SY0-801 study scenarios: three profiles

SY0-801 is a maximum of 90 questions in 90 minutes with a passing score of 750 on a 100 to 900 scale, and Security Operations at 27 percent and Threats, Vulnerabilities, and Attacks at 24 percent are about half of it. CompTIA lists the V8 launch as expected on or around November 17, 2026, so the practical question is how much of your time goes where while you wait. The three profiles below cover a candidate with SY0-701 material, a help desk or network technician and a student.

Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.

The candidate who already studied from SY0-701 material

Starting point. This candidate knows the V7 topics: control types, cryptography, common attacks, IAM, incident response and governance terms. Format and scoring are identical, so the learning is a difference, not a new subject.

Where the time goes. Into what V8 changed. General Security Concepts rose from 12 to 16 percent, so the fundamentals count for more. Program Management fell from 20 to 14 percent, so governance deserves less than it did. The new AI objective 2.6 (prompt injection, poisoning, jailbreaking, hallucinations, evasion) sits inside the 24 percent Threats domain, with AI also in automation and attack surface. Smaller additions include SSE, passkeys, quishing and BIMI.

The trap. Trusting familiarity. Material written for SY0-701 does not cover the AI objective, and an old governance-heavy study pattern spends hours where V8 now awards fewer marks.

Suggested order. AI threats and the new term lists, general concepts, then timed Security Operations scenarios; governance last.

Planning assumption. The four-week plan is built for someone working in IT. For this profile a reasonable planning assumption is two to three weeks at 8 to 10 hours, 16 to 30 hours, based on the objectives difference listed on the SY0-801 vs SY0-701 page.

The help desk or network technician with general IT experience

Starting point. This candidate resets accounts, handles tickets and knows ports, subnets and firewalls from daily work, but has not run a SIEM or written an incident report. Threat names and governance documents are new vocabulary.

Where the time goes. Into Security Operations (27 percent) and Threats (24 percent) in the study plan’s weeks 1 and 3: vulnerability management, logs and alerts, IAM models, SAML versus OAuth, incident response phases, and recognising smishing, vishing, quishing and whaling from indicators. Program Management (14 percent), the smallest domain, is the quickest gain, because SLA, MOU, SOW, ALE and BIA are learnable terms.

The trap. Memorising acronyms without scenarios. The difficulty page puts this first among reasons people fail, because many options are plausible and the exam asks for the best or first action.

Suggested order. Concepts and threats, architecture, operations with a home lab, then governance, AI review and practice.

Planning assumption. The difficulty page suggests four to six weeks for general IT. A reasonable planning assumption is 32 to 60 hours at 8 to 10 hours a week, with roughly a quarter of the total on Operations.

The student with no IT work behind them

Starting point. This candidate has theory but little operating-system, network or log experience. The V8 recommended profile, a security administrator with two years of hands-on experience, is far off.

Where the time goes. First into foundations the exam assumes rather than lists: IP addressing, common ports, a Windows and a Linux machine, and what a firewall rule does. The study plan says to double the timeline and consider Network+ N10-009 in that case. Then evenly through five domains with a lab, because the performance-based questions use a simulated interface.

The trap. Going straight to practice questions without the basics, which turns every scenario into memorised answers and leaves the performance-based tasks unfamiliar.

Suggested order. Networking and operating system basics, concepts, threats, architecture, operations, program management, then two timed practice passes.

Planning assumption. Doubling the four-week plan gives eight weeks at 8 to 10 hours, 64 to 80 hours, before any Network+ study.

SY0-801 profiles side by side

How to check which SY0-801 profile fits before booking

Take the free sample questions cold and sort misses by domain. Misses on AI and newer term lists point to the first profile, misses on logs, IAM and incident steps to the second, and misses on networking basics to the third. Then follow the four-week study plan, use the practice test as a readiness check and read the exam format for the launch date, because SY0-801 cannot be booked until CompTIA opens it. If networking is your gap, see Network+ N10-009.

These hour counts are planning assumptions, not guidance from CompTIA, and they do not guarantee a pass.