Security+ Domain 4 · SY0-801
The largest domain: hardening systems, managing assets and vulnerabilities, monitoring, identity and access, automation with AI, incident response and investigations.
Each block is as wide as that domain’s share of SY0-801. Domain 4 is 27%, down from 28% in SY0-701. Weights: CompTIA’s published SY0-801 exam objectives (v2.0).
The eight objectives
Eight objectives, five of them scenario-based. This is the day-to-day work of a security team, and the domain where most PBQ formats come from.
Select an objective number for its study drill. Each drill has ten questions, untimed, with feedback after each answer.
Choosing and configuring the controls that reduce risk on networks, endpoints, email, applications and wireless: firewall rules, IDS and IPS, web filtering and DLP, email authentication, NAC, EDR and XDR, segmentation, deception and rate limiting.
Typical question: a requirement plus a constraint, and you pick the control or configuration that BEST meets it.
Try the firewall PBQ below.
Why knowing, owning and tracking every hardware, software and data asset, from planning and purchase to disposal, underpins security.
Typical question: an asset situation, such as an unknown laptop in a scan or a retired server, and you name the activity that applies.
Finding vulnerabilities with scans, application tests, code review and cloud posture tools, then confirming them, prioritizing in context, choosing a response, validating the fix and reporting.
Typical question: a short list of findings, and you decide what to fix first or how to confirm the fix worked.
Monitoring systems, applications and networks: collecting and aggregating logs, alerting and tuning, dashboards and reports, and tools from SIEM and SCAP to flow data and packet analyzers.
Typical question: a monitoring problem, such as too many alerts or no visibility on a segment, and you pick the tool or practice that fits.
Applying IAM to real situations: the account life cycle, access-control models, federation and SSO, MFA (now including passkeys and backup codes), privileged and emergency accounts, and access reviews.
Typical question: a new hire, contractor, merger or lost phone, and you pick the IAM action or method that BEST fits.
Using scripts, orchestration and now AI to run security operations at scale, and knowing the guardrails, benefits and risks of automating.
Typical question: a security-operations goal with a limit, such as a person must approve containment, and you pick the automation or AI capability that fits.
SY0-801’s eight incident response headings, from preparation to post-incident, and the concepts under each, such as chain of custody, threat hunting and root cause analysis.
Typical question: an incident-response activity is described, and you name the heading it belongs to.
Choosing and using evidence: network, endpoint and application logs, metadata, packet captures, flow records, surveillance footage, memory dumps and disk images, and integrity checks on files and logs.
Typical question: an investigator’s question, and you pick the source that BEST answers it or what to preserve first.
Objective titles and summaries are our own words, not CompTIA’s. See every objective in the Security+ exam objectives checklist.
Domain test
30 questions in 30 minutes, covering all eight objectives, with one PBQ. Your results show how you did on each objective, so you know what to drill next.
Security Operations, every objective, on a timer.
SY0-801 vs SY0-701
Nine objectives become eight. Objective 4.1 merges three SY0-701 objectives, vulnerability management and automation move up to scenario questions, and incident response is reorganized under eight headings.
SY0-701SY0-801
| SY0-801 | What it covers | From SY0-701 | Change |
|---|---|---|---|
4.1 | Mitigating controls and techniques | 4.1 + 4.5 + 2.5 | Merged |
4.2 | Hardware, software and data asset management | 4.2 | Same title |
4.3 | Vulnerability management tasks | 4.3 | Now scenario-based |
4.4 | Alerting and monitoring | 4.4 | Same title |
4.5 | Identity and access management | 4.6 | Renumbered |
4.6 | Automation, orchestration and AI tools | 4.7 | Now scenario-based |
4.7 | Incident response | 4.8 | New headings |
4.8 | Data, artifacts and sources for investigations | 4.9 | Renumbered |
Incident response in SY0-701
Incident response in SY0-801 (objective 4.7)
CompTIA says its lists of examples aren’t exhaustive, so don’t forget the terms it no longer names, but don’t make them your focus. Read the full SY0-801 vs SY0-701 guide.
Sample PBQ
This performance-based question is in our free demo. You inherit a rule table that is too permissive and partly out of order, and you edit it until it meets five requirements.
FAQ
Domain 4, Security Operations, covers the day-to-day work of securing an organization: hardening, asset and vulnerability management, monitoring, identity and access, automation, incident response and investigations. At 27% of SY0-801, with eight objectives, it’s the largest domain.
SY0-801 uses eight headings: Preparation, Identification, Investigation, Containment, Negotiation, Eradication and recovery, Notification and external reporting, and Post-incident. They replace SY0-701’s seven-step process. Expect questions that describe an activity and ask which heading it belongs to.
Yes. SY0-801 names passkeys in objective 4.5, alongside backup codes and one-time passwords. Know what makes a passkey different from a password, and which sign-in method fits a given situation.
Five of its eight objectives are scenario-based, and that’s where our Domain 4 PBQs come from: firewall rules (4.1), a vulnerability report (4.3), an access-control matrix (4.5), matching (4.6) and log analysis (4.8). CompTIA doesn’t publish which PBQ formats appear on the real exam.
Take the timed Domain 4 test, or start with Mock Test 1: a free, full-length Security+ practice exam, explained option by option.
