Security+ Domain 2 · SY0-801
Who attacks and why, how attacks get in, which weak spots they use and how to read the signs of one in progress, plus threat intelligence and the new objective on AI threats.
Each block is as wide as that domain’s share of SY0-801. Domain 2 is 24%, up from 22% in SY0-701. Weights: CompTIA’s published SY0-801 exam objectives (v2.0).
The six objectives
Six objectives, read in order, follow an attack from the people behind it to the evidence it leaves. Two of them are new in SY0-801.
How you learn about threats and judge how serious a vulnerability is: threat feeds and intelligence sources, likelihood and impact, life cycles, CVE identifiers, CVSS scores and prioritization.
Typical question: an advisory, CVE record or CVSS score is described, and you decide what it tells you or what deserves attention first.
The kinds of threat actors, the attributes that tell them apart and what drives them. SY0-801 renames nation-state actors to state-sponsored and adds terrorists, competitors and accidental insiders.
Typical question: an actor’s resources, patience or demands are described, and you name the actor type or motivation.
The routes attackers use to get in: messages, files and images, browsers, collaboration tools, remote access, removable media, supply chains, IoT and OT, physical access and radio signals.
Typical question: you’re told how something got in, and you name the vector or source.
What leaves systems exposed: unsupported or unpatched systems, hardcoded secrets, stale credentials, misconfiguration and shadow IT, plus newer surfaces such as large language models, identity providers and public object storage.
Typical question: a system or design is described, and you name the weakness or exposed surface it shows.
Given evidence such as log lines, an alert or a user report, decide which attack is most likely under way: malware, physical, network, application, social-engineering or credential attacks, and the indicators of compromise behind them.
Typical question: a few log lines or an alert, then: which attack is MOST likely occurring?
Try the sample question below.
The risks of using AI tools such as LLM assistants and agents, from prompt injection and poisoning to hallucinations and data leaks. Questions describe an AI system and what went wrong, and you name the threat. Each threat is explained with an example in our Security+ AI threats guide (objective 2.6).
Objective titles and summaries are our own words, not CompTIA’s. See every objective in the Security+ exam objectives checklist.
Domain test
30 questions in 30 minutes, covering all six objectives, with one PBQ. Your results show how you did on each objective, so you know what to drill next.
Threats, Vulnerabilities, and Attacks, every objective, on a timer.
SY0-801 vs SY0-701
The domain is renamed from “…and Mitigations” to “…and Attacks”, gains two percentage points and grows from five objectives to six. Threat intelligence (2.1) and AI threats (2.6) are new, and SY0-701’s objective on mitigation techniques has moved into 4.1.
SY0-701SY0-801
| SY0-801 | What it covers | From SY0-701 | Change |
|---|---|---|---|
2.1 | Threat feeds, CVSS, CVE and prioritization | Parts of 4.3 | New |
2.2 | Threat actors and their motivations | 2.1 | Renumbered |
2.3 | Threat vectors and sources | Part of 2.2 | Split and expanded |
2.4 | Vulnerabilities and attack surfaces, including LLMs | 2.3 + part of 2.2 | Merged |
2.5 | Indicators of malicious activity | 2.4 | Renumbered |
2.6 | Threats and vulnerabilities of AI use | None | New |
CompTIA says its lists of examples aren’t exhaustive, so don’t forget the terms it no longer names, but don’t make them your focus. Read the full SY0-801 vs SY0-701 guide.
Sample question
An original question on reading the signs of an attack. Pick an answer to see why each option is right or wrong.
Employees on one floor who browse to payroll.corp.example land on a look-alike portal, while employees on other floors, who use a different resolver, reach the real site. When an administrator queries the floor’s assigned internal resolver from its own console, it returns 192.0.2.44, but the zone’s authoritative server returns 10.20.1.15. Which of the following is MOST likely occurring?
Pick an answer to see why each option is right or wrong.
Takeaway: one resolver wrong, authoritative server right: suspect cache poisoning on that resolver. Sources: CAPEC-142: DNS Cache Poisoning · RFC 5452
Another sample, on AI threats (objective 2.6), is on the Security+ practice questions page.
FAQ
Domain 2, Threats, Vulnerabilities, and Attacks, covers threat actors, attack vectors, vulnerabilities and attack surfaces, the indicators of an attack, threat intelligence and AI threats. It’s 24% of SY0-801 and has six objectives.
Two new objectives: 2.1 on threat intelligence and vulnerability scoring, and 2.6 on AI threats such as prompt injection, poisoning and jailbreaking. The domain’s name now ends “and Attacks” instead of “and Mitigations”, and SY0-701’s mitigation objective has moved into 4.1.
30 questions in 30 minutes: 29 multiple choice and one log-analysis PBQ on objective 2.5. It covers all six objectives, and your results break down by objective so you know which drill to take next.
Practice reading evidence. Objective 2.5 questions give you log lines, alerts or user reports and ask which attack is most likely, so look for the detail that rules out the near miss, such as whether one resolver or every resolver returns a bad answer. Log-analysis PBQs test the same skill.
Take the timed Domain 2 test, or start with Mock Test 1: a free, full-length Security+ practice exam, explained option by option.
