Security+ 801 Countdown, T-37: Same Objective Numbers, Different Topics

An exam blueprint is the document that fixes what a certification is allowed to test. For Security+ that document is the exam objectives, and everything built to prepare a candidate (textbook chapters, practice banks, course outcomes, flashcard decks) is tagged, directly or by inheritance, with its objective numbers. On SY0-801 the blueprint is Document Version 2.0: five domains and 27 numbered objectives, of which 2.1, characteristics of threats and vulnerabilities, and 2.6, AI threats and vulnerabilities, are new (CompTIA 2025).

The numbers are the interface between the blueprint and your study material, and that is the problem this post solves. A flashcard tagged “4.6” is only useful if you and the blueprint agree on what 4.6 means; on SY0-801 it means automation and orchestration, and a candidate who believes it means identity and access management will spend an evening on the wrong chapter. What follows is a reader’s map: how the five domains are laid out, where the large topics sit, what the verb at the front of each objective says about how the topic is tested, and how to move older material onto the 801 numbers without corrupting it. Domain weights were covered at T-38.

How the blueprint is organized

Every objective has three parts: a number, a verb, and a title. The number is domain and position, so 2.5 is the fifth objective in Domain 2. The verb is the opening word or phrase of the title, and SY0-801 uses five of them: Explain, Given a scenario, Summarize, Compare and contrast, and Describe. The title names the topic, and the bullets beneath it list the testable content. Objective 2.5, for instance, reads “Given a scenario, analyze indicators of malicious activity”: number 2.5, verb Given a scenario, topic indicators of malicious activity.

The domains are uneven. Domain 1 has three objectives (1.1 to 1.3), Domain 2 has six (2.1 to 2.6), Domain 3 has four (3.1 to 3.4), Domain 4 has eight (4.1 to 4.8), and Domain 5 has six (5.1 to 5.6). That is 27 in total; there is no 1.4 and no 4.9, and a reference to either number is a reliable sign of older material. The verbs are distributed just as unevenly: Explain leads 11 objectives, Given a scenario leads nine, Summarize four, Describe two, and Compare and contrast exactly one. Where the scenario objectives fall is the single most useful thing to know about the blueprint, because, as the later sections argue, the verb is the best available signal of how a topic will be tested.

Domain	Objectives	Scenario objectives	Series posts
1	1.1 to 1.3	1.2	T-36 to T-34
2	2.1 to 2.6	2.5	T-33 to T-23
3	3.1 to 3.4	3.2	T-22 to T-17
4	4.1 to 4.8	4.1, 4.3, 4.5, 4.6, 4.8	T-18, T-16 to T-8
5	5.1 to 5.6	5.6	T-7 to T-2

One caution before using the map. CompTIA’s V8 web page carries a 26-line objectives summary whose verbs do not match the document’s; it lists “Implement incident response activities” where the document’s 4.7 says Summarize (CompTIA 2026a). The document is the blueprint. Take numbers, verbs, and titles from Document Version 2.0 and treat the web summary as marketing copy.

Where the big topics live

Domain 1: foundations

Domain 1 is short and conceptual. Objective 1.1 (Explain) holds security controls and the core concepts, and it is one of the two places where least privilege is listed (T-36). Objective 1.2, change management, is the domain’s only scenario objective: the testable skill is choosing the backout plan or the approval path for a given change, not reciting the vocabulary of change control (T-35). Objective 1.3 (Explain) is cryptographic solutions, and encryption as a control is defined here rather than in the operations domain (T-34).

Domain 2: threats and vulnerabilities

Domain 2 is the second-largest domain and holds both of the new objectives. Objective 2.1 (Explain) opens the domain with the characteristics of threats and vulnerabilities, and it is the home of threat feeds, CVSS, and CVE (T-33). Objectives 2.2 and 2.3 are the only two Describe objectives on the exam: 2.2 covers threat actors (T-32), and 2.3, “Describe threat vectors and sources,” covers the paths by which a threat reaches a target (T-31). Objective 2.4, “Explain types of vulnerabilities and attack surfaces,” pairs weaknesses with the surfaces that expose them, and shadow IT is listed here as an attack surface rather than among the actors (T-29, T-28). Objective 2.5 is the domain’s scenario objective, indicators of malicious activity (T-30, T-28 to T-25), and 2.6 (Summarize) is AI threats and vulnerabilities (T-24, T-23).

Domain 3: architecture

Domain 3 is where the exam’s single Compare and contrast objective lives: 3.1, architecture models (T-22). Objective 3.2 (scenario) is securing the infrastructure, and it is where Zero Trust sits, alongside the second listing of least privilege (T-21, T-20). Objective 3.3 (Summarize) is protecting data (T-19, T-18), and 3.4 (Explain) is resilience and recovery (T-17).

Domain 4: operations

Domain 4 has eight objectives, five of them scenario objectives, and it carries most of the hands-on work. Objective 4.1, “apply mitigating controls, techniques, and solutions to secure the environment,” is the largest objective in the document, with 17 top-level bullets: hardening, application security (input validation through code signing), sandboxing, monitoring and alerting, MDM, firewalls, IDS/IPS, content filter, NAC, endpoint security, email security, operating system security, segmentation, access controls, application control, deception, and repositories with secrets scanning. Firewall types and 802.1X are here as well (T-16 to T-14, with deception at T-15). Objective 4.2 (Explain) is asset management, including decommissioning (T-18). Objective 4.3, “Given a scenario, perform tasks associated with vulnerability management,” asks you to rank and act on scan findings (T-13). Objective 4.4 (Explain) is alerting and monitoring (T-8). Objective 4.5 (scenario) is identity and access management: SAML, OAuth, MFA, and the rest of the identity stack (T-12, T-11). Objective 4.6 (scenario) is automation and orchestration (T-10); 4.7 (Summarize) is incident response, with isolation among its activities (T-9); and 4.8 (scenario) is investigation data and artifacts (T-8).

Domain 5: governance

Domain 5 is Explain-heavy: 5.1 governance artifacts, 5.2 risk management, 5.3 third-party risk, and 5.5 audits and assessments all carry Explain (T-7, T-6, T-5, T-3). Secure baselines live under Standards in 5.1 rather than in operations (T-7), gap analysis is in 5.5, and legal hold is listed under compliance in 5.4, the domain’s Summarize objective (T-4). The domain’s one scenario objective is 5.6, security awareness (T-2).

What the verb tells you about the test

Neither objectives document defines its verbs or ties an objective to an item type; each says only that questions are multiple-choice and performance-based (CompTIA 2023; CompTIA 2025). So the verb carries no official promise, and anything it tells you is inference from two further sources. CompTIA’s PBQ overview lists Security+ among the certifications with simulation PBQs but names no objectives (CompTIA n.d.b), and its testing-approach page links simulations to job tasks without naming a verb (CompTIA n.d.a). Scenario objectives are written as job tasks performed in a situation, so they are the most likely PBQ material. That is inference, not policy, and no CompTIA document limits PBQs to them.

Bloom’s taxonomy, the usual tool for ranking verbs, does not separate the four non-scenario verbs either. In the revised taxonomy, Explaining, Summarizing, and Comparing are all processes in one category, Understand; Describe is not among the 19 named processes, and the strict hierarchy was relaxed (Krathwohl 2002). Basically, Explain, Describe, Summarize, and Compare and contrast all ask the same thing: know the topic well enough to say what it is, how it works, and how it differs from its neighbors. Do not read Summarize on 4.7 (incident response) as a lighter requirement than Explain on 4.4 (alerting and monitoring); the taxonomy puts them in the same category. The defensible step is from those four verbs to Given a scenario, whose action verbs (apply in 4.1, perform in 4.3) mostly fit Apply, “Carrying out or using a procedure in a given situation,” while the analyze in 2.5 fits Analyze. That mapping is my interpretation; CompTIA publishes none.

In practice the verb changes what you rehearse. For an Explain or Describe objective, a definition and a distinction are the unit of study: what a threat vector is, and how it differs from a vulnerability. For a scenario objective, the unit of study is a decision made under stated constraints: given a change request, pick the backout plan (1.2, T-35); given a scan report, rank the findings (4.3, T-13); given a repetitive task, choose the automation (4.6, T-10). Those three deserve special attention from anyone working from older material, because change management, vulnerability management, and automation were Explain-level topics in 701-era study guides, and the habit of memorizing definitions where SY0-801 expects a choice is the habit most likely to survive unnoticed.

Nine of 27 objectives carry Given a scenario, one third of the blueprint by count. CompTIA publishes only domain weights, so any finer estimate is a model rather than a CompTIA figure, but giving each objective an equal share of its domain’s weight puts about 33.3 percent of the exam under scenario objectives, and the plain count agrees. Domain 4 alone holds five of the nine.

Retagging older study material

CompTIA’s V8 page links only to the objectives document and offers no mapping from the previous exam’s numbers (CompTIA 2026a), so anyone holding a question bank, flashcard deck, or course outline tagged with 701 numbers has to build the map. The renumbering has a simple mechanism. Domain 1 shifts down by one from 1.2 onward, because 1.1 absorbed the old 1.2. Domain 2 shifts up by one, because the new 2.1 was inserted at the top; the old 2.5, mitigation techniques, did not shift but folded into 4.1. Domain 4 shifts down by one from 4.6 onward, because 4.1 absorbed the old 4.5. Domains 3 and 5 keep every number. The result is that eleven numbers name a different topic on the two exams, and the worst pair is 2.4 and 2.5: a 701-era book’s chapter 2.4 carries the exact title of 801 2.5, so the matching sentence tempts you to keep the old number.

The tempting tool is a chain of find-and-replace rules, and it fails. Run in ascending order, the chain cascades:

>>> s = "SY0-701 2.1"
>>> for a, b in [("2.1","2.2"),("2.2","2.3"),("2.3","2.4"),("2.4","2.5"),("2.5","4.1")]: s = s.replace(a, b)
>>> s
'SY0-701 4.1'

The threat-actor item lands in 4.1, because each rule rewrites the previous rule’s output. Descending order breaks Domain 4 instead (4.6 to 4.5, then 4.5 to 4.1), so no single order is safe. An unanchored sed 's/1\.2/1.1/g' fails differently: it also rewrites “TLS 1.2” inside a question stem. The correct tool is one lookup per tag, anchored on the tag, using a dictionary that lists only the numbers that change; MAP.get(old, old) passes everything else through unchanged. The script below also flags the six 701 objectives whose content split across several 801 objectives, because those items need a human reader.

import csv, re, sys

MAP = dict(pair.split(">") for pair in (
    "1.2>1.1 1.3>1.2 1.4>1.3 2.1>2.2 2.2>2.3 2.3>2.4 2.4>2.5 "
    "2.5>4.1 4.5>4.1 4.6>4.5 4.7>4.6 4.8>4.7 4.9>4.8").split())
REVIEW = {"1.2", "2.2", "2.5", "4.1", "4.3", "4.5"}

out = csv.writer(sys.stdout, lineterminator="\n")
out.writerow(["item_id", "old_tag", "new_tag", "flag"])
for item_id, tag in csv.reader(sys.stdin):
    old = re.fullmatch(r"SY0-701 ([1-5]\.[1-9])", tag).group(1)
    new = MAP.get(old, old)
    out.writerow([item_id, tag, "SY0-801 " + new,
                  "REVIEW" if old in REVIEW else ""])

$ python3 retag.py < bank.csv
item_id,old_tag,new_tag,flag
Q0142,SY0-701 2.1,SY0-801 2.2,
Q0177,SY0-701 2.5,SY0-801 4.1,REVIEW
Q0203,SY0-701 4.6,SY0-801 4.5,
Q0311,SY0-701 4.9,SY0-801 4.8,
Q0356,SY0-701 1.2,SY0-801 1.1,REVIEW

The flagged objectives are not one-to-one, which is why a number map cannot finish the job. 701 1.2 sends deception to 4.1, gap analysis to 5.5, and Zero Trust to 3.2; 701 4.3 sends CVSS and CVE to 2.1. Smaller moves hit unflagged objectives too: shadow IT left the 701 2.1 actor list for 801 2.4, the 701 3.2 firewall types and 802.1X now sit under 801 4.1, and legal hold moved from 701 4.8 to 801 5.4. Basically, a number map retags and only a person re-reads. My own ITN 260 week overview pages cite 701 objective numbers, so moving them to 801 means this map plus that review.

What you need to know for SY0-801

• SY0-801 has 27 objectives in five domains; 1.4 and 4.9 do not exist.
• An objective number is domain and position, and the verb is the opening word of the title: Explain (11 objectives), Given a scenario (9), Summarize (4), Describe (2), or Compare and contrast (1).
• The nine scenario objectives are 1.2, 2.5, 3.2, 4.1, 4.3, 4.5, 4.6, 4.8, and 5.6.
• Describe appears only on 2.2 (threat actors) and 2.3 (threat vectors and sources); Compare and contrast appears only on 3.1 (architecture models).
• 2.5 is indicators of malicious activity; 4.5 is identity and access management; 4.6 is automation and orchestration; mitigations, firewalls, and endpoint security live in 4.1.
• “Attack surfaces” sits with vulnerabilities in 2.4; 2.3 is vectors and sources.
• Objective 4.1 is the largest in the document, 17 top-level bullets from hardening to secrets scanning.
• For scenario objectives, practice decisions, not definitions: pick a backout plan (1.2), rank scan findings (4.3), and choose an automation (4.6).
• Scenario objectives are the most likely PBQ source; no CompTIA document limits PBQs to them.
• Take verbs and titles from Document Version 2.0, not the V8 web page summary, which lists different verbs.
• If your material carries 701-era numbers, retag with a single-pass anchored lookup, then re-read anything tagged 701 1.2, 2.2, 2.5, 4.1, 4.3, or 4.5.
• A matching title does not mean a matching number: 701-era 1.4 cryptography is 801 1.3, and 701-era 2.4 indicators is 801 2.5.

Check yourself

1. A candidate’s 701-era flashcards tag every SAML, OAuth, and MFA card “4.6.” She is reorganizing them by SY0-801 objective. Where do they belong?

• A. Objective 4.6.
• B. Objective 4.5.
• C. Objective 4.1.
• D. Objective 2.4.

Answer: B. 701 4.6, identity and access management, is now 801 4.5. Keeping 4.6 is the trap: on 801, 4.6 is automation and orchestration.

2. An instructor retags a quiz bank by running these replacements in order: 2.1 to 2.2, 2.2 to 2.3, 2.3 to 2.4, 2.4 to 2.5, then 2.5 to 4.1. A threat-actor question starts tagged 701 2.1. Where does it end?

• A. 2.2, the correct 801 objective.
• B. 2.5, indicators of malicious activity.
• C. 4.1, mitigating controls.
• D. 2.1, because the tag is unchanged.

Answer: C. Each rule rewrites the previous rule’s output, so the tag cascades to 4.1. A single-pass lookup gives the correct 2.2.

3. Which change promotes an objective from Explain to Given a scenario on SY0-801?

• A. Incident response, 701 4.8 to 801 4.7.
• B. Vulnerability management, 701 4.3 to 801 4.3.
• C. Threat actors, 701 2.1 to 801 2.2.
• D. Governance, 701 5.1 to 801 5.1.

Answer: B. 801 4.3 reads “Given a scenario, perform tasks associated with vulnerability management.” Incident response went to Summarize, threat actors to Describe, and governance from Summarize to Explain.

This is T-37 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-36: Objective 1.1 Now Starts With Defense in Depth. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

CompTIA. n.d.a. “Approach to Performance-Based Testing.” CompTIA Exam Development. Accessed October 12, 2026.

CompTIA. n.d.b. “Performance-Based Questions Overview.” CompTIA Exam Development. Accessed October 12, 2026.

Krathwohl, David R. 2002. “A Revision of Bloom’s Taxonomy: An Overview.” Theory Into Practice 41 (4): 212 to 218.