes
   • Password spraying, brute force and user enumeration
   • MFA bypass and replay
   • Indicators: file and network artifacts
   • Indicators: resource use, timestamps and log manipulation
   • Indicators: account anomalies

   Study objective 2.5What changed in objective 2.5

6. 2.6 AI and LLM risks

   New in SY0-801

   The new AI objective: prompt injection, jailbreaking, poisoning, model manipulation, evasion, data loss, hallucinations, bias and more.

   13 key topics

   • Prompt injection
   • Jailbreaking
   • Poisoning
   • Model manipulation
   • Evasion
   • Data loss through AI use
   • AI privacy risks
   • Hallucinations
   • Bias
   • Explainability
   • Ethical considerations
   • AI session hijacking
   • Code execution through AI

   Study objective 2.6What changed in objective 2.6

Nothing in this domain matches the filter.

1. 3.1 Choosing where and how systems run: security trade-offs

   How cloud models, multicloud, on-premises, serverless, microservices, infrastructure as code and OT change who is responsible for what.

   15 key topics

   • Shared responsibility
   • Cloud deployment models
   • Multicloud
   • On-premises
   • Infrastructure as code
   • Serverless
   • Microservices
   • Physical isolation vs logical segmentation
   • Operational technology (OT)
   • High availability
   • Proprietary vs open source
   • Business considerations
   • Data sovereignty and classification
   • Technical considerations
   • Usability

   Study objective 3.1What changed in objective 3.1

2. 3.2 Running a defensible infrastructure

   Scenario-based

   Where controls go, how zones connect, what happens when a control fails, Zero Trust building blocks, secure admin access and SSE.

   15 key topics

   • Device placement
   • Security zones and connectivity
   • Attack surface reduction
   • Failure modes
   • Zero Trust: user authentication
   • Zero Trust: device inventory and health
   • Zero Trust: application access control
   • Remote access and VPN
   • Security Service Edge (SSE)
   • Out-of-band management
   • End-to-end encrypted messaging and secure file transfer
   • Service accounts and gMSAs
   • Privilege creep
   • Diversity
   • Selecting effective controls

   Study objective 3.2What changed in objective 3.2

3. 3.3 Protecting data across its life

   Data types, states and classification levels, and the methods that protect data: encryption, hashing, masking, tokenization and de-identification.

   14 key topics

   • Endpoint data handling
   • Structured vs unstructured data
   • Classification levels
   • Data states
   • Sovereignty, geolocation and geofencing
   • Encryption and hashing for data
   • Masking and tokenization
   • Obfuscation and data transposition
   • De-identification
   • Filtering, segmentation and permission restrictions
   • Marking, labeling and data placement
   • Data protection roles
   • Data management life cycle
   • Data compliance categories

   Study objective 3.3What changed in objective 3.3

4. 3.4 Staying available and restoring service

   High availability, recovery sites, backups you can actually restore, power resilience, and the recovery metrics RTO, RPO, MTTR and MTBF.

   14 key topics

   • Load balancing vs clustering
   • Autoscaling
   • Recovery sites and geographic dispersion
   • Platform diversity and multicloud resilience
   • Capacity planning
   • Resilience testing
   • Backups: frequency, scope, encryption and snapshots
   • Backup immutability and retention
   • Restoration testing
   • Power resilience
   • Business continuity vs disaster recovery
   • RTO and RPO
   • MTTR and MTBF
   • Resilient storage

   Study objective 3.4What changed in objective 3.4

Nothing in this domain matches the filter.

1. 4.1 Hardening and protective controls in practice

   Scenario-based

   Choosing and configuring controls: firewall rules, IDS/IPS, filtering, DLP, email authentication, NAC, EDR/XDR, hardening and deception.

   16 key topics

   • Firewall rules and access control lists
   • Firewall types and web application firewalls
   • IDS and IPS
   • Web filtering and data loss prevention
   • Email authentication and gateways
   • BIMI
   • Network access control and endpoint posture
   • Antivirus, EDR, XDR and host-based protection
   • Host and operating system hardening
   • Mobile, wireless, WIPS and captive portals
   • Deception technology and canary accounts
   • Secrets scanning
   • Rate limiting
   • Application security controls
   • Segmentation, isolation and allow listing
   • Secure protocol and port selection

   Study objective 4.1What changed in objective 4.1

2. 4.2 Tracking assets from purchase to disposal

   Knowing every hardware, software and data asset, who owns it, and how it is retired and disposed of safely.

   7 key topics

   • Asset management life cycle
   • Planning and scoping
   • Acquisition and procurement
   • Assignment, ownership and classification
   • Inventory, tracking and enumeration
   • Disposal and decommissioning
   • Data retention

   Study objective 4.2What changed in objective 4.2

3. 4.3 Running vulnerability management

   Scenario-based

   Finding vulnerabilities with scans, code review, CSPM and pen tests, then confirming, prioritizing, fixing, verifying and reporting them.

   12 key topics

   • Vulnerability scanning
   • Application testing and package monitoring
   • Source code review
   • Asset discovery with IPAM
   • Cloud security posture management (CSPM)
   • Penetration testing and report review
   • Responsible disclosure and bug bounties
   • Confirming findings
   • Contextual prioritization
   • Remediation options
   • Validating remediation
   • Vulnerability reporting

   Study objective 4.3What changed in objective 4.3

4. 4.4 Security visibility: log collection, alerts and telemetry tools

   Collecting logs and telemetry: SIEM correlation, alert tuning, syslog, SNMP, flow data, packet capture and dashboards.

   12 key topics

   • What to monitor
   • Log aggregation and SIEM
   • Syslog
   • Alerting and alert tuning
   • Security monitoring tools
   • Dashboards, reporting and archiving
   • Agent-based vs agentless monitoring
   • SCAP and benchmarks
   • SNMP traps and network management systems
   • NetFlow and flow data
   • Packet analyzers and port mirroring
   • Orchestration in monitoring

   Study objective 4.4What changed in objective 4.4

5. 4.5 Identity and access management in practice

   Scenario-based

   The account life cycle, permissions, access control models, SSO, MFA and passkeys, privileged and emergency accounts, and access reviews.

   13 key topics

   • Identity proofing, provisioning and deprovisioning
   • Permission assignment
   • Federation and single sign-on
   • Access control models
   • Just-in-time access
   • MFA methods and one-time passwords
   • Passkeys
   • Backup codes
   • Password policy, managers and passwordless
   • Emergency (break-glass) and third-party accounts
   • Privileged accounts and privileged access management
   • Access reviews, account audits and policy reports
   • Compromised credential monitoring

   Study objective 4.5What changed in objective 4.5

6. 4.6 Scripted workflows and AI helpers for the security team

   Scenario-based

   Automating provisioning, tickets and response, securing CI/CD, and using agentic AI, chatbots and AI baselines safely within guardrails.

   14 key topics

   • User and resource provisioning
   • Ticketing and escalation
   • Enabling and disabling services and access
   • CI/CD pipeline security
   • APIs and integrations
   • Desired state management
   • Anomaly detection
   • Agentic AI
   • AI chatbots and assistants
   • Predictive analysis
   • AI-augmented baselines
   • Guardrails
   • Benefits of automation
   • Risks and considerations

   Study objective 4.6What changed in objective 4.6

7. 4.7 Incident response building blocks

   The eight incident response headings, from preparation to post-incident review, and which activities belong under each.

   12 key topics

   • Preparation
   • Tabletop exercises and simulations (Preparation)
   • Identification and advisories
   • Threat hunting (Identification)
   • Investigation, digital forensics and e-discovery
   • Chain of custody and preservation (Investigation)
   • Containment
   • Negotiation
   • Eradication and recovery
   • Notification and external reporting
   • Post-incident: lessons learned and root cause analysis
   • Post-incident report (PIR)

   Study objective 4.7What changed in objective 4.7

8. 4.8 Picking the right evidence for an investigation

   Scenario-based

   Choosing the right logs, packet captures, flow records, disk and memory images or video for an investigation, and keeping evidence intact.

   12 key topics

   • Network and firewall logs
   • Endpoint and operating-system logs
   • Application and web logs
   • IDS/IPS logs, scans, dashboards and automated reports
   • Metadata
   • Packet captures
   • Flow records and IPFIX
   • Surveillance footage
   • System images: memory dumps, bit-level copies and snapshots
   • File and log integrity
   • Investigation stakeholders
   • Log-parsing techniques

   Study objective 4.8What changed in objective 4.8

Nothing in this domain matches the filter.

1. 5.1 Policies, standards and reference documents

   Policies vs standards vs procedures vs guidelines, plus playbooks, runbooks, benchmarks, reference architectures and continuity plans.

   12 key topics

   • Policies, standards, procedures and guidelines
   • Core security policies
   • BYOD and clean desk policies
   • Privacy and vulnerability disclosure policies
   • Technical standards
   • Procedures, onboarding and offboarding
   • Playbooks and runbooks
   • Benchmarks and implementation guides
   • Reference architectures
   • Advisories and RFCs
   • Monitoring and revision
   • Continuity and recovery plans

   Study objective 5.1What changed in objective 5.1

2. 5.2 Managing risk

   Finding, scoring and recording risks, working out expected loss with SLE, ALE and ARO, and choosing how to treat each risk.

   10 key topics

   • Risk identification
   • Business impact and residual risk
   • Qualitative vs quantitative analysis
   • SLE, ALE and ARO
   • Risk scoring and categorization
   • Risk register, owners and current mitigations
   • Register communication and reviews
   • Risk appetite and tolerance
   • Risk treatment strategies
   • Risk reporting and oversight

   Study objective 5.2What changed in objective 5.2

3. 5.3 Third-party and vendor risk

   Choosing and managing vendors: solicitation documents, due diligence, assessments, agreement types, SLAs and SLOs, and lock-in.

   10 key topics

   • Solicitation documents (RFI, RFP, RFQ, EOI)
   • Due diligence and conflicts of interest
   • Vendor assessment methods
   • Compliance attestation
   • Questionnaires and ongoing monitoring
   • SLA and SLO
   • Agreement types
   • Vendor registry
   • Rules of engagement
   • Limitations: vendor lock-in and ROI

   Study objective 5.3What changed in objective 5.3

4. 5.4 Compliance and privacy obligations

   Compliance reporting and monitoring, the cost of failing, compliance training, consent, data subject rights and legal holds.

   9 key topics

   • Compliance reporting
   • Consequences of non-compliance
   • Compliance monitoring
   • Compliance training (AML/CTF and anti-bribery)
   • Privacy legal scope
   • Consent: opt-in and opt-out
   • Data subject rights
   • Data inventory and retention
   • Legal holds and legal orders

   Study objective 5.4What changed in objective 5.4

5. 5.5 Audits, testing and intrusion-analysis frameworks

   Internal and external audits, evidence gathering, gap analysis, penetration tests, and the MITRE ATT&CK, Cyber Kill Chain and Diamond Model frameworks.

   11 key topics

   • Internal audits and self-assessments
   • External audits, examinations and attestation
   • Audit charter
   • Evidence gathering: sampling and interviews
   • MITRE ATT&CK
   • Cyber Kill Chain
   • Diamond Model
   • Gap analysis
   • Benchmarking against frameworks and standards
   • Penetration testing types and reconnaissance
   • Functional vs behavioral testing

   Study objective 5.5What changed in objective 5.5

6. 5.6 Security awareness programs

   Scenario-based

   Running an awareness program: phishing simulations, training types and delivery, behavior risk scoring and topics such as BEC.

   10 key topics

   • Phishing simulations
   • Recognizing and reporting suspicious messages
   • Situational awareness
   • Training types
   • Delivery mechanisms
   • Personnel behavior risk scoring
   • Business email compromise awareness
   • Emerging security topics
   • User guidance
   • Program development, execution and metrics

   Study objective 5.6What changed in objective 5.6

Nothing in this domain matches the filter.