SY0-801 study resources

The most important SY0-801 resource is free: the official CompTIA exam objectives document, which lists every topic, the weights and an acronym list. Build everything else around it, add hands-on lab time, and use realistic practice questions to find weak domains. One caution up front: SY0-801 had not launched when this was written, so most books and courses are still SY0-701 material.

Start with the official material

The exam objectives. CompTIA publishes the SY0-801 objectives (version 2.0) as a PDF on its Security+ pages. It contains the five domains and percentages, the numbered objectives with example topics, an acronym list, and a sample hardware and software list for a lab. Read it end to end before you buy anything, and tick off topics as you learn them.

The acronym list. CompTIA encourages candidates to attain a working knowledge of every acronym on it. It is a ready-made revision list, and several questions turn on expanding or telling apart acronyms such as SLA, SLO, MOU and MOA.

The lab list. The objectives suggest tablets, laptops, a web server, firewalls, IDS and IPS, virtual machines, Windows and Linux, Kali Linux, packet capture software, a vulnerability scanner, a SIEM, MDM software, a VPN, DHCP and DNS services, a Wi-Fi analyzer, a network mapper, a NetFlow analyzer and access to cloud environments. You do not need all of it; a few virtual machines cover most of it.

CompTIA’s own product pages. The V8 page lists the launch as expected on or around November 17, 2026, and the V7 page lists retirement dates. Check both before you book. See also exam changes.

Lab work

Security+ is not a heavy lab exam, but a few exercises make the scenario questions easier:

1. Scan and fix. Scan a lab VM with a vulnerability scanner, rank the findings, patch one and rescan.
2. Read network traffic. Capture traffic with Wireshark, find a DNS lookup, a TLS handshake and a failed login.
3. Harden an endpoint. Apply password policy and disable unused services on Windows and Linux, and check them with Group Policy or a local policy tool.
4. Email authentication. Look up the SPF, DKIM and DMARC records of a domain you own or a public one.
5. Logs and alerts. Send logs to a free SIEM, create a rule for repeated failed logins and tune it.
6. Risk register. Write five risks with impact, likelihood, owner and treatment, and compute the ALE of two.

Worth paying for

Practice tests written against the V8 objectives, not V7. Their value is diagnostic: they show which domain is weak. The free 20-question test here is weighted like the objectives and is a good first check.

A current study guide or video course that says clearly it covers SY0-801 (V8). For the AI objective in particular, do not rely on material for V7.

What to avoid

Braindumps. The CompTIA objectives state that using unauthorized “brain dump” material can lead to revoked certifications and suspension from future testing. They also teach memorised answers, which fail on scenario questions.

Old material presented as new. If a resource has no coverage of AI threats, prompt injection or agentic automation, it predates V8.

A sensible order

1. Read the objectives once and take a cold diagnostic.
2. Follow the four-week study plan.
3. Take the practice test and find the weakest domain.
4. Revisit its page and redo the matching lab.
5. Book once you score 80% or more twice in a row. Costs are covered at certification costs, and for the skills outline format see skills outline.

Is this the right exam?

For a first security certification, yes. If your networking is weak, start with Network+ N10-009. If you already hold Security+ and want AI security, see SecAI+ CY0-001. Whether the effort pays off is covered in is Security+ worth it?.