ExamSprintLab

SY0-801 study plan: pass in 4 weeks

Updated October 9, 2026

Four weeks is realistic for SY0-801 if you already work in IT and study 8-10 hours a week. Start with general concepts and threats because every later domain uses that vocabulary, then architecture, then Security Operations (the largest domain), and finish with governance and a review of AI topics. If you have no IT background, double the timeline and consider Network+ N10-009 first.

Before you start

  • Download the official SY0-801 exam objectives from CompTIA and read them once. They list every topic, plus an acronym list you should know.
  • Set up a lab you can break: two virtual machines (one Windows, one Linux), a free SIEM or log viewer, and Wireshark.
  • Take a diagnostic set of questions cold. The score does not matter; the weak domains do.
  • Check whether SY0-801 is available in your region yet. It is expected around November 17, 2026.

Week 1: concepts, threats and attacks (16% + 24%)

Goal: name any control, actor, attack or indicator in a scenario.

  • Concepts: CIA, AAA, non-repudiation, Zero Trust, least privilege, control categories and types, change management (CAB, backout plan, maintenance window), PKI, symmetric versus asymmetric encryption, hashing, salting.
  • Threats: actors and motivations, threat vectors, vulnerability types, CVSS and CVE, malware families, social engineering variants, network, application and credential attacks.
  • AI threats: prompt injection, poisoning, jailbreaking, hallucinations, evasion.

Task: build a table of 30 attacks with the indicator that gives each away. Practise telling smishing, vishing, quishing and whaling apart.

Week 2: security architecture (19%)

Goal: choose the right design and the right data protection for a requirement.

  • Cloud, serverless, IaC, microservices, on-premises, air-gapped and OT models; segmentation; shared responsibility.
  • Zero Trust architecture, device placement, security zones, VPN, SSE, failure modes.
  • Data types, states, classifications, roles (owner, custodian, steward, controller), masking, tokenization, hashing, encryption.
  • Resilience: hot, warm and cold sites, redundancy, backups and immutability, RTO, RPO, MTTR, MTBF.

Task: draw a small network with a screened subnet, a database zone and a management network, then write which traffic each firewall rule allows.

Week 3: security operations (27%)

Goal: this is the biggest block; it is where hands-on experience pays off.

  • Hardening, segmentation, application control, IDS and IPS, firewalls and WAFs, EDR and XDR, NAC and 802.1X, DLP, email security (SPF, DKIM, DMARC, BIMI).
  • Asset management, vulnerability management, SIEM, NetFlow, syslog, SNMP, SCAP.
  • Identity and access: provisioning, SSO, SAML, OAuth, LDAP, MFA, passkeys, access control models, just-in-time access.
  • Automation and orchestration, including AI capabilities.
  • Incident response phases, forensics, chain of custody, log and artifact analysis.

Task: run a vulnerability scan of your lab, rank the findings by severity and exposure, then investigate one with logs and a packet capture.

Week 4: program management, AI review and practice (14%)

Goal: close the reading-heavy gaps and test yourself.

  • Governance documents (policies, standards, procedures, baselines), risk (qualitative versus quantitative, SLE, ALE, ARO, risk register, treatment), third-party risk (RFP, SLA, MOU, MSA, SOW, NDA, right to audit), compliance and privacy, audits and penetration testing, awareness training.
  • Re-read the AI sections of the objectives.
  • Take the practice test and review every wrong answer.

Task: write a one-page risk register with five risks, each with impact, likelihood, owner and treatment.

If you already have experience

If you work as a systems or security administrator, spend week 1 on a fast skim, spend most time on Domains 2 and 5 where practitioners often have gaps (terminology, risk calculations, governance), and learn the AI objective from scratch. Two weeks can be enough.

How to know you are ready

  • You score 80-85% on two different sets of realistic questions in a row.
  • You can explain, without notes, the difference between RTO and RPO, preventive and detective controls, and SLA, MOU and SOW.
  • You can calculate SLE, ALE and ARO quickly.
  • You have read the whole acronym list and know most of it.

Read the exam format once more before booking, and the exam day guide the week before.