Category: Network Security

An intrusion does not need to bring its own software. A modern endpoint already ships with interpreters, administrative utilities, and management agents that can read credentials, move laterally, and persist across reboots, and most of them carry a valid vendor signature. Living off the land (LOTL) is the abuse of those native, trusted tools in place of a new malicious executable. Fileless malware is the related family of attacks whose payload lives in memory, the registry, or the WMI repository rather than in a file on disk. Both exist because the oldest endpoint control, scanning a file and matching its hash against a known-bad list, has nothing to match when the only executables involved are legitimate ones and the payload was never written out.

SY0-801 objective 2.3 adds an endpoint-based vector group that names built-in tools, living-off-the-land tools, and trusted devices, and objective 2.5 adds fileless malware to the malware list and malicious processes to the indicators of compromise, all new in SY0-801 (CompTIA 2025). These items test one skill: recognizing an intrusion that never drops a new executable, and knowing which telemetry exposes it when every hash comes back clean. If your mental model of detection is “scan the file, match the hash,” this topic will mislead you.

Living off the land: the attacker uses your tools

The February 7, 2024 joint guide from CISA, NSA, FBI, and seven partner agencies defines living off the land as “the abuse of native tools and processes on systems,” especially living-off-the-land binaries (LOLBins), which blend in “because these tools are already deployed and trusted in the environment” (CISA et al. 2024a). A LOLBin is a legitimate executable that an attacker repurposes: the same binary an administrator uses to back up a directory can, under a stolen account, copy that directory to an attacker instead.

Two consequences follow from that definition, and both shape detection. First, LOLBins carry trusted attributes such as file hashes and digital signatures, so any control keyed to a known-good hash or signer lets them through; the binary is not malicious, the use is. Second, the activity produces few conventional indicators of compromise (IoCs), the observable artifacts such as file hashes, domains, and IP addresses that signal an intrusion, because nothing new was downloaded and nothing unknown was written. The guide also cites GTFOBins for Unix and LOOBins for macOS, so LOTL is not a Windows-only problem (CISA et al. 2024a).

Built-in tools, living-off-the-land tools, and trusted devices

CompTIA lists “Built-in tools” and “Living-off-the-land tools” as separate vectors and defines neither. A defensible reading separates them by origin. Built-in tools are the binaries and interpreters that ship with the operating system: PowerShell, WMI, cmd.exe, and certutil on Windows; ntdsutil on a domain controller; bash, ssh, and curl on Linux. Living-off-the-land tools are the wider set of trusted software already deployed in an environment, which the joint guide extends to remote monitoring and management, patch management, mobile device management (MDM), endpoint configuration management, and EDR consoles, any of which can run commands on every host it manages (CISA et al. 2024a). On the exam, both items point at the same idea: legitimate tooling misused, with no new malware binary.

“Trusted devices” is the third item in the group, also undefined by CompTIA. The likely meaning is a managed endpoint that other systems trust because of what it is: domain-joined, holding a device certificate, or reporting compliant to MDM. That trust is itself the vector. An attacker who lands on an administrator’s workstation inherits its network reach and its standing with the domain controllers, and LOTL activity from that host looks like the administrator’s normal work. NIST SP 800-207 rejects implicit trust granted “based on asset ownership” (Rose et al. 2020); device health as a Zero Trust input is at T-21.

The reference case: Volt Typhoon

The reference case for LOTL is Volt Typhoon, a PRC state-sponsored group. Advisory AA24-038A calls LOTL “a hallmark” of the group and reports footholds held for at least five years in some victim networks. In one intrusion the actors used Windows Management Instrumentation (WMI) to run ntdsutil, a built-in Active Directory utility, to copy the NTDS.dit credential database and the SYSTEM registry hive from a volume shadow copy (CISA et al. 2024b). No exploit, no dropper, and no custom tool appear anywhere in that chain; it is domain administration, performed by the wrong people.

Every binary in the chain was Microsoft-signed, so hash matching had nothing to match. The joint guide’s answer is process creation logging plus context: Windows Security Event 4688 and Sysmon Event ID 1 both capture the ntdsutil command line, and creating a snapshot with ntdsutil is not a regular event in most enterprises (CISA et al. 2024a). The signal is not that ntdsutil ran; it is that ntdsutil ran from WMI against a shadow copy, under an account and at an hour where it has no business running.

Fileless malware is a spectrum

CompTIA does not define “fileless malware,” and Microsoft’s own documentation says “there’s no one definition for fileless malware.” The useful way to reason about it is as a spectrum of file involvement rather than a yes-or-no property. Microsoft’s three-type model sorts fileless threats by how much the attack touches the file system, and each type maps onto a different place a defender has to look (Microsoft n.d.-h):

Type	File activity	Microsoft’s example	Where defenders look
I	None	Network exploit leaving a backdoor in kernel memory; firmware implants	Memory capture, firmware integrity
II	Indirect	PowerShell command stored in the WMI repository, run by a WMI filter	WMI subscriptions, script logs
III	Files required, useless as evidence	Kovter: registry-stored script run through mshta.exe	Registry, process chains

The types differ in what they leave for a scanner. A Type I kernel-memory backdoor never writes a file at all. A Type II payload sits inside a legitimate Windows data store, the WMI repository, rather than in an executable. Kovter, the Type III example, needed files on disk but kept its script in the registry and ran it through mshta.exe, a built-in Windows binary, so nothing on disk was worth scanning.

When I teach this in ITN 260, I draw the line this way: fileless describes where the payload lives (memory, the registry, the WMI repository), and LOTL describes which tools run it. They overlap, because most fileless chains execute through a built-in interpreter, but they are not synonyms. The Volt Typhoon ntdsutil step was LOTL, yet it wrote a database copy to disk; a kernel-memory backdoor is fileless, yet it may have arrived through an exploit rather than a native tool.

Persistence, the attacker’s mechanism for relaunching after the host restarts, decides what survives a reboot. A payload that exists only in RAM dies with the power cycle unless it lives in firmware, which is why volatile evidence is captured before shutdown (memory dumps are at T-8). Types II and III relaunch from a WMI subscription or a registry key, so they survive the reboot while the startup folders stay clean. Delivery vectors such as embedded macros were covered at T-31.

Detecting behavior instead of files

Process creation and the parent-child pair

Every LOTL or fileless chain still creates processes, and that is the foothold for detection. Windows Security Event 4688 records process creation but omits the command line until you enable “Include command line in process creation events” (Microsoft n.d.-f); without that setting the log says only that powershell.exe started, not what it was asked to do. Sysmon Event ID 1 goes further, logging the full command line of the new process and of its parent, plus a ProcessGuid that keeps correlation intact when Windows reuses process IDs (Russinovich and Garnier 2026).

The parent and child pair is the signal. Word starting PowerShell is rarely legitimate, because a document editor has no ordinary reason to launch a shell; PowerShell started from an administrator’s console usually is. The same binary, with the same clean hash, is benign or malicious depending on who spawned it and with what arguments.

Script content: script block logging and AMSI

Script content is the next layer down. Script block logging writes Event ID 4104 to the Microsoft-Windows-PowerShell/Operational log and records the content of every script block PowerShell processes, so code that never touched disk still lands in the log (Microsoft n.d.-b). This is the control that matters most for fileless chains: a base64 payload decoded and run in memory leaves no file to scan, but the decoded script block is logged all the same. Microsoft advises pairing it with Protected Event Logging, because logged scripts can contain credentials (Microsoft n.d.-b).

The Antimalware Scan Interface (AMSI) attacks obfuscation from the other side. A script may pass through several rounds of de-obfuscation, but it must eventually reach the engine as plain code, and that is the moment AMSI submits it for scanning (Microsoft n.d.-i). PowerShell, Windows Script Host, JavaScript, VBScript, and Office VBA macros all integrate with AMSI (Microsoft n.d.-c). Between script block logging and AMSI, obfuscation buys the attacker delay, not invisibility.

WMI persistence and code injection telemetry

Sysmon Event IDs 19, 20, and 21 record a WMI event filter, a WMI event consumer, and the binding between them, which are the three parts of Type II persistence; the payload fires only when all three exist, so the trio appearing together in the log is the persistence being installed. Event ID 8 (CreateRemoteThread) and Event ID 25 (ProcessTampering, which flags hollowing) catch code moving into another process (Russinovich and Garnier 2026). Hollowing replaces a legitimate process’s code in memory, so the hash on disk stays clean while the process running under that name is not.

Baselines and hunting

Logs alone drown analysts. The joint guide’s first detection practices are centralized, write-once logging and baselines of which LOLBins run, with which command lines, under which accounts, with alerts on deviation. It also recommends matching on OriginalFileName from the PE header, because a renamed net.exe still reports its real name (CISA et al. 2024a). A baseline changes the question from “is this binary bad,” which it never is, to “is this use of this binary normal here,” which is the only question LOTL leaves open.

In Microsoft Defender XDR advanced hunting, a first pass at the classic Office-to-script-host chain uses columns from the DeviceProcessEvents schema (Microsoft n.d.-g):

// Office apps that spawned a script host or common LOLBin, last 7 days
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Expect some legitimate hits; Microsoft notes that line-of-business apps sometimes spawn Command Prompt or PowerShell for benign reasons (Microsoft n.d.-e). Tune those into the baseline instead of deleting the query.

Restricting the tools without removing them

Detection finds the abuse after the fact; hardening narrows what the tools can do in the first place. Application control and EDR as 4.1 controls get full treatment at T-16, so what follows is pointers. Microsoft’s attack surface reduction rules include “Block all Office applications from creating child processes,” “Block execution of potentially obfuscated scripts,” and “Block persistence through WMI event subscription,” which map one to one onto the parent-child, obfuscation, and Type II mechanisms above (Microsoft n.d.-e). Unless a use case requires them, Microsoft recommends blocking mshta.exe, wmic.exe, wscript.exe, cscript.exe, msbuild.exe, and others with App Control (Microsoft n.d.-d).

PowerShell gets special treatment because it is both a daily administrative tool and a favorite attacker interpreter. Under an AppLocker or App Control policy, PowerShell runs untrusted scripts in ConstrainedLanguage mode, which cuts off the .NET and COM APIs attackers favor (Microsoft n.d.-a). Do not remove PowerShell outright; the 2022 joint sheet from NSA, CISA, and the New Zealand and UK NCSCs recommends configuring and monitoring it instead (NSA et al. 2022). Restricting, logging, and baselining the interpreter keeps the tool and takes away the abuse.

What you need to know for SY0-801

• Living off the land means misusing legitimate, already-present, trusted tools; no new executable arrives, and conventional IoCs are scarce.
• Built-in tools ship with the operating system (PowerShell, WMI, cmd.exe, certutil, ntdsutil, bash, ssh, curl); living-off-the-land tools extend to deployed management software such as MDM, patch management, and EDR consoles.
• A trusted device is a managed endpoint that other systems trust for what it is (domain-joined, certificate-holding, MDM-compliant); the trust itself is the vector.
• Fileless malware keeps its payload in memory, the registry, or the WMI repository instead of a standalone file; it is related to LOTL but not a synonym.
• If the scenario says the file hash matches a signed vendor binary, the hash IoC is the distractor; look for malicious processes (odd parent, encoded command line, unusual account or hour).
• If the scenario says “nothing on disk” or “returns after reboot with clean startup folders,” think fileless with WMI or registry persistence.
• If a compromised administrator workstation runs signed Windows utilities against a domain controller, think trusted device plus LOTL.
• Signature-based antivirus is the usual wrong answer; behavior-based EDR, script block logging, AMSI, and baselines are the right family.
• Event 4688 with command line auditing and Sysmon Event ID 1 record process creation; Event ID 4104 records script blocks; Sysmon 19, 20, and 21 record WMI persistence.
• “Remove PowerShell” is a distractor; restrict it, log it, and baseline it.
• Bloatware (unwanted preinstalled software) is 701-era vocabulary; the SY0-801 malware list has adware instead, software that shows or injects ads or redirects browsing for revenue.

Check yourself

These are original practice questions, not exam items.

1. An EDR alert shows WINWORD.EXE launching powershell.exe with a long base64 argument on a finance workstation. The analyst confirms that the PowerShell binary’s SHA-256 matches Microsoft’s signed release and finds no new executables on disk. Which SY0-801 2.5 indicator best supports escalation?

• A. Hash.
• B. Malicious processes.
• C. Domain.
• D. Excessive resource consumption.

Answer: B. The hash is clean because the binary is legitimate; what is abnormal is the parent and child relationship and the encoded command line. That is a malicious process indicator.

2. After a reboot, a workstation resumes beaconing every 30 minutes. Its startup folders, Run keys, and scheduled tasks are clean, and no unknown files exist on disk. Sysmon logged Event IDs 19, 20, and 21 two days earlier. What is the most likely persistence mechanism?

• A. A logic bomb in a scheduled task.
• B. A WMI event subscription.
• C. A rootkit in the boot record.
• D. Adware installed as a browser extension.

Answer: B. Sysmon 19, 20, and 21 record a WMI filter, consumer, and binding, which together relaunch a payload stored in the WMI repository; that is Microsoft’s Type II fileless pattern. Scheduled tasks were already ruled out, and nothing points to the boot record.

3. A security team wants to reduce abuse of PowerShell without breaking administrators’ scripts. Which approach best matches published joint guidance?

• A. Uninstall PowerShell from every endpoint, including administrator workstations.
• B. Enable script block logging and enforce application control so untrusted scripts run in ConstrainedLanguage mode.
• C. Add the hash of powershell.exe to the EDR block list on all servers.
• D. Rename powershell.exe on every host so commodity scripts cannot find it.

Answer: B. The joint guidance favors configuring and monitoring PowerShell over removing it; logging records what runs, and application control limits what untrusted scripts can reach. Blocking the signed binary’s hash breaks administration, and a renamed binary still reports its OriginalFileName.

This is T-30 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-29: Objective 2.4 Rebuilt Around Attack Surfaces, Secrets, and Public Buckets. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA (Cybersecurity and Infrastructure Security Agency) et al. 2024a. “Identifying and Mitigating Living Off the Land Techniques.” Joint guidance. February 7, 2024.

CISA (Cybersecurity and Infrastructure Security Agency) et al. 2024b. “PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure.” Cybersecurity Advisory AA24-038A. February 7, 2024.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Microsoft. n.d.-a. “about_Language_Modes.” PowerShell documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-b. “about_Logging.” PowerShell documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-c. “Antimalware Scan Interface (AMSI).” Win32 documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-d. “Applications That Can Bypass App Control and How to Block Them.” Windows security documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-e. “ASR Rules Reference.” Microsoft Defender for Endpoint documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-f. “Command Line Process Auditing.” Windows Server documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-g. “DeviceProcessEvents Table in the Advanced Hunting Schema.” Microsoft Defender XDR documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-h. “Fileless Threats.” Microsoft Defender for Endpoint documentation, Microsoft Learn. Accessed October 12, 2026.

Microsoft. n.d.-i. “How AMSI Helps You Defend Against Malware.” Win32 documentation, Microsoft Learn. Accessed October 12, 2026.

NSA (National Security Agency) et al. 2022. Keeping PowerShell: Security Measures to Use and Embrace. Cybersecurity Information Sheet. June 22, 2022.

Rose, Scott, Oliver Borchert, Stu Mitchell, and Sean Connelly. 2020. Zero Trust Architecture. NIST Special Publication 800-207.

Russinovich, Mark, and Thomas Garnier. 2026. “Sysmon.” Sysinternals, Microsoft Learn. Published September 10, 2026.

A threat vector is the path an attacker uses to reach a target: the channel that carries a lure, a file, or an exploit from the adversary to a victim’s device, account, or network. A threat source is the adversary at the other end of that path. Defenders keep the two ideas separate because controls attach to channels. Mail filtering sits on the email vector, an AutoPlay setting sits on the removable media vector, and a firewall rule sits on the remote access vector, so knowing which channel delivered a payload tells a responder which control was bypassed and which one to check next.

SY0-801 objective 2.3, “Describe threat vectors and sources,” expands the vector list with named sub-bullets for the channels that show up in current incident reports: Rich Communication Services (RCS) and collaboration tools, QR codes and fake CAPTCHAs, macro, RTF, and PDF attachments, malicious USB devices, remote access services, edge appliances and hypervisors, and SaaS and logistic providers (CompTIA 2025). The objective is built as one source, the advanced persistent threat (APT), followed by vector categories named for their channel: message-based, image-based, attachment-based, external media-based, remote access, network-based, and supply chain-based, among others. Describing a vector on this exam means naming the channel and the trust it abuses. Browser-based, endpoint-based, IoT, OT, physical, and signal-based vectors have their own posts (T-28, T-30, T-22, and T-26), and the human-based lures are covered at T-27.

Sources versus vectors: the advanced persistent threat

The objective title pairs vectors with sources, and the APT is the only source on the list. NIST SP 800-30 Rev. 1 defines an APT as an adversary with “sophisticated levels of expertise and significant resources” that uses multiple attack vectors and pursues its objectives “repeatedly over an extended period of time” (NIST, n.d.). The definition has three parts worth holding apart: capability (expertise and resources), breadth (multiple vectors rather than one), and persistence (an extended period rather than a single intrusion). Basically, a vector answers how the payload arrived; the APT answers who sent it and how long they intend to stay.

That distinction is what a scenario tests. A stem that stresses months of undetected access, a custom implant on an edge appliance, or an adversary that returns through a second channel after the first is closed is pointing at APT as the source, even though each individual entry used an ordinary vector such as a VPN appliance or a phishing message. The actor label for that adversary is usually State-sponsored, which belongs to T-32.

Message-based vectors: RCS and collaboration tools

A message-based vector delivers the lure through a conversation channel the victim already uses: email, SMS, instant messaging, RCS, or a workplace collaboration tool. The attacker’s problem on any of these channels is the filter between sender and reader, and the two newest sub-bullets matter precisely because of where that filter is missing.

RCS is “a carrier-provided service,” and GSMA positions its Universal Profile as the successor to SMS; the current specification is Universal Profile 4.1, published July 28, 2026 (Apple 2026; Van Pelt 2026). Where SMS moves short plain-text messages through the carrier, RCS moves richer messaging through the same carrier relationship, and it is now getting the encryption that SMS never had. GSMA announced end-to-end encryption based on the Messaging Layer Security (MLS) protocol on March 14, 2025, and Apple’s iOS 26.5 labels cross-platform encrypted RCS “Beta,” available “with supported carriers” (GSMA 2025; Apple 2026).

For defenders, encryption cuts the other way. A carrier SMS firewall works by reading message content and dropping known lure patterns and malicious URLs; an end-to-end encrypted channel removes that inspection point entirely. Netcraft documented the darcula phishing kit sending lures over RCS and iMessage instead of SMS, which bypasses carrier SMS firewalls because operators cannot inspect encrypted content; it counted more than 20,000 darcula domains targeting 100+ brands (Everett 2024). The postal-delivery lure text is the same smish a user has seen before; what changed is that the filter in front of it is gone.

Collaboration tools abuse a different trust: the internal-feeling chat window. A chat that opens inside Microsoft Teams looks like it came from a colleague, but Teams external access defaults to “Allow all external domains,” so any Microsoft 365 tenant that also allows external access can start a chat (Microsoft 2026b). A tenant is an organization’s own Microsoft 365 instance, and the display name an incoming chat shows is the one the sending tenant chose. Microsoft reported Storm-1811, a Black Basta affiliate, creating tenants with display names such as “Help Desk IT” and “IT Support,” then talking victims into Quick Assist sessions; Teams use was observed at the end of May 2024. Microsoft’s user-level mitigation is to check the “External” tag (Microsoft Threat Intelligence 2024a). The vector is the chat; the remote-assistance session is the next stage, not the delivery channel.

Image-based vectors: QR codes, embedded content, and fake CAPTCHAs

An image-based vector hides the malicious element inside something the user, or the filter, treats as a picture. The objective names three forms: QR codes, embedded content, and CAPTCHA.

A QR code is a two-dimensional barcode that encodes data, usually a URL, so a phone camera can open the link with no typing. That convenience is the attack: QR codes carry a URL past text-based link scanning, because a mail filter that extracts and checks URLs from a message body finds nothing when the link exists only as pixels until a camera decodes it. The quishing mechanics, i.e., what happens after the scan, are T-27’s.

“Embedded content” has no CompTIA definition; the likely meaning, an interpretation, is a payload hidden inside a benign-looking file, as in ATT&CK T1027.017 SVG Smuggling (script inside an SVG image) and T1027.006 HTML Smuggling (MITRE 2025c). An SVG is a text-based image format, so a file that a filter classifies as an image can carry script that the browser runs when it renders the picture; the image is the wrapper, and the content is the payload.

CAPTCHA appears in two roles. A CAPTCHA is a challenge designed to tell a human from an automated client, and attackers use both the human’s trust in it and the robot’s inability to pass it. As a lure, it is ClickFix, ATT&CK T1204.004 Malicious Copy and Paste: a fake “verify you are human” page tells the user to open the Run dialog and paste a “verification” string that page script already placed on the clipboard (MITRE 2025a). Microsoft first observed the technique between March and June 2024, and its most prolific final payload is Lumma Stealer (Microsoft Threat Intelligence 2025). As a wrapper, a Cloudflare Turnstile gate in front of a credential page keeps automated anti-phishing scanners from reaching the form (Check Point 2023). What a responder sees after a ClickFix click:

Lure (rendered page):  "Verify you are human"  [ ] I'm not a robot
                       1. Press Windows+R   2. Press Ctrl+V   3. Press Enter
Clipboard source:      navigator.clipboard.writeText(...)  (page script)
Run dialog owner:      explorer.exe
Child process:         powershell.exe  (most-used binary per Microsoft)
Artifact on host:      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
                       (value holds the pasted string)
Mitigations:           GPO "Remove Run menu from Start Menu";
                       PowerShell script block logging;
                       Windows Terminal multi-line paste warning

Because the user runs the command, email filtering, browser sandboxing, and controls on downloaded files never see a file. The browser was only the display surface for the instructions, which is why the vector is image-based rather than browser-based. Detection by parent-child process chain belongs to T-30; here, recognize the vector.

Attachment-based and external media vectors: three file carriers and a keyboard

An attachment-based vector delivers a file that carries its own execution mechanism, so opening it is enough to start the payload. The objective names three carriers, each with a distinct payload mechanism and a triage tell.

Carrier	Payload mechanism	Triage tell
Embedded macros	VBA auto-exec procedures such as Document_Open	olevba flags AutoExec plus Suspicious keywords
RTF documents	OLE objects, e.g., Equation Editor exploit CVE-2017-11882	rtfobj flags the Equation 3.0 CLSID
PDFs	JavaScript run by an automatic action	pdfid counts /JS and /OpenAction or /AA

A macro is code stored inside a document that runs inside the application that opens it; in Office that code is Visual Basic for Applications (VBA), and auto-exec procedures such as Document_Open run as soon as the file opens. Office blocks VBA macros in files from the internet by default (Current Channel version 2206, July 27, 2022). The block keys on Mark of the Web, the NTFS Zone.Identifier stream with ZoneId=3 that records a downloaded file as having come from the internet zone, and it applies only to Office on Windows, which is the trap: candidates over-generalize “macros are off” (Microsoft 2026a). A document opened in Office on a platform other than Windows, or one that reaches disk without the mark, gets no block.

An RTF document carries its payload as an embedded OLE object, and the classic case is the Equation Editor exploit CVE-2017-11882, a stack buffer overflow in eqnedt32.exe, which ran as a separate COM server without ASLR, so Office’s own mitigations missed it; Microsoft removed Equation Editor 3.0 in January 2018 (CERT/CC 2017). A PDF carries JavaScript that an automatic action runs when the document opens, and a one-page PDF with JavaScript and an /OpenAction is the classic malicious pattern: the content gives no reason for code to run on open.

“Malicious USB,” the external media-based sub-bullet, has two sub-cases. Autorun malware on storage is stopped by disabling AutoPlay. A keystroke-injection device is different: it is a USB device that enumerates as a keyboard and types commands, and the operating system trusts a keyboard. FIN7 mailed USB sticks disguised as HHS letters and Amazon gift boxes that would “register itself as a keyboard” and type PowerShell commands (Cimpanu 2022). ATT&CK tracks this as T1674 Input Injection (MITRE 2025b). Because the operating system trusts a keyboard, autorun and USB-storage blocks do not stop it; device-installation restrictions by device class or ID, and physical port control, do.

Remote access, edge devices, hypervisors, and providers

The last group of vectors reaches the target without a user at all. Remote access names three services. Remote desktop, RDP, listens on TCP 3389. VNC uses the Remote Framebuffer protocol on TCP 5900; RFC 6143 defines security type 1, None, and a DES challenge-response that truncates the password to eight characters, and its Section 9 says the protocol “provides no security beyond the optional and cryptographically weak password check” (Richardson and Levine 2011). A check against a documentation address shows what an attacker learns:

$ nmap -p 5900 --script vnc-info 198.51.100.10
PORT     STATE SERVICE
5900/tcp open  vnc
| vnc-info:
|   Protocol version: 3.8
|   Security types:
|     None (1)
|_  WARNING: Server does not require authentication

The VPN sub-bullet is the appliance itself, not the tunnel. Network-based “Infrastructure devices” and “Virtualized devices” share the reason they are prized: Mandiant reports firewalls, VPNs, and virtualization platforms “rarely support EDR deployment,” and their exploits “typically require no user interaction” (Mandiant 2024). An edge appliance sits at the network boundary with a public listener, runs a vendor operating system that rarely accepts an endpoint agent, and holds the sessions of everyone who connects through it. Citrix Bleed, CVE-2023-4966, leaked memory containing valid session cookies from NetScaler appliances, letting LockBit affiliates bypass passwords and MFA; CISA’s fix included killing active sessions as well as patching, because a patch does not invalidate a cookie that was already stolen (CISA 2023). CISA Emergency Directive 24-01, issued January 19, 2024, addressed Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887 (CISA 2024). A hypervisor is the layer that hosts many virtual machines on one physical server, which makes it the highest-yield target on the list: ESXi CVE-2024-37085 granted full admin to an Active Directory group named “ESX Admins,” and ransomware operators then encrypted the datastore, every hosted VM at once (Microsoft Threat Intelligence 2024b). Session keys, the third network-based sub-bullet, are T-28’s.

Supply chain-based vectors reach the target through a third party that already has access. A managed service provider (MSP) runs IT for many customers through a shared remote-management tool, so one compromise fans out downstream: Kaseya VSA (July 2021) is the MSP case, in which one remote-management tool delivered ransomware to many downstream customers (CISA 2021). A SaaS provider holds an integration token rather than a management agent, and the token is enough: UNC6395 in August 2025 used stolen OAuth tokens for the Salesloft Drift app to export Salesforce data, and Google says the activity did not stem from “a vulnerability within the core Salesforce platform” (Larsen et al. 2025). The victim’s own platform was not broken; a partner’s credential to it was. “Logistic providers” has no CompTIA definition; the likely meaning (an interpretation) is shipping, fulfillment, and delivery partners with facility or system access.

What you need to know for SY0-801

• APT is a source (who, how persistent); everything else in 2.3 is a vector (how delivered).
• Vector is 2.3, the exposure is 2.4, the observed attack is 2.5: the QR code is a 2.3 image-based vector, quishing is a 2.5 attack.
• RCS is carrier-provided and SMS’s successor; its cross-platform encryption is new, beta, and carrier-dependent, and it hides lures from SMS filtering.
• A chat from an outside tenant named “Help Desk” is Message-based, Collaboration tools; the “External” tag is the user-level tell.
• A page saying Win+R, Ctrl+V, Enter is Image-based, CAPTCHA (ClickFix), not Browser-based; no file is ever downloaded.
• Macro blocking needs Mark of the Web and Windows Office; RTF hides OLE exploits; PDFs hide JavaScript.
• Disabling autorun does not stop a USB device that enumerates as a keyboard; device-installation restrictions and port control do.
• RDP is TCP 3389; VNC is TCP 5900 and may allow no authentication at all.
• Edge appliances and hypervisors rarely support EDR, and one compromise reaches many hosts.
• Supply chain-based covers MSPs, SaaS providers, and logistic providers; a stolen partner OAuth token is a supply chain vector.
• Voice call, Default credentials, and Client-based vs. agentless are 701-era vectors with no 801 entry; vishing lives in 2.5.
• “Embedded content” and “Logistic providers” have no CompTIA definition.

Check yourself

These are my own practice questions, written for this post.

1. An employee visits a site showing a CAPTCHA that instructs, “Press Windows+R, then Ctrl+V, then Enter to verify.” Minutes later, EDR shows explorer.exe launching powershell.exe. Which SY0-801 2.3 vector best describes the delivery?

• A. Browser-based.
• B. Image-based.
• C. Attachment-based.
• D. Human-based.

Answer: B. CAPTCHA is an Image-based sub-bullet in 801, and the fake verification page is the ClickFix lure. No file was attached, and the browser was only the display surface.

2. A finance analyst receives a Microsoft Teams chat from an outside tenant named “IT Support” asking her to approve a remote-assistance session. Which classification fits the delivery channel best?

• A. Remote access.
• B. Supply chain-based.
• C. Message-based, collaboration tools.
• D. Default credentials.

Answer: C. The lure arrived as a chat from an external tenant, which is the Collaboration tools sub-bullet. Default credentials is not an 801 vector, and the remote session is what the attacker wants, not how the lure arrived.

3. A penetration tester finds TCP 5900 open on a server; the scan reports the security type None and that the server does not require authentication. Which sub-bullet applies, and why is it severe?

• A. Remote access, VNC; RFC 6143 permits a None security type, so anyone can control the desktop.
• B. Remote access, Remote desktop; port 5900 is RDP’s default.
• C. Network-based, Infrastructure devices; the server is an edge appliance.
• D. Remote access, VPN; port 5900 carries tunnel traffic.

Answer: A. Port 5900 is VNC, and security type None means no password is checked. RDP uses TCP 3389.

This is T-31 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-30: Living off the Land and Fileless Malware Arrive. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Apple. 2026. “What Is the Difference Between iMessage, RCS, and SMS/MMS?” Apple Support. Accessed October 12, 2026.

CERT/CC. 2017. “VU#421280: Microsoft Office Equation Editor Stack Buffer Overflow.” CERT Coordination Center.

Check Point. 2023. “Verify You Are Human (So We Can Steal Your Credentials).” Check Point Blog, August 15, 2023.

Cimpanu, Catalin. 2022. “FBI: FIN7 Hackers Target US Companies with BadUSB Devices to Install Ransomware.” The Record, January 7, 2022.

CISA. 2021. “CISA-FBI Guidance for MSPs and Their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack.” Last revised July 6, 2021.

CISA. 2023. “#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability.” Cybersecurity Advisory AA23-325A, November 21, 2023.

CISA. 2024. “ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities.” Emergency Directive, January 19, 2024.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Everett, Harry. 2024. “Out of the Shadows: ‘darcula’ iMessage and RCS Smishing Attacks Target USPS and Global Postal Services.” Netcraft, March 27, 2024.

GSMA. 2025. “RCS Encryption: A Leap Towards Secure and Interoperable Messaging.” GSMA Newsroom, March 14, 2025.

Larsen, Austin, Matt Lin, Tyler McLellan, and Omar ElAhdan. 2025. “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift.” Google Threat Intelligence Group, August 26, 2025.

Mandiant. 2024. M-Trends 2024: Chinese Espionage Operations Targeting the Visibility Gap. Google Cloud.

Microsoft. 2026a. “Macros from the Internet Are Blocked by Default in Office.” Microsoft Learn.

Microsoft. 2026b. “Manage External Meetings and Chat with People and Organizations Using Microsoft Identities.” Microsoft Learn.

Microsoft Threat Intelligence. 2024a. “Threat Actors Misusing Quick Assist in Social Engineering Attacks Leading to Ransomware.” Microsoft Security Blog, May 15, 2024.

Microsoft Threat Intelligence. 2024b. “Ransomware Operators Exploit ESXi Hypervisor Vulnerability for Mass Encryption.” Microsoft Security Blog, July 29, 2024.

Microsoft Threat Intelligence. 2025. “Think Before You Click(Fix): Analyzing the ClickFix Social Engineering Technique.” Microsoft Security Blog, August 21, 2025.

MITRE. 2025a. “Malicious Copy and Paste, T1204.004.” MITRE ATT&CK.

MITRE. 2025b. “Input Injection, T1674.” MITRE ATT&CK.

MITRE. 2025c. “SVG Smuggling, T1027.017.” MITRE ATT&CK.

NIST. n.d. “Advanced Persistent Threat (APT).” Computer Security Resource Center Glossary. Accessed October 12, 2026.

Richardson, T., and J. Levine. 2011. The Remote Framebuffer Protocol. RFC 6143. IETF.

Van Pelt, Tom. 2026. “RCS Universal Profile 4.1: Stronger Foundations for Secure Messaging.” GSMA Newsroom, July 28, 2026.

A threat actor is the person or group behind a security event: the one who clicks, types, pays, or gives the order, as distinct from the malware, the phishing message, or the exposed port that the actor uses to reach a target. A motivation is the reason the actor acts, and it is a separate fact from the actor’s identity, because the same person can act for money one week and out of spite the next. The distinction matters outside the exam room: a defender who misnames the actor chooses the wrong containment, and one who misreads the motivation predicts the wrong next move.

SY0-801 objective 2.2, “Describe common threat actors and motivations,” is an expanded treatment of the topic, with eight actors, twelve motivations, and three attributes (CompTIA 2025). The eight actors are Unskilled attacker, Hacktivist, State-sponsored, Crime syndicate/organized crime, Insider, Terrorist, Competitor, and Accidental/unintentional. The twelve motivations are Espionage, Ethical, Revenge, Financial, Extortion, Fear/chaos, Ideological, Political, Influence, Intellectual property, Notoriety, and General curiosity. The three attributes used to characterize any actor are Internal/external, Resources/funding, and Level of sophistication/capability.

The actor that deserves the closest reading is Accidental/unintentional, the only one defined by the absence of intent: a scenario can describe real damage with no motivation behind it at all. The rest of the objective is a classification exercise, and the method that holds up under pressure is to treat the label, the motivation, and the attributes as three separate decisions, made in that order.

Three decisions: label, motivation, and attributes

The label answers who acted. Four of the eight actors are defined by what the actor is. A State-sponsored actor is directed or funded by a government. A Crime syndicate/organized crime actor is a group that attacks as a business. A Competitor is a rival organization in the victim’s own market. An Insider is someone who holds, or held, trusted access to the victim’s systems or facilities. Three more are defined by what the actor wants or how it operates: a Hacktivist attacks in service of a cause, a Terrorist seeks to put fear into a population, and an Unskilled attacker runs tools other people built without the ability to adapt them. The eighth, Accidental/unintentional, is defined by the absence of a want at all, and it gets its own section below.

The motivation answers why, and the twelve options sort into five families that are easier to hold than a flat list. Money: Financial is the broad case (card theft for resale, crypto heists), and Extortion is the coercive case (pay, or we encrypt or leak). Information: Espionage collects secrets, Intellectual property targets designs, code, and trade secrets, and Influence shapes opinions or decisions rather than taking anything. Cause: Ideological is a belief about how the world should work (protesting a company’s environmental record), and Political targets a government, its policy, or an election. Self: Notoriety needs an audience (posting, claiming credit), General curiosity is private exploration, and Ethical covers authorized testing and coordinated disclosure. Harm: Fear/chaos targets a population, and Revenge targets a specific organization or person over a grievance. The families are a study aid, not CompTIA’s grouping; the objective lists the twelve flat.

The attributes describe the actor once it is labeled. Internal/external is position relative to the trust boundary, not the network path. Resources/funding is the money, people, and time behind the actor. Level of sophistication/capability is whether the actor builds and adapts its tooling or only runs it. The attributes are kept separate from the label because they vary inside it: a state-backed group can be clumsy and a small criminal crew can be excellent, and the cases later in this post show both.

The eight labels line up closely with taxonomies practitioners already use. NIST SP 800-30 Rev. 1 has a Competitor subtype and an ACCIDENTAL source type, and the VERIS enumerations include Competitor, Terrorist, Organized crime, and “State-sponsored or affiliated group” (NIST 2012; VERIS Community n.d.b). CompTIA publishes no mapping to either, but a reader who knows one of them will recognize most of 2.2 on sight.

Accidental actors: harm with no intent

NIST SP 800-30 Rev. 1, Table D-2, sorts threat sources into four types: ADVERSARIAL, ACCIDENTAL, STRUCTURAL, and ENVIRONMENTAL. ACCIDENTAL means “Erroneous actions taken by individuals in the course of executing their everyday responsibilities,” with two subtypes, User and Privileged User/Administrator (NIST 2012). Adversarial sources are characterized by Capability, Intent, and Targeting; accidental sources by Range of effects alone. Basically, NIST scores an accident only on potential damage, because there is no intent to score, and that is exactly the logic of an actor with no motivation. Do not stretch the label: equipment failure (STRUCTURAL) and natural disasters (ENVIRONMENTAL) have no equivalent on the 2.2 actor list.

The sources disagree on where accidents belong. CISA files them under insider threat, which covers “malicious, complacent, or unintentional acts,” and its accidental example is mistyping an email address and sending a sensitive document to a competitor (CISA n.d.). SY0-801 lists Insider and Accidental/unintentional as separate actors, so on the exam the deciding fact is whether the act was a mistake or deliberate. VERIS, the incident schema behind Verizon’s Data Breach Investigations Report, adds a useful rule: Error actions carry motive NA, and an insider whose misconfiguration only contributed to another actor’s breach is not counted as an actor at all (VERIS Community n.d.a). If an attacker exploits a mistake, the attacker is the actor and the mistake is a vulnerability (misconfiguration, covered at T-29).

For scale, the 2026 DBIR reports internal actors in 44 percent of Public Administration breaches, with an unusually high rate of Miscellaneous Errors, especially Misdelivery. Its headline figure, a human element in 62 percent of breaches, is broader than accidents, so do not quote it as an error rate (Verizon 2026).

Same person, same data, opposite intent

VERIS makes the distinction mechanical. These two illustrative records (not real incidents) use only VERIS 1.4 field names and enumeration values. First, the accident:

{
  "schema_version": "1.4.0",
  "incident_id": "3f2c9a1e-7b4d-4e2a-9c61-0d8e5a7b1c22",
  "security_incident": "Confirmed",
  "summary": "Payroll clerk attached the wrong spreadsheet to an email to a benefits vendor.",
  "timeline": {"incident": {"year": 2026, "month": 10}},
  "actor": {"internal": {"variety": ["Finance"], "motive": ["NA"]}},
  "action": {"error": {"variety": ["Misdelivery"], "vector": ["Carelessness"]}},
  "asset": {"assets": [{"variety": "S - Mail"}], "cloud": ["External Cloud Asset(s)"]},
  "attribute": {"confidentiality": {"data_disclosure": "Yes", "data": [{"variety": "Personal", "amount": 412}], "data_victim": ["Employee"]}},
  "discovery_method": {"internal": {"variety": ["Reported by employee"]}}
}

The second record is identical except for four fields:

{
  "summary": "Payroll clerk who was denied a promotion emailed the same spreadsheet to a personal account.",
  "actor": {"internal": {"variety": ["Finance"], "motive": ["Grudge"]}},
  "action": {"misuse": {"variety": ["Data mishandling"], "vector": ["LAN access"]}},
  "discovery_method": {"internal": {"variety": ["Data loss prevention"]}}
}

Same person, same 412 employee records, same mail server. Motive NA with an error action is Accidental/unintentional; motive Grudge with a misuse action is Insider with Revenge. Misdelivery means sending the wrong information or sending to the wrong recipient. Nothing about the damage tells you which actor you have; only the intent does, and intent is read from the action and from the surrounding facts (a denied promotion, a personal account as the destination, a DLP alert rather than a self-report).

Mapping actors to motivations

Once the label is settled, the motivation usually follows; the table gives the pairings that recur in advisories and incident data. They are typical, not rules, and are not a CompTIA mapping.

SY0-801 actor	Typical motivations	Anchor
State-sponsored	Espionage, Influence, Political; sometimes Financial	North Korean crypto heists and financial crimes net at least $1 billion a year (ODNI 2026)
Crime syndicate/organized crime	Financial, Extortion	Double extortion: encrypt and threaten to leak (CISA 2023b)
Hacktivist	Ideological, Political, Notoriety	Pro-Russia groups “primarily seeking notoriety” (CISA 2025)
Terrorist	Fear/chaos, Ideological	Terrorist shift to information operations for propaganda (ODNI 2026)
Competitor	Intellectual property, Espionage	Adversarial organization subtype (NIST 2012)
Unskilled attacker	Notoriety, General curiosity	VERIS motive “Fun, curiosity, or pride”
Insider	Revenge, Financial	Intentional insiders often want to “get even” (CISA n.d.)
Accidental/unintentional	None	VERIS motive NA; NIST Range of effects only

Ethical has no fixed actor; it fits authorized testing and coordinated disclosure. When a scenario resists the table, I use this order (my interpretation, not CompTIA’s):

1. Was the damaging act itself a mistake (wrong recipient, wrong setting, wrong file)? If so, the actor is Accidental/unintentional and no motivation applies. Deliberate access with no wish to harm, such as curiosity-driven probing or authorized testing, is not accidental; it carries a motivation (General curiosity, Ethical).
2. Who directs or funds the actor? A government means State-sponsored, whatever persona it uses.
3. Did the person hold trusted access when acting? Then Insider.
4. Otherwise classify by goal: money or coercion, cause, fear in a population, or business advantage. A lone actor running other people’s tools for bragging rights or curiosity is the Unskilled attacker.
5. Use the attributes last, to describe the actor and break ties. Sophistication names an actor only in the Unskilled attacker case, and only after steps 2 to 4 found no sponsor, organization, or cause.

Step 4 maps, in order, to Crime syndicate/organized crime, Hacktivist, Terrorist, and Competitor; its last sentence covers the Unskilled attacker. Step 3 has one known edge case, the former employee, and the sources split on it: CISA defines an insider as anyone who “has or had” authorized access, while VERIS codes a former employee with no remaining access as External (CISA n.d.; VERIS Community n.d.a). If a scenario hinges on it, look for still-valid credentials (an inference).

Blurred lines: personas, proxies, and profit

The hardest scenarios describe an actor whose persona and sponsor differ, or whose stated motive and real one do.

CARR presented itself as a group of pro-Russia hacktivists. CISA assesses that GRU unit 74455 likely supported its creation in early 2022 and likely funded its DDoS tools through at least September 2024, calling it “an unattributable platform” for activity “beneath the level of an APT” (CISA 2025). According to an indictment announced December 9, 2025, the GRU “founded, funded, and directed” it; that is an allegation, and trial outcomes are unverified (U.S. Department of Justice 2025). In 2.2 terms: State-sponsored, motivated by Political and Notoriety, with low sophistication despite state resources, which is why the attributes are separate from the label.

CyberAv3ngers defaced internet-exposed Unitronics PLCs, likely through default or missing passwords, compromising at least 75 US devices, at least 34 in the water sector, from November 2023 to January 2024. CISA and partner agencies call it “an Iranian IRGC-affiliated cyber persona” and note that the US and Canada designate the IRGC a foreign terrorist organization (CISA 2023a). Treasury sanctioned six officials of the IRGC Cyber-Electronic Command on February 2, 2024 under counterterrorism authority E.O. 13224, while calling the command a government organization and noting the operation “did not disrupt any critical services” (U.S. Department of the Treasury 2024). The terrorist designation makes Terrorist tempting, but the better 2.2 reading (an interpretation) is State-sponsored, because a government organization directs it; the motivation is Political, with Fear/chaos secondary.

Lapsus$ is the reverse trap. The Cyber Safety Review Board describes a “loosely organized,” extortion-focused group that included juveniles and was not a nation-state actor; it claimed profit as its only motive, though notoriety, amusement, and ideology were also plausible (Cyber Safety Review Board 2023). Simple techniques do not make it an Unskilled attacker, because step 4 finds a goal (money by coercion) before step 5 ever looks at sophistication. The closest 2.2 label (an interpretation) is Crime syndicate/organized crime with Extortion, Notoriety, and Financial, although the CSRB itself contrasts the loosely organized group with “well-resourced cybercrime syndicates”; the objective has no separate label for a loose criminal crew. States can also chase money: ODNI reports that North Korea runs espionage and cybercrime and places IT workers with falsified credentials, which is a state actor gaining insider access (ODNI 2026).

What you need to know for SY0-801

• Eight actors: Unskilled attacker, Hacktivist, State-sponsored, Crime syndicate/organized crime, Insider, Terrorist, Competitor, and Accidental/unintentional.
• Twelve motivations: Espionage, Ethical, Revenge, Financial, Extortion, Fear/chaos, Ideological, Political, Influence, Intellectual property, Notoriety, and General curiosity.
• Three attributes: Internal/external, Resources/funding, and Level of sophistication/capability; they describe an actor and never replace the label.
• “Nation-state” is 701-era vocabulary; SY0-801 says State-sponsored, and an APT scenario usually resolves to it (APT itself is named in 2.3 as a source, covered at T-31).
• Shadow IT is no longer an actor answer; an employee’s unapproved SaaS tool is a 2.4 exposure (T-29).
• An error (misdelivery, misconfiguration) means Accidental/unintentional; deliberate access without malice does not. If an attacker exploits that mistake, the attacker is the actor and the mistake is a vulnerability.
• Extortion is coercion (pay, or we encrypt or leak); Financial is broader, e.g., card theft for resale or crypto heists.
• Espionage collects secrets; Intellectual property targets designs, code, and trade secrets and pairs with Competitor; Influence shapes opinions or decisions.
• Ideological is a cause (protesting a company’s environmental record); Political targets a government, its policy, or an election.
• Notoriety needs an audience (posting, claiming credit); General curiosity is private exploration.
• Fear/chaos targets a population; Revenge targets a specific organization or person over a grievance.
• The VERIS motive “Fear” means acting under fear or duress; it is not CompTIA’s Fear/chaos.
• A persona’s claims never decide the label; funding and direction do.

Check yourself

These are my own practice questions, written for this post.

1. A help desk technician bulk-edits group membership and mistakenly adds 300 contractors to a finance share. An audit finds the error two days later; logs show no access by anyone outside the company. Using SY0-801 2.2 terms, which actor and motivation best fit the technician?

• A. Insider; Revenge.
• B. Accidental/unintentional; no motivation applies.
• C. Insider; Financial.
• D. Unskilled attacker; General curiosity.

Answer: B. The technician’s change was a mistake, not a deliberate act against the organization, which is the line between Insider and Accidental/unintentional. Trusted access alone does not make someone an Insider actor on 801.

2. A Telegram channel of self-described patriotic volunteers claims it changed setpoints on water-plant HMIs. A later government advisory assesses that a foreign military intelligence unit created the group and funded its tools, and notes the group’s techniques were unsophisticated. Which actor label fits best?

• A. Hacktivist.
• B. Terrorist.
• C. State-sponsored.
• D. Unskilled attacker.

Answer: C. Funding and direction by a government decide the label, whatever persona the group presents. Low sophistication is an attribute describing the actor, not a reason to call it an Unskilled attacker.

3. A rival manufacturer pays a contractor at a robotics firm to copy CAD files for an unreleased gripper and uses them to shorten its own design cycle. Which actor and motivation best describe the manufacturer?

• A. Competitor; Intellectual property.
• B. State-sponsored; Espionage.
• C. Crime syndicate/organized crime; Extortion.
• D. Insider; Revenge.

Answer: A. A business rival stealing designs for economic advantage is the new Competitor actor with the new Intellectual property motivation. The contractor is an insider motivated by money, but the question asks about the organization that commissioned the theft.

This is T-32 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-31: Threat Vectors Rebuilt for RCS, QR Codes, and Fake CAPTCHAs. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA. 2023a. “IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.” Cybersecurity Advisory AA23-335A, last revised December 18, 2024.

CISA. 2023b. #StopRansomware Guide. Joint Ransomware Task Force, October 2023.

CISA. 2025. “Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure.” Cybersecurity Advisory AA25-343A, last revised December 18, 2025.

CISA. n.d. “Defining Insider Threats.” Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Cyber Safety Review Board. 2023. Review of the Attacks Associated with Lapsus$ and Related Threat Groups. Department of Homeland Security.

NIST. 2012. Guide for Conducting Risk Assessments. Special Publication 800-30 Rev. 1. Joint Task Force Transformation Initiative.

ODNI. 2026. Annual Threat Assessment of the U.S. Intelligence Community. Office of the Director of National Intelligence, March 2026.

U.S. Department of Justice. 2025. “Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups.” Press Release 25-1158, December 9, 2025.

U.S. Department of the Treasury. 2024. “Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure.” Press release JY2072, February 2, 2024.

VERIS Community. n.d.a. “Actors.” VERIS Framework. Accessed October 12, 2026.

VERIS Community. n.d.b. “verisc-labels.json.” VERIS Community Schema 1.4.1, vz-risk/VERIS repository on GitHub. Accessed October 12, 2026.

Verizon. 2026. 2026 Data Breach Investigations Report: Executive Summary.

Every vulnerability scanner report, vendor advisory, and government alert speaks the same compact language: a CWE number for the kind of mistake, a CVE number for the specific flaw, a CVSS score for how severe it would be, and a KEV flag or an EPSS probability for whether anyone is exploiting it. Each token answers a different question, and a reader who treats them as interchangeable will patch the wrong things first. Threat and vulnerability characteristics are the vocabulary that keeps those questions apart, and the vocabulary exists because the volume of disclosed flaws outran any team’s ability to fix everything at once years ago. SY0-801 objective 2.1, “Explain characteristics of threats and vulnerabilities,” is new in SY0-801 and gathers vulnerability scoring, CVE identifiers, threat feeds, intelligence sources, likelihood, impact, prioritization, and the intelligence life cycle under one heading (CompTIA 2025).

The exam tests concepts and workflow separately. Objective 2.1 asks what a score, an identifier, and a feed mean; objective 4.3 (“Given a scenario, perform tasks associated with vulnerability management”) asks you to act on them (T-13). One idea ties the two together: a CVSS score describes how bad a flaw is anywhere, and priority describes how likely and costly it is here. Treat a CVSS number as a patch order and you lose points in both.

One flaw, five identifiers

A single software defect collects several names on its way from a developer’s mistake to a line in your patch queue. The chain runs CWE (weakness class) to CVE (one instance) to CVSS (severity) to KEV and EPSS (exploitation evidence and forecast) to asset context (priority), which only you supply. The first links are assigned by other people and published in databases; the last one cannot be, because nobody outside your organization knows what the affected host does.

The Common Weakness Enumeration (CWE) is the taxonomy for code flaws, independent of any product. A CWE entry names the type of mistake: the 2025 CWE Top 25 ranks CWE-79 (cross-site scripting) first and CWE-78 (OS command injection) ninth (MITRE 2025). Many unrelated products share the same CWE, so a CWE number can never identify a specific flaw.

Common Vulnerabilities and Exposures (CVE) names one publicly disclosed vulnerability. A CVE Numbering Authority (CNA) assigns the ID and publishes the record, which starts Reserved and becomes Published or Rejected (CVE Program 2026). The identifier’s format carries less information than people assume: the number after the CVE year runs 4 to 19 digits, and the year marks discovery or publication, not exploitation (CVE Program n.d.). CVE-2026-102490 has six digits; CVE-2015-3306 (ProFTPD) entered KEV on October 8, 2026, so an old year prefix is no evidence that attackers have lost interest.

The National Vulnerability Database (NVD) is NIST’s database. It mirrors the CVE List and adds CVSS scores, CWE mappings, and CPE product strings, which name the affected product so that a scanner can match a record against an inventory. Volume forces prioritization: over 67,000 CVEs were published in 2026 as of September 18 (CISA 2026c), and no team patches at that rate.

Reading a record from NVD

The enrichment NVD adds is no longer uniform. Since April 15, 2026, NIST enriches KEV entries first (“within one business day of receipt”), then federal-use and EO 14028 critical software, and no longer routinely adds its own score when the CNA already scored the CVE (NIST 2026). The number you see in NVD is therefore often the CNA’s, labeled Secondary. One real record, queried October 12, 2026 (output condensed):

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-0111" | jq '.vulnerabilities[0].cve | {id, vulnStatus, cvss31: [.metrics.cvssMetricV31[] | {source, score: .cvssData.baseScore, vector: .cvssData.vectorString}], cvss40: [.metrics.cvssMetricV40[] | {source, score: .cvssData.baseScore}], cwe: [.weaknesses[].description[].value] | unique, cisaExploitAdd, cisaActionDue}'
{
  "id": "CVE-2025-0111",
  "vulnStatus": "Analyzed",
  "cvss31": [{"source": "nvd@nist.gov", "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],
  "cvss40": [{"source": "psirt@paloaltonetworks.com", "score": 7.1}],
  "cwe": ["CWE-610", "CWE-73"],
  "cisaExploitAdd": "2025-02-20",
  "cisaActionDue": "2025-03-13"
}

CVE-2025-0111 is an authenticated file read through the PAN-OS management interface. Most of the chain is visible in this one record: the CWE mappings (CWE-610 and CWE-73) classify the weakness, the CVE ID names the instance, two CVSS scores measure severity, and cisaExploitAdd is its KEV date. NIST scored it 6.5 in CVSS v3.1; Palo Alto, the CNA, scored it 7.1 in v4.0 when that interface faces the internet and 5.9 when only a jump box reaches it. Two scores for one flaw is not a disagreement; it is the first hint that severity depends on assumptions, which is the subject of the next section.

CVSS v4.0 measures severity, not risk

The Common Vulnerability Scoring System (CVSS) expresses the severity of a vulnerability as a vector of metric values and a number from 0.0 to 10.0 computed from them. FIRST published CVSS v4.0 on November 1, 2023 (FIRST 2024). Its four metric groups are Base (intrinsic traits of the flaw), Threat (Exploit Maturity), Environmental (your CR, IR, and AR requirements, meaning the confidentiality, integrity, and availability requirements of the affected asset, plus Modified Base metrics), and Supplemental (Safety, Automatable, and others that never change the number). The bands are None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, and Critical 9.0 to 10.0. Because the groups can be applied in combinations, every number should carry a label saying which groups produced it: CVSS-B, CVSS-BT, CVSS-BE, or CVSS-BTE (FIRST 2025).

A vector string is the score’s audit trail. The same flaw in v4.0 and v3.1 notation:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N    9.3 Critical (CVSS-B)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                       9.8 Critical

The v4 vector reads: network attack vector, low complexity, no attack requirements (AT, new in v4), no privileges or user interaction, high impact on the vulnerable system (VC, VI, VA), and none on subsequent systems (SC, SI, SA). The same traits score 9.8 in v3.1, which had Scope and a different formula; never compare numbers across versions.

What the consumer adds

The Base group belongs to whoever publishes the advisory. Applying Threat and Environmental metrics “is the responsibility of the CVSS consumer” (FIRST 2025), which means the score on an advisory is the beginning of your assessment, not the end of it. The vector above in FIRST’s v4.0 calculator, with consumer metrics added:

Added metrics	Score	Label
None	9.3 Critical	CVSS-B
E:A (exploitation reported)	9.3 Critical	CVSS-BT
E:P (public proof of concept)	8.9 High	CVSS-BT
E:U (no known exploit)	8.1 High	CVSS-BT
E:U/CR:L/IR:L/AR:L (low-value asset)	6.5 Medium	CVSS-BTE
E:U/MAV:L (local access only here)	6.1 Medium	CVSS-BTE

Two rules explain the table. Undefined Exploit Maturity is scored as Attacked, so a base score assumes the worst case and Threat metrics can only hold or lower it. Environmental metrics then adjust for what the asset is worth and how it is reached: low requirements on a low-value asset, or a Modified Attack Vector of Local because the service is not network-reachable here, pull the 9.3 down into Medium. FIRST’s own caveat: CVSS-B scores “should not be used alone to assess risk” (FIRST 2025).

Prioritization: why a 6.5 can outrank a 9.8

Severity describes the flaw. Risk adds two things the score cannot see: the likelihood that this flaw will be exploited and the impact if it is, on this asset. Two public data sources supply likelihood evidence, and both are now exam vocabulary.

CISA’s Known Exploited Vulnerabilities (KEV) catalog is evidence of the past: an entry needs a CVE ID, reliable evidence of active exploitation, and clear remediation guidance, and a public proof of concept alone does not qualify (CISA 2026e). On October 12, 2026, KEV held 1,739 entries, and more than 140 of them carried a Medium or Low CVSS v3 rating in NVD. EPSS is a forecast of the future: it “estimates the probability a vulnerability will be exploited in the wild within the next 30 days”; version 5 (model v2026.06.15) has scored daily since June 15, 2026 (FIRST 2026a; FIRST 2026b).

CISA’s Binding Operational Directive (BOD) 26-04, issued June 10, 2026, revoked BOD 22-01 and its two-week default. Its inputs are In KEV, Publicly Exposed, Automatable, and Technical Impact; outcomes run from 3 days plus forensic triage down to fix on system upgrade (CISA 2026b). Of KEV entries added since June 10, 2026, 99 carry 3-day due dates and 23 carry 14-day ones. Neither CVSS nor EPSS is an input. It binds only federal civilian agencies; everyone else should use KEV “as an input to their vulnerability management prioritization framework” (CISA 2026d).

A worked triage

When I teach this in ITN 260, the habit to break is sorting the scanner export by CVSS and patching from the top. Five hypothetical findings (CVSS v3.1 scores from FIRST’s calculator, invented EPSS values):

Finding	CVSS v3.1	KEV; EPSS	Context
A: lab-db01	9.8	No; 0.003	Isolated lab VLAN, test data
B: vpn.example.com	6.5	Yes; 0.02	Internet-facing VPN for all remote staff
C: 600 laptops	8.8	No; 0.40	Web browser; user must visit a malicious page
D: www.example.com	7.5	No; 0.02	Public web server with customer PII
E: fs01	7.8	Yes, ransomware use Known; 0.15	Internal file server

Three ways to order the same five findings:

• CVSS only: A, C, E, D, B.
• KEV first, then CVSS: E, B, A, C, D.
• Risk-based (KEV, then internet exposure, then EPSS, then asset value; CVSS breaks ties): B, E, D, C, A.

Under BOD 26-04, assuming only A and D are automatable and only A, C, and E have total technical impact, B, D, and E get 14 days, A gets 60, and C waits for a system upgrade. The 6.5 tops the risk-based order and shares BOD 26-04’s shortest deadline here (14 days, with D and E); the 9.8 drops to last in the risk-based order and gets 60 days under BOD 26-04, behind three lower-scored findings. C shows the limit of any single model: a strong EPSS signal that BOD 26-04 ignores. Real cases fit the pattern: CVE-2025-0111 and SonicWall’s CVE-2021-20035 are CVSS v3.1 6.5 management-interface flaws in KEV, and CVE-2025-0111’s EPSS on October 12, 2026 was only 0.01999.

Basically, the score says how bad a flaw is anywhere; priority says how likely and costly it is here.

Threats: sources, feeds, and intelligence

The threat half of the objective uses three words that practitioners often blur, and NIST SP 800-150 separates them. Sources are origins: sharing communities, government repositories, internal telemetry, commercial feeds, and open sources (Johnson et al. 2016). A feed is machine-readable delivery; the KEV JSON file, the daily EPSS CSV, and CISA’s free Automated Indicator Sharing (AIS) service over TAXII 2.1 are feeds (CISA 2026a). Threat intelligence is information “aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making.” A feed can carry raw indicators with no analysis attached; it becomes intelligence only when someone adds the context that supports a decision. Two sharing bodies appear by acronym: an ISAC serves a critical-infrastructure sector; an ISAO, any community of interest. STIX belongs to T-25.

Likelihood and impact

Likelihood and impact are the two factors of risk, and they appear here and again in objective 5.2, home of the SLE and ALE math (T-6). For a vulnerability, likelihood draws on KEV, EPSS, Exploit Maturity, the exploitability metrics (AV, AC, AT, PR, UI), and exposure; impact draws on the six impact metrics, CR, IR, and AR, and the business function at stake. Every input in the triage above slots into one of those two columns, which is why a risk-based ordering can be defended line by line.

The intelligence life cycle

“Life cycle” has no CompTIA definition. My interpretation is the intelligence cycle, which the U.S. Intelligence Community gives as six steps (INTEL.gov n.d.). An illustrative trace of one requirement through the cycle:

1. Planning: alert us within one business day when a KEV entry touches our edge devices.
2. Collection: pull the KEV JSON and vendor PSIRT advisories.
3. Processing: match cveID and product against the asset inventory and CPE strings.
4. Analysis: two firewalls expose the affected management interface to the internet.
5. Dissemination: open a change ticket and push a SIEM watchlist entry.
6. Evaluation: judge whether the alert was timely and actionable, then adjust the requirement.

The last step is the one teams skip: a feed that is never evaluated keeps producing alerts nobody acts on. Other readings of “life cycle” are the CVE Record lifecycle (Reserved, Published, Rejected) or a vulnerability’s discovery-to-patch life cycle. “Vulnerability types” is also undefined; it most likely points to the 801 2.4 categories (T-29), and CWE is the taxonomy for code flaws.

What you need to know for SY0-801

• CVE means Common Vulnerabilities and Exposures. The SY0-701 objectives printed it as “Common Vulnerability Enumeration,” which echoes CWE (Common Weakness Enumeration), a likely distractor.
• One flaw’s unique ID is CVE; its severity is CVSS; its weakness category is CWE; NIST’s enriched database is NVD; the affected product name is CPE.
• CVSS v4.0 bands: None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0. Never compare a v4.0 number with a v3.1 number.
• CVSS v4.0: Base comes from the provider, Threat and Environmental from the consumer, and Supplemental never changes the score. Label the result CVSS-B, CVSS-BT, CVSS-BE, or CVSS-BTE.
• Severity is not risk; risk adds likelihood (KEV, EPSS, exposure) and impact (asset criticality).
• KEV is confirmed past exploitation and wins over EPSS, a 30-day forecast whose percentile is a rank: 0.80 is not an 80 percent chance.
• A source originates, a feed delivers, and intelligence is analyzed for a decision.
• Objective 2.1 tests prioritization as a concept; objective 4.3 tests the workflow, where it heads severity assessment and pen test report review (T-13).

Check yourself

These are original practice questions, not exam items.

1. A remote-access appliance advisory lists CWE-78, CVE-2021-20035, a CVSS v3.1 base score of 6.5, and a CISA KEV entry. Which statement is accurate?

• A. CWE-78 uniquely identifies this appliance flaw.
• B. CVE-2021-20035 identifies one disclosed vulnerability, and CWE-78 names its weakness type.
• C. A Medium score means the fix can wait for the next cycle.
• D. The KEV entry is a 30-day exploitation probability.

Answer: B. CVE identifies the instance; CWE classifies the weakness. KEV records confirmed exploitation, not a probability (EPSS), so this Medium score is still urgent.

2. A team can deploy one fix tonight. Which finding should it remediate first?

• A. CVSS v3.1 9.8 on an isolated test server, not in KEV.
• B. CVSS v3.1 6.5 on an internet-facing VPN gateway, listed in KEV.
• C. CVSS v3.1 8.8 in a desktop app that requires a user to open a file.
• D. CVSS v3.1 7.5 on an internal print server with public proof-of-concept code.

Answer: B. Confirmed exploitation on an internet-exposed asset outweighs higher severity elsewhere. A public proof of concept alone does not meet KEV’s evidence bar.

3. An analyst takes a vendor’s CVSS v4.0 vector, adds E:U, and sets CR, IR, and AR to Low because the host holds test data. How should the resulting 6.5 be labeled?

• A. CVSS-B.
• B. CVSS-BT.
• C. CVSS-BE.
• D. CVSS-BTE.

Answer: D. Exploit Maturity is a Threat metric and the requirements are Environmental metrics, so both groups apply; the vendor’s unmodified score was CVSS-B.

This is T-33 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-32: Threat Actors Rewritten With Terrorists, Competitors, and Accidents. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA (Cybersecurity and Infrastructure Security Agency). 2026a. “Automated Indicator Sharing (AIS).” Accessed October 12, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026b. “BOD 26-04: Prioritizing Security Updates Based on Risk.” June 10, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026c. CVE Program: Establishing a Quality Era Framework. September 22, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026d. “Known Exploited Vulnerabilities Catalog.” Accessed October 12, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026e. “Reducing the Significant Risk of Known Exploited Vulnerabilities.” Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CVE Program. 2026. “Glossary.” CVE. Accessed October 12, 2026.

CVE Program. n.d. “CVE Record Format.” JSON schema. Accessed October 12, 2026.

FIRST (Forum of Incident Response and Security Teams). 2024. Common Vulnerability Scoring System Version 4.0: Specification Document. Document version 1.2. See also the v4.0 calculator and v3.1 calculator.

FIRST (Forum of Incident Response and Security Teams). 2025. Common Vulnerability Scoring System Version 4.0: User Guide. Document version 1.2.

FIRST (Forum of Incident Response and Security Teams). 2026a. “EPSS Frequently Asked Questions.” Accessed October 12, 2026.

FIRST (Forum of Incident Response and Security Teams). 2026b. “Get the Data.” EPSS. Accessed October 12, 2026.

INTEL.gov. n.d. “How the IC Works.” Accessed October 12, 2026.

Johnson, Chris, Lee Badger, David Waltermire, Julie Snyder, and Clem Skorupka. 2016. Guide to Cyber Threat Information Sharing. NIST Special Publication 800-150.

MITRE. 2025. “2025 CWE Top 25 Most Dangerous Software Weaknesses.” Common Weakness Enumeration.

NIST (National Institute of Standards and Technology). 2026. “NIST Updates NVD Operations to Address Record CVE Growth.” April 15, 2026.

A cryptographic solution is the whole arrangement that turns a mathematical primitive into protection for real data: the algorithm, the key that drives it, the hardware or software that holds that key, and the protocol that tells two parties how to use all of it on a live connection. An algorithm such as AES is only a function; it becomes useful once a protocol such as TLS decides which algorithm to run, how the two ends agree on a key, and what to do when the other side offers something weaker. Most practical failures happen in that surrounding machinery rather than in the primitives, which is why one objective has to cover protocols, key sizes, hashing, and key-holding hardware together.

In SY0-801 this material sits under objective 1.3, “Explain the importance of using appropriate cryptographic solutions,” which newly lists Protocols as the first entry under Encryption (CompTIA 2025). The same objective covers Algorithms, Key length, Hashing algorithms, Salting, Digital signatures, Tools, Obfuscation, Certificates, and PKI, and it expects working knowledge of TLS, IPsec, AES, RSA, ECC, and SHA-2 behind those general headings. This post takes them in the order a packet meets them: protocol, algorithms and key strength, hashing, and finally the hardware and password-storage practices that keep keys and secrets from leaking.

Protocols: putting algorithms on the wire

A cryptographic protocol is an agreed sequence of messages by which two parties choose algorithms, establish keys, authenticate each other, and then protect the traffic that follows. The objective gives Protocols no examples; TLS and IPsec are the anchors the document itself supplies, with OCSP under Certificates and “Request for comments (RFC)” under Standards in 5.1 (T-7). SSH and WPA3 are fair examples even though the objectives do not name them. Do not confuse this Protocols entry with the 4.4 “Protocols” group (NetFlow, SNMP, syslog, SCAP), which is about monitoring.

TLS 1.3 and the rules for TLS 1.2

Transport Layer Security (TLS) is the protocol beneath HTTPS and most other secured application traffic. A TLS connection begins with a handshake in which the client and server agree on a cipher suite, a named bundle of the key exchange method, the authentication method, the bulk cipher, and the hash. TLS 1.3 removed static RSA and static Diffie-Hellman key exchange, so “all public-key based key exchange mechanisms now provide forward secrecy” (Rescorla 2018). Forward secrecy means that session keys are derived from ephemeral values discarded after the handshake, so a server private key stolen later cannot decrypt traffic recorded earlier. Every remaining cipher is AEAD (authenticated encryption with associated data), which produces an integrity tag as part of encryption instead of relying on a separate MAC: AES-GCM, ChaCha20-Poly1305, or AES-CCM. A full handshake takes one round trip, and everything after ServerHello is encrypted, including the server certificate. Suite names shrank to the AEAD and the hash, e.g., TLS_AES_128_GCM_SHA256. TLS 1.2 names all four parts: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is ECDHE key exchange, RSA authentication, AES-128-GCM, and SHA-256.

Older versions are prohibited, not merely discouraged. RFC 8996 states “TLS 1.0 MUST NOT be used” and says the same of TLS 1.1 (Moriarty and Farrell 2021). RFC 9325 requires TLS 1.2, recommends TLS 1.3, and advises against static RSA suites (no forward secrecy) and CBC suites without encrypt_then_mac (Sheffer, Saint-Andre, and Fossati 2022). All of this is visible in one query to a live server, captured October 12, 2026 with OpenSSL 4.0.3 (lines trimmed):

$ openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null
Certificate chain
 0 s:CN=example.com
   i:C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3
   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA256
   v:NotBefore: Sep 26 22:49:11 2026 GMT; NotAfter: Dec 25 22:56:35 2026 GMT
...
Peer signature type: ecdsa_secp256r1_sha256
Negotiated TLS1.3 group: X25519MLKEM768
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
...
Verify return code: 0 (ok)

$ openssl s_client -connect example.com:443 -tls1_1 </dev/null
...:error:0A0000BF:SSL routines:tls_setup_handshake:no protocols available:...

Reading the output top to bottom:

• The negotiated suite names only the AEAD (AES-256-GCM) and the hash (SHA-384), as every TLS 1.3 suite does.
• The group combines X25519 ECDHE with ML-KEM-768 (FIPS 203), a hybrid post-quantum key agreement standardized in RFC 10024 in August 2026 (Kwiatkowski et al. 2026).
• The leaf key is ECDSA P-256 (128-bit strength), valid about 90 days, inside the CA/Browser Forum’s 200-day maximum in force since March 15, 2026 (CA/Browser Forum 2026).
• The TLS 1.1 attempt fails in the client, because OpenSSL’s default security level 2 disables TLS 1.0 and 1.1. At security level 0, the same server still accepted TLS 1.1, a finding under RFC 8996.

IPsec: AH, ESP, modes, and IKE

IPsec is the protocol family that protects traffic at the IP layer, so it secures whatever rides above it without the application knowing. It has two protection protocols. Authentication Header (AH, IP protocol 51) authenticates packets without encrypting them, and because its integrity check covers header fields that address translation rewrites, it breaks under NAT; NIST discourages it (Barker et al. 2020). Encapsulating Security Payload (ESP, IP protocol 50) adds confidentiality and is mandatory to implement. Both are IP protocol numbers, not ports.

Each protection protocol runs in one of two modes. Transport mode protects only the payload and leaves the original IP header in place, so it works host to host and is incompatible with NAT. Tunnel mode wraps the whole original packet inside a new one, and it is required when either end is a security gateway (Kent and Seo 2005). Keys for either mode come from Internet Key Exchange: IKEv2 (RFC 7296) negotiates on UDP 500, or UDP 4500 for NAT traversal, and IKEv1 should not be used for new deployments.

Replacing cleartext protocols

Much of the “appropriate” in the objective title comes down to choosing the encrypted version of a service over the plaintext one:

Cleartext	Secure option	IANA port
Telnet (23)	SSH	22/tcp
HTTP (80)	HTTPS	443/tcp
LDAP (389)	LDAPS, or StartTLS on 389	636/tcp
SNMPv1 and v2c	SNMPv3 with USM privacy	161/udp
DNS (53)	DNS over TLS	853/tcp

For mail, RFC 8314 prefers implicit TLS (465 for submission, 993 for IMAP, 995 for POP3) over STARTTLS on 587; implicit TLS begins the session encrypted instead of upgrading a cleartext one. DNS over TLS encrypts the query; DNSSEC adds integrity and origin authentication but “is not designed to provide confidentiality” (RFC 4033). Private lookups call for the former, proof that an answer was not forged for the latter.

Algorithms, key length, and security strength

Key length is the number of bits in a key. Security strength is the work an attacker needs, expressed as the equivalent of brute-forcing a symmetric key of that many bits, and the two match only for symmetric ciphers. Key length is not security strength (Barker 2020, Table 2):

Strength (bits)	Symmetric	RSA or DH modulus	ECC key
80 or less	2TDEA	1024	160 to 223
112	3TDEA	2048	224 to 255
128	AES-128	3072	256 to 383
192	AES-192	7680	384 to 511
256	AES-256	15360	512 and up

So RSA-2048 is 112-bit strength, acceptable through 2030 under SP 800-57. Two NIST drafts, SP 800-131A Rev. 3 ipd and IR 8547 ipd, propose deprecating 112-bit RSA and ECC after 2030, and IR 8547 would disallow every quantum-vulnerable public-key algorithm after 2035 (Barker and Roginsky 2024; Moody et al. 2024). Those dates are proposals. FIPS 203, 204, and 205 (ML-KEM, ML-DSA, and SLH-DSA) were published August 13, 2024 (NIST 2024), and the X25519MLKEM768 group in the capture above is one of them in deployment, though nothing quantum appears in the SY0-801 objectives.

Mode matters too. A block cipher encrypts one fixed-size block at a time; a mode of operation is the rule for chaining blocks into a whole message. ECB leaks patterns because identical plaintext blocks encrypt identically; CBC needs an unpredictable IV and a separate MAC; GCM is AEAD, but its IV must never repeat under one key (SP 800-38D). When I teach this in ITN 260, the confusion is usually that “AES-256” gets treated as a complete answer, when the mode and the IV handling decide whether the ciphertext leaks.

Hashing algorithms and collision resistance

A hash function maps input of any length to a fixed-size digest. A cryptographic hash is one for which finding two inputs with the same digest (a collision) or recovering any input from a given digest (a preimage) is computationally infeasible. For hashing algorithms, the dividing line is collision resistance. MD5 lost it long ago (RFC 6151), and SHAttered, announced February 23, 2017, produced two different PDFs with one SHA-1 digest (Stevens et al. 2017). Checked against the two published files on October 12, 2026:

$ shasum -a 1 shattered-1.pdf shattered-2.pdf
38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-1.pdf
38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-2.pdf
$ shasum -a 256 shattered-1.pdf shattered-2.pdf
2bb787a73e37352f92383abe7e2902936d1059ad9f1ba6daaa9c1e58ee6970d0  shattered-1.pdf
d4488775d29bdef7993367d541064dbdda50d383f89f0aa13a6ff2e0894ba5ff  shattered-2.pdf

That is a collision, not a preimage: the researchers built two documents to share a digest rather than recovering a file from a digest. A signature over that digest cannot tell the two PDFs apart, which is why collision resistance matters for signing. NIST plans to finish moving off SHA-1 for all applications by December 31, 2030 (NIST 2022); use SHA-256, SHA-384, or SHA-3 (FIPS 180-4, FIPS 202). HMAC-SHA1 is not broken; RFC 9155 leaves it in place for TLS 1.2 record protection.

Three constructions give three guarantees. A plain hash checks integrity, and anyone can recompute it. An HMAC mixes a shared secret key into the hash, so only a key holder can produce a valid tag; because both parties hold that key, either could have made it. A digital signature (a hash signed with a private key) supports non-repudiation, since only the private key holder could have produced it. Hash chaining and digital signatures are also the primitives beneath a blockchain, which NIST describes as “tamper evident and tamper resistant digital ledgers” (Yaga et al. 2018).

Tools: where the keys live

A protocol is only as trustworthy as the place its private keys are kept. The SY0-801 objective lists “Tools” without naming any, and the document’s own note says “The lists of examples provided in Bulleted format are not exhaustive lists” (CompTIA 2025), so the four devices below remain right answers in scenarios.

A Trusted Platform Module (TPM) is a per-device crypto-processor that seals keys and measures boot. Sealing binds a key to a measured state of the machine: BitLocker seals its key to PCR 7 and PCR 11, so a changed boot path forces recovery (Microsoft n.d.).

A hardware security module (HSM) is a tamper-resistant device for an organization’s high-value keys, validated under FIPS 140-3. Public certificate authorities must hold CA keys in a FIPS 140 Level 3 or Common Criteria EAL 4 device (CA/Browser Forum 2026). FIPS 140-2 certificates moved to the CMVP Historical List in September 2026 (NIST n.d.).

A key management system (KMS) is the lifecycle and policy layer above the hardware, usually HSM-backed. In envelope encryption, a data key encrypts the object and the KMS key wraps the data key (AWS n.d.), so the key that protects the data is itself stored only in encrypted form.

A secure enclave is an on-device subsystem “isolated from the main processor,” keeping keys safe even if the kernel is compromised (Apple n.d.). Basically, the four tools differ in scope: a TPM serves one machine, an HSM serves an organization, a KMS governs the keys over time, and an enclave protects keys from the operating system on the same device.

Salting and key stretching

Password storage is where hashing, salting, and cost meet. A salt is a random per-user value mixed into the hash so that identical passwords produce different digests and precomputed tables are useless. Key stretching is the textbook name for deliberately slowing a hash, by iterating it or making it memory-hungry, so that each guess costs an attacker real time. SP 800-63B-4 requires passwords to be “salted and hashed using a suitable password hashing scheme” with a salt of at least 32 bits and a cost factor (Temoshok et al. 2025); OWASP calls the same thing a work factor. Neither says “stretching,” but the mechanism is the same.

Salting and cost solve different problems, and you need both. A salt does not slow a guess. On one Apple M4 Pro core with Python’s hashlib (October 12, 2026; an illustration, not a benchmark), salted SHA-256 managed about 3.7 million guesses per second and PBKDF2-HMAC-SHA256 at 600,000 iterations about 23. OWASP’s first choice is Argon2id with at least 19 MiB of memory, two iterations, and parallelism 1 (OWASP n.d.):

$ echo -n "correct horse battery staple" | argon2 "Qx7pL2vR9sKw4mZ1" -id -t 2 -k 19456 -p 1 -l 32 -e
$argon2id$v=19$m=19456,t=2,p=1$UXg3cEwydlI5c0t3NG1aMQ$fgGAj7c11YpV9/xJthJFyGVvBZwnOFvD862DhH6xzx8

The stored string carries the parameters and salt, so the cost can rise over time without breaking existing hashes.

What you need to know for SY0-801

• TLS 1.3 means forward secrecy on every full handshake and AEAD only; TLS 1.0 and 1.1 are findings; TLS 1.2 needs ECDHE plus AEAD suites.
• Forward secrecy comes from ephemeral key exchange, so TLS_RSA_WITH_AES_256_GCM_SHA384 has none.
• Only ESP encrypts; a gateway endpoint means tunnel mode; NAT means NAT-T on UDP 4500.
• RSA-2048 is 112-bit strength; RSA-3072, P-256, and AES-128 are each 128.
• SHA-1 and MD5 fail collision resistance; HMAC-SHA1 is not broken.
• A hash checks integrity, an HMAC adds a shared secret, and a signature adds non-repudiation.
• A salt defeats precomputed tables; a cost factor slows each guess; you need both.
• Key stretching is 701-era vocabulary for the cost factor that SP 800-63B-4 and OWASP describe; expect the mechanism, not the phrase.
• “Measured boot” or “laptop disk keys” signals TPM; “CA root key” signals HSM; “rotate and audit keys” signals KMS; “keys safe from a compromised OS” signals secure enclave.
• Blockchain and open public ledger are 701-era items; their primitives, hash chaining and digital signatures, remain in 1.3.

Check yourself

These are original practice questions, not exam items.

1. A scan shows an internal web server offering only TLS 1.0, with suites such as TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA and TLS_RSA_WITH_AES_128_CBC_SHA. Nmap’s ssl-enum-ciphers grades every suite A. What should the administrator do?

• A. Nothing, because every suite earned an A grade.
• B. Remove the static RSA suites and keep TLS 1.0.
• C. Disable TLS 1.0 and 1.1, and enable TLS 1.3 plus TLS 1.2 with ECDHE and AEAD suites.
• D. Replace the server certificate with an RSA-4096 certificate.

Answer: C. RFC 8996 says TLS 1.0 and 1.1 must not be used, and Nmap’s grade ignores the protocol version. Removing static RSA suites adds forward secrecy but keeps the deprecated protocol.

2. A certificate authority must generate and protect its root private key inside a tamper-responsive device validated at FIPS 140-3 Level 3. Which tool fits best?

• A. A TPM in the CA administrator’s laptop.
• B. A hardware security module.
• C. A secure enclave in a mobile device.
• D. A key management system that stores keys in a software database.

Answer: B. An HSM is the dedicated, validated device for an organization’s high-value keys. A TPM protects keys for one machine, and a software-only KMS lacks the hardware boundary.

3. After a breach, analysts find that users who share a password have identical stored hashes, and the hashes crack quickly on GPUs. Which change addresses both problems?

• A. Hash each password with SHA-256 instead of MD5.
• B. Encrypt the password table with AES-256.
• C. Add one secret pepper to every password before hashing.
• D. Use a unique per-user salt with Argon2id at a tuned memory and time cost.

Answer: D. The salt makes identical passwords hash differently, and Argon2id’s cost makes each guess expensive. SHA-256 is fast and unsalted, encryption is reversible with the key, and a shared pepper alone leaves identical passwords with identical hashes.

This is T-34 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-33: CVSS, CVE, and Threat Intelligence Move Into New Objective 2.1. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Apple. n.d. “The Secure Enclave.” Apple Platform Security. Accessed October 12, 2026.

AWS (Amazon Web Services). n.d. “AWS KMS Cryptography Essentials.” AWS Key Management Service Developer Guide. Accessed October 12, 2026.

Barker, Elaine. 2020. Recommendation for Key Management: Part 1: General. NIST Special Publication 800-57 Part 1 Rev. 5. Gaithersburg, MD: National Institute of Standards and Technology.

Barker, Elaine, Quynh Dang, Sheila Frankel, Karen Scarfone, and Paul Wouters. 2020. Guide to IPsec VPNs. NIST Special Publication 800-77 Rev. 1. Gaithersburg, MD: National Institute of Standards and Technology.

Barker, Elaine, and Allen Roginsky. 2024. Transitioning the Use of Cryptographic Algorithms and Key Lengths. NIST Special Publication 800-131A Rev. 3, Initial Public Draft.

CA/Browser Forum. 2026. Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates. Version 2.3.1.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Kent, Stephen, and Karen Seo. 2005. Security Architecture for the Internet Protocol. RFC 4301. Internet Engineering Task Force.

Kwiatkowski, Kris, Panos Kampanakis, Bas Westerbaan, and Douglas Stebila. 2026. Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3. RFC 10024. Internet Engineering Task Force.

Microsoft. n.d. “BitLocker Countermeasures.” Microsoft Learn. Accessed October 12, 2026.

Moody, Dustin, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper. 2024. Transition to Post-Quantum Cryptography Standards. NIST IR 8547, Initial Public Draft.

Moriarty, Kathleen, and Stephen Farrell. 2021. Deprecating TLS 1.0 and TLS 1.1. RFC 8996, BCP 195. Internet Engineering Task Force.

NIST (National Institute of Standards and Technology). 2022. “NIST Transitioning Away from SHA-1 for All Applications.” Computer Security Resource Center, December 15, 2022.

NIST (National Institute of Standards and Technology). 2024. “NIST Releases First 3 Finalized Post-Quantum Encryption Standards.” August 13, 2024.

NIST (National Institute of Standards and Technology). n.d. “FIPS 140-3 Transition Effort.” Computer Security Resource Center. Accessed October 12, 2026.

Nmap Project. n.d. “ssl-enum-ciphers.” Nmap Scripting Engine Documentation. Accessed October 12, 2026.

OpenSSL Project. n.d. “SSL_CTX_set_security_level.” OpenSSL Documentation. Accessed October 12, 2026.

OWASP Foundation. n.d. “Password Storage Cheat Sheet.” OWASP Cheat Sheet Series. Accessed October 12, 2026.

Rescorla, Eric. 2018. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. Internet Engineering Task Force.

Sheffer, Yaron, Peter Saint-Andre, and Thomas Fossati. 2022. Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). RFC 9325, BCP 195. Internet Engineering Task Force.

Stevens, Marc, Elie Bursztein, Pierre Karpman, Ange Albertini, and Yarik Markov. 2017. “SHAttered.” Announced February 23, 2017. Accessed October 12, 2026.

Temoshok, David, et al. 2025. Digital Identity Guidelines. NIST Special Publication 800-63B-4.

Yaga, Dylan, Peter Mell, Nik Roby, and Karen Scarfone. 2018. Blockchain Technology Overview. NIST IR 8202.

Change management is the discipline that decides how a modification to a production system is requested, reviewed, approved, tested, carried out, and verified, and who is accountable at each step. It exists because change is the leading cause of self-inflicted outages: Google’s SRE book reports that “roughly 70% of outages are due to changes in a live system” (Treynor Sloss 2016). A firewall rule, a firmware upgrade, or a one-line configuration edit can take a service down as surely as an attacker can, and the security consequences of a bad change (an exposed port, a disabled control, a host that cannot boot) are why the topic lives in a security exam and not only in an operations manual.

SY0-801 objective 1.2, “Given a scenario, demonstrate the impact of change management processes on security,” expands the topic by naming the change advisory board (CAB) and fail forward beside the other business-process elements (CompTIA 2025). Those elements are ownership, stakeholders, the CAB with its approval process, impact analysis, test results, backout planning, fail forward, the maintenance window, and standard operating procedures (SOPs). Beside them sit seven technical implications (allow lists and deny lists, restricted activities, downtime, service restart, application restart, legacy applications, and dependencies), plus documentation and version control as their own items.

A scenario objective most likely means a broken-change story and a question about which process element was missing or which recovery path fits, so this post follows that shape: the roles, one change record, the backout decision, and one real incident.

Who approves, who owns, who gets told

A change advisory board (CAB) is the body that reviews a proposed change and approves or rejects it. On SY0-801 the approval process is nested under the CAB, so a question about approval points at a body, not at a signature line. NIST SP 800-53 CM-3 requires approval “with explicit consideration for security and privacy impact analyses,” names “Configuration Control Boards or Change Advisory Boards” as the reviewers, and CM-3(4) seats security representatives on the board (NIST 2020). The exam draws no line between a CAB and NIST’s configuration control board (CCB); treat them as the same seat at the table.

Around the board sit four other roles, two of them objective terms and two of them borrowed from NIST and from practice:

Role	Job in the change	Anchor
Requester	Raises the request (user, help desk, advisory, scan)	NIST “Change Initiator”; not an 801 term
Change owner	Accountable for the change and its outcome	801 “Ownership”
CAB or change authority	Reviews; approves or rejects	801 CAB; NIST CM-3
Stakeholders	Affected; consulted, then notified of downtime	801 “Stakeholders”
Implementer	Makes the change; never approves it	NIST AC-5, CM-5(4); not an 801 term

Ownership means one named person is accountable for the change and its outcome once the window opens. Stakeholders are the people and teams the change touches; they are consulted during impact analysis and then notified of the downtime, so nobody discovers a VPN gateway reboot by losing their tunnel.

Separation of duties

The implementer row is explained by separation of duties, a control the objective does not name but which the approval process depends on. NIST AC-5 says separation “helps to reduce the risk of malevolent activity without collusion,” and CM-5(4) dual authorization (“two-person control”) requires two qualified people (NIST 2020). An engineer approving their own firewall rule is an approval-process failure; separation of duties is the supporting control.

Standard, normal, and emergency changes

Not every change deserves a board meeting. Standard, normal, and emergency changes are ITIL and industry vocabulary rather than objective terms, but they explain how a CAB can meet on a schedule and still keep a network patched. A standard change is low risk, repeatable, and pre-approved; NIST’s preapproved examples include “vendor-provided security patches, updated antivirus signatures” (NIST 2011). A normal change is assessed case by case, with the high-risk ones going to the CAB. An emergency change goes through “a smaller approval body commonly known as the Emergency Change Advisory Board (ECAB)” (Amazon Web Services n.d.-a), and NIST has the CCB review it “as soon as is practical after” it is made.

Emergency is not the same as unauthorized. An emergency change skips the regular meeting but not the approval; an unauthorized change skipped the process entirely, and the CM-3(7) review exists to catch it after the fact. SY0-801’s “Emergency access” account type (covered at T-12) is unrelated.

Anatomy of a change record

The fastest way to learn the business-process elements is to read a change record that uses all of them. This illustrative record (documentation addresses, no real CVE) gives every element a line:

CHG-2026-1187  Class: Emergency (expedited)
Title:         Vendor firmware fix, VPN gateway vpn1.example.com (203.0.113.10)
Requester:     SOC lead; vendor advisory reports active exploitation
Owner:         Network services manager (accountable)
Implementer:   On-call network engineer (cannot approve this change)
Approval:      ECAB 2026-10-14 16:40 ET; full CAB review at next meeting
Stakeholders:  Remote staff, help desk, IdP/MFA team, SOC
Impact:        Reboot drops all tunnels for about 10 minutes
Dependencies:  RADIUS 198.51.100.20, SAML IdP, MFA push, monitoring probe
Test results:  Lab gateway: auth, tunnel, failover pass;
               legacy client 4.x fails TLS 1.3 handshake
Window:        22:00 to 23:30 ET; no other network changes (restricted)
Backout:       Prior firmware is the vulnerable build. Restore it only if
               the gateway fails health checks, then block external access
               at the edge firewall.
Fail forward:  If only legacy clients fail, keep the fix; push client 5.x
               per SOP-NET-014.
Decision:      23:00 ET; owner chooses backout or fail forward
Verify:        Version string, external scan, auth logs
Docs:          Network diagram revision, VPN SOP, config repo commit

Read top to bottom, the record follows the process order that NIST SP 800-128 lays out: request, record, determine whether control applies, analyze impact, test, approve, implement and notify, verify, and close out (NIST 2011). Testing comes before approval, which is why the “Test results” line caught the legacy-client failure before the window and the ECAB approved with that result in hand. Verification comes after implementation, which is why the “Verify” line names evidence (a version string, an external scan, the auth logs). Impact analysis here is one change’s security impact, in the sense of NIST CM-4 (NIST 2020): the 10-minute tunnel drop and the systems that depend on the gateway.

The twist is the backout line. The last known good firmware is the vulnerable firmware, so a plain rollback reopens the exposure. That is why the plan pre-approves a fail-forward branch, names a decision time (23:00 ET), and names a decision maker (the owner).

The seven technical implications

The Impact, Dependencies, Test results, and Window lines map onto the objective’s seven technical implications, which describe what the change does to the systems around it:

• Allow lists/deny lists: a hash-based allow list blocks the patched binary because its hash changed; update the rule in the same change (application control is covered at T-16).
• Restricted activities: what is prohibited, such as other network changes in the window.
• Downtime: the 10-minute tunnel drop that stakeholders hear about in advance.
• Service restart: systemctl restart takes dependents down too; list them with systemctl list-dependencies --reverse or Get-Service -DependentServices, and prefer nginx -t plus systemctl reload nginx when a reload will do.
• Application restart: one app’s process or pool, so only its sessions drop (CompTIA defines neither restart type; this split is interpretation).
• Legacy applications: client 4.x failing TLS 1.3.
• Dependencies: RADIUS, the IdP, and MFA push, found in impact analysis instead of in the outage.

Backout planning or fail forward

Backout planning means pre-written steps, a trigger, and a time limit for returning to the last known good state. SP 800-128 lists “Requirements for rollback of changes in the event that problems occur,” and CM-2(3) retains prior baselines “to support rollback” (NIST 2011; NIST 2020). The baseline is the thing you roll back to, so a backout plan presupposes that someone kept it. In version control, git revert HEAD backs out a bad commit by recording a new one, so the audit trail survives; git reset --hard rewrites history and discards the evidence of what went wrong.

Fail forward has no CompTIA definition. In industry usage it means keeping the change and deploying a corrective change instead of reverting. AWS calls it fixing forward and treats it as a policy decision rather than an improvisation: “Policies should specify when a fix-forward situation is allowed” (Amazon Web Services n.d.-b). Basically, fail forward is a pre-approved branch of the plan. Choosing it because nobody wrote a backout plan is a process failure, and the business-slang sense of learning from failure does not apply.

Google’s counterweight: on a found or suspected error, the team “rolls back first and investigates the problem second” (Hilton 2017). Rolling back first protects availability when the cause is unknown; failing forward protects a security gain, or a migration that cannot be undone. When I teach this in ITN 260, I frame it as a choice the plan makes before the window opens, not at 23:00. Rows marked reasoning are inference, not a published rule.

Situation	Lean	Basis
One-way schema or data migration already ran	Fail forward	Rollback “not straightforward” (Hilton 2017)
Patch for an actively exploited flaw breaks a minor feature	Fail forward plus workaround	Reasoning: backout reopens the exposure
User-visible failure, unknown root cause	Back out	“Rolls back first” (Hilton 2017)
Change freeze in effect	Back out to the approved baseline	Reasoning: the fix is itself a new change
Failed change disables the delivery channel	Back out by an out-of-band path	Channel File 291, below

The last row covers a change that breaks the mechanism you would use to undo it, and there is a well-documented example.

Channel File 291: when the backout cannot reach the host

On February 28, 2024, CrowdStrike’s Falcon sensor 7.11 for Windows added an IPC Template Type defining 21 input fields; the calling code supplied only 20. Its 12 static test cases ran against a channel file with a wildcard in field 21, so the mismatch never fired, and instances shipped cleanly on March 5 and April 8 to 24, 2024 (CrowdStrike 2024a; CrowdStrike 2024b). Every successful deployment made the next one look safer, which is the quiet danger in test results that never exercise the failing path.

At 04:09 UTC on July 19, 2024, two new instances went to Windows sensors 7.11 and above. One used a non-wildcard criterion in field 21; a Content Validator bug passed it, and deployment rested on “trust in the checks performed in the Content Validator” and earlier successes (CrowdStrike 2024b). The out-of-bounds read crashed hosts with bugcheck 0x50 in csagent.sys. The content was reverted at 05:27 UTC, 78 minutes later; Microsoft estimated 8.5 million affected devices, “less than one percent of all Windows machines” (Weston 2024).

A 78-minute revert sounds like a working backout plan, and for machines that had not yet pulled the bad file it was one. The revert often could not reach machines already stuck in a crash loop. Microsoft reported that some recovered after multiple restarts, but many needed Safe Mode or the Windows Recovery Environment, possibly a BitLocker recovery key, and del C-00000291*.sys in C:\Windows\System32\drivers\CrowdStrike (Microsoft n.d.). The lesson is the one the decision table ends on: a backout path cannot depend on the component that failed.

Mapped to the objective’s elements, the incident touches three. Test results: narrow test data and trust in past success. Impact analysis and dependencies: one update consumed by kernel-level code on every affected host. Backout planning: no reliable revert path to crashed hosts. The RCA’s own finding is “Each Template Instance should be deployed in a staged rollout,” and CrowdStrike added canary testing, deployment rings with bake-in time and rollback, and customer control over deployment (CrowdStrike 2024a). Canary deployment is not SY0-801 vocabulary; the exam’s only canary is the canary account (covered at T-15).

What you need to know for SY0-801

• Objective 1.2 is a scenario objective; a failed-change story most likely asks for the missing process element or the right recovery path.
• The approval process is nested under the CAB; an implementer approving their own change is an approval-process failure, and separation of duties (NIST AC-5, CM-5(4)) is the supporting control.
• Standard, normal, and emergency changes support the objective but are not objective terms; an emergency change is not an unauthorized one.
• Backout planning (701 said “Backout plan”) returns to the last known good state; fail forward keeps the change and ships a planned fix; a backup restore is recovery and can lose recent data.
• Test results come before approval, verification after implementation; SP 800-128 orders request, record, determine whether control applies, analyze impact, test, approve, implement and notify, verify, close out (most likely PBQ-style ordering material).
• The maintenance window is when; restricted activities are what is prohibited; a change freeze bars non-emergency changes.
• Impact analysis in this objective is one change’s security impact (NIST CM-4); business impact analysis is a separate topic under objective 5.2.
• Objective 1.2 says “Allow lists/deny lists”; application control under objective 4.1 says “Allow lists” and “Block lists”.
• Documentation and version control are sibling items; stale diagrams mislead responders, and version control gives diffs, attribution, and a rollback point.
• A backout path cannot depend on the component that failed; a change that breaks the delivery channel needs out-of-band recovery.

Check yourself

1. An administrator writes a change request to open TCP 1433 from a new reporting server to the payroll database, marks it approved, and implements it that night. It works, but an audit flags it. Which change management element was bypassed?

• A. Maintenance window.
• B. Change advisory board approval.
• C. Fail forward.
• D. Version control.

Answer: B. SY0-801 nests approval under the CAB, and self-approval defeats it. A working change that skipped approval is still unauthorized.

2. A release ran a one-way migration that split a customer table in two, and one report now fails. The previous build cannot read the new schema, and the approved plan includes a corrective-release branch. What should the team do?

• A. Redeploy the previous application build.
• B. Restore the database from last night’s backup.
• C. Fail forward with the corrective release the plan approved.
• D. Submit a new normal change for the next CAB meeting.

Answer: C. Rollback is not straightforward after a schema change, and a restore loses data written since the backup. Fail forward fits because the plan pre-approved it.

3. During an approved 22:00 to 23:30 window for a storage firmware upgrade, a network engineer also pushes an unrelated switch change, reasoning that users already expect an outage. Policy allows only the approved change in the window. Which 1.2 element was violated?

• A. Maintenance window.
• B. Restricted activities.
• C. Backout planning.
• D. Stakeholders.

Answer: B. The window defines when approved changes run; restricted activities define what may not happen during it. The switch change is also unauthorized, which NIST CM-3(7) review should detect.

This is T-35 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-34: Cryptography Adds Protocols and Stops Naming TPM, HSM, and Key Stretching. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Amazon Web Services. n.d.-a. “Change Management Categories and Priorities.” Establishing Your Cloud Foundation on AWS. Accessed October 12, 2026.

Amazon Web Services. n.d.-b. “OPS06-BP01 Plan for Unsuccessful Changes.” AWS Well-Architected Framework. Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CrowdStrike. 2024a. External Technical Root Cause Analysis: Channel File 291. August 6, 2024.

CrowdStrike. 2024b. “Preliminary Post Incident Review.” CrowdStrike Blog, July 24, 2024.

Hilton, Adrian. 2017. “Reliable Releases and Rollbacks: CRE Life Lessons.” Google Cloud Blog, March 24, 2017.

Microsoft. n.d. “Support Article KB5042421.” Microsoft Support. Accessed October 12, 2026.

NIST. 2011. Guide for Security-Focused Configuration Management of Information Systems. NIST Special Publication 800-128, includes updates as of October 10, 2019.

NIST. 2020. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53, Revision 5, includes updates as of December 10, 2020.

Treynor Sloss, Benjamin. 2016. “Introduction.” In Site Reliability Engineering. Google.

Weston, David. 2024. “Helping Our Customers through the CrowdStrike Outage.” Official Microsoft Blog, July 20, 2024.

A security control is any safeguard that reduces the likelihood or the impact of a loss: a device, a configuration, a procedure, or a policy. No single control is trusted to hold on its own. A firewall rule is misconfigured, a password is phished, a workstation cannot be patched, and each failure is survivable only if something else stands behind it. Defense in depth is the name for arranging controls so that they stand behind one another by design, and it is the principle under which the other security fundamentals (confidentiality, integrity, and availability; authentication, authorization, and accounting; non-repudiation; Zero Trust; and least privilege) fit together as parts of one structure rather than as a vocabulary list.

SY0-801 objective 1.1, “Explain security concepts and controls,” is the expanded home for this material: it opens with defense in depth, nests those five fundamentals one level beneath it, and then covers the categories and types used to classify any control (CompTIA 2025). CompTIA’s gloss for Domain 1 on its V8 page, “Understand how layered security controls work together to protect systems and data,” is the plainest statement of what the objective is for (CompTIA 2026a).

Defense in depth as the organizing principle

NIST defines defense-in-depth as “An information security strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization” (NIST n.d.). The definition names people and operations alongside technology, which means a layered defense is never only a stack of appliances. The one SP 800-53 Rev. 5 control named for the strategy, enhancement PL-8(1), requires allocating controls to “locations and architectural layers” so that they “operate in a coordinated and mutually reinforcing manner” (Joint Task Force 2020). The goal is work factor: an adversary has to defeat several controls in turn, and each attempt raises the odds of detection before the target is reached (Joint Task Force 2020).

Coordination is half of the design; diversity is the other half. SP 800-160 Vol. 1 Rev. 1 principle E.9 says successive barriers should be “diverse in nature and include technical, operational, and organizational barriers” (Ross, Winstead, and McEvilley 2022). A small calculation shows why diversity matters more than count. Take three phishing controls, a mail filter, user reporting, and EDR on execution, and suppose each misses 10 percent of attempts (invented figures, not measured rates). If their misses are independent, all three fail together 0.1 × 0.1 × 0.1 = 0.001 of the time, or 0.1 percent. If they share a failure mode, such as the same vendor’s detection content on the gateway and the endpoint, they miss the same message, and the stack behaves like a single 10 percent layer. That is why PL-8(2) asks for supplier diversity within a layer, and why “Diversity” appears as a resilience term in objective 3.2 (T-20). Three copies of the same control are redundancy, not depth.

The five concepts beneath it

Each of the five fundamentals has a distinct job in the layered design.

Confidentiality, integrity, and availability (CIA) name what the layers protect: confidentiality keeps information from parties not authorized to see it, integrity keeps it from unauthorized change, and availability keeps it reachable by the people and systems that need it. Every control in the matrix later in this post serves at least one of the three.

Authentication, authorization, and accounting (AAA) form the identity layer: who is asking, what they may do, and what record is kept. The next section defines each function from its RFC and shows all three in one log excerpt.

Non-repudiation is the evidence layer. SP 800-53 Rev. 5 control AU-10 calls for “irrefutable evidence” that a person performed an action, obtained through mechanisms such as digital signatures and receipts (Joint Task Force 2020). The term needs care: SP 800-57 Part 1 says a digital signature can “support a non-repudiation decision,” a message authentication code (MAC) cannot, and the real determination “is a legal decision” (Barker 2020). The signature mechanics are covered at T-34.

Zero Trust principles grant no implicit trust to assets or user accounts “based solely on their physical or network location” (Rose et al. 2020). CompTIA does not explain why the principles sit under defense in depth; the sensible reading is that Zero Trust adds a per-request access decision to the layers rather than replacing them, which matches SP 800-207’s expectation that most enterprises “will operate in a hybrid zero trust/perimeter-based mode” (Rose et al. 2020). The architecture itself is covered at T-21.

Least privilege is the last line. SP 800-53 control AC-6 allows accounts only the accesses “necessary to accomplish assigned organizational tasks” (Joint Task Force 2020). Its job in a layered design is to cap what a compromised account can reach after the other layers have failed.

Least privilege and its neighbors

Three terms sit close to least privilege and are easy to swap on an exam. Need-to-know is access to specific information for official duties, per CNSSI 4009; it restricts information rather than rights. Separation of duties, SP 800-53 control AC-5, divides a task among people so as to limit “malevolent activity without collusion” (Joint Task Force 2020). Privilege creep is least privilege decaying over job changes, as a person keeps old rights while gaining new ones (T-12).

AAA and least privilege in one sudo trail

RFC 2989 defines the three AAA functions. Authentication is “The act of verifying a claimed identity.” Authorization determines whether a right “can be granted to the presenter of a particular credential.” Accounting collects usage information for “trend analysis, auditing, billing, or cost allocation” (Aboba et al. 2000). Identification, the step the acronym leaves implicit, is the claim itself: typing a username asserts an identity, and authentication proves it.

One sudo rule exercises all three functions and least privilege at the same time. It lives in /etc/sudoers.d/webops, edited with visudo -f:

%webops  web01 = (root) /usr/bin/systemctl restart nginx

Members of the webops group, on host web01, may run as root exactly one command with one argument. Alice, a member of that group, restarts the web server and then tries to stop it. The resulting entries in /var/log/secure on web01:

Oct 12 05:01:12 web01 sudo: pam_unix(sudo:auth): authentication failure; logname=alice uid=1000 euid=0 tty=/dev/pts/0 ruser=alice rhost=  user=alice
Oct 12 05:01:20 web01 sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart nginx
Oct 12 05:01:20 web01 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)
Oct 12 05:02:03 web01 sudo: alice : command not allowed ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl stop nginx

Read it one function at a time:

• Authentication is the pam_unix(sudo:auth) line: alice mistyped her password, and the accepted command eight seconds later shows the retry succeeded.
• Authorization is the sudoers rule; because arguments listed in a command must match exactly, restart nginx is allowed and stop nginx is logged as “command not allowed.”
• Accounting is every line, and each carries the AU-3 content fields: when, where (web01, pts/0), who (alice), what (COMMAND), and the outcome.

The rule grants one command with one argument on one host, not ALL, which is least privilege in a single line (Sudo Project n.d.). The trail is attributable only because alice has her own account; a shared “admin” login breaks accounting and non-repudiation at once. AC-5 extends the separation logic to the logs themselves: the people who administer access control should not also administer the audit functions that record what they did (Joint Task Force 2020). Formats vary (older Linux-PAM omits (uid=0), and newer rsyslog setups may print RFC 3339 timestamps); the fields do not.

Control categories and control types

Every control can be classified two ways, and the two classifications answer different questions. Category answers how, and by whom or what, a control is implemented. Type answers what the control does relative to an incident. A control has one category and can have several types. When I teach this in ITN 260, I have students ask the two questions separately; “managerial” and “directive” sound like near-synonyms and answer different ones.

The four categories and their second names

SY0-801 names the categories Technical/logical, Managerial/administrative, Physical/environmental, and Operational. Technical (or logical) controls are implemented by systems: a firewall rule, an EDR agent, a login banner. Managerial (or administrative) controls govern risk through policy and assessment. Operational controls are “implemented and executed by people (as opposed to systems),” in the words of FIPS 200: guard rounds, log review, a periodic access review (NIST 2006). Physical (or environmental) controls act on the facility and its surroundings: doors, cameras, power, fire suppression, and climate.

The second names exist because the field has never settled on one vocabulary. FIPS 200 (2006) and SP 800-53 Rev. 3 (2009) used a management, operational, and technical triad, and Rev. 3 classed the PE family (Physical and Environmental Protection) as Operational (Joint Task Force 2009). Rev. 4 (2013) dropped the class designations because many controls mix “management, operational, and technical properties” (Joint Task Force 2013). The ISC2 Certified in Cybersecurity outline effective September 1, 2026 uses Technical, Administrative, and Physical controls, plus “logical access controls” (ISC2 2026). Basically, the slashes let either vocabulary map onto CompTIA’s four.

CompTIA publishes no definition of “environmental.” The NIST PE family is the best anchor: FIPS 200 requires protecting systems “against environmental hazards” (NIST 2006), and SP 800-53 Rev. 5 implements that requirement as PE-11 Emergency Power, PE-13 Fire Protection, PE-14 Environmental Controls, and PE-15 Water Damage Protection (Joint Task Force 2020).

The six types

Preventive controls block an action: a lock, a firewall deny rule. Deterring controls discourage an action but can be ignored: a sign, a login banner, a visible camera. Detective controls notice and record: a log, an alarm, a review. Corrective controls act after an incident to limit or undo damage: restore, rollback, quarantine. Directive controls tell people what to do: an acceptable use policy, an “authorized personnel only” sign. Compensating controls are “employed in lieu of” a baseline control that cannot be implemented (NIST n.d.); the choice is made before any incident, because the primary control is infeasible, and that timing is what separates compensating from corrective.

The matrix below is an interpretation, since CompTIA publishes no mapping of examples to categories and types; the multi-type rows are the point. Guards are the split case: SP 800-12 Rev. 1 lists gates and guards among physical defenses (Nieles, Dempsey, and Pillitteri 2017), but FIPS 200’s people-executed test puts the guard in Operational, so read the stem; the fence or guard booth is Physical/environmental, and the person on rounds is Operational.

Control	Category	Type(s)
Badge reader on server-room door	Physical	Preventive; its log is Detective
Visible CCTV	Physical	Detective; Deterring because visible
Security guard	Operational (a person executes it)	Preventive, Deterring, Detective
“Authorized personnel only” sign	Physical	Directive, Deterring
Acceptable use policy	Managerial/administrative	Directive
Firewall deny rule	Technical/logical	Preventive
EDR kills and quarantines a process	Technical/logical	Detective, Corrective
Clean-agent fire suppression (PE-13)	Physical/environmental	Corrective
HVAC with humidity alarms (PE-14)	Physical/environmental	Preventive; alarm is Detective
Isolating an unpatchable host	Technical/logical	Compensating
Login warning banner (AC-8)	Technical/logical	Deterring, Directive
Quarterly privileged-access review, AC-6(7)	Operational	Detective, then Corrective

In the unpatchable-host row, firewall rules that admit only a jump host and log everything else are Preventive and Detective in function, but they exist because patching is infeasible, and that is what makes them compensating.

What you need to know for SY0-801

• Defense in depth means coordinated, diverse layers so that one failure is not a compromise; three copies of the same control are redundancy, not depth.
• Rename spotter: “logical” means technical, “administrative” means managerial, and “environmental” (HVAC, humidity, fire suppression, power) means physical.
• Managerial controls govern risk (policy, risk assessment); operational controls are “implemented and executed by people (as opposed to systems)” per FIPS 200 (guard rounds, log review).
• Deterring discourages and can be ignored (sign, banner, visible camera); Preventive blocks (lock, deny rule). Deterring is the SY0-801 spelling of what SY0-701 called Deterrent; the type is the same.
• Compensating is chosen before an incident because the primary control is infeasible; Corrective acts after one (restore, rollback, quarantine).
• “Only the access needed” signals least privilege; “only this information” signals need-to-know; “no single person can complete” signals separation of duties.
• Identification claims, authentication proves, authorization decides, and accounting records.
• “Proves who signed” signals non-repudiation; MACs and shared accounts cannot support it.
• Zero Trust in 1.1 is a set of principles (no implicit trust by location); “control plane” and “data plane” are SY0-701 vocabulary, and the architecture itself is covered at T-21.
• Look-alikes: “Corrective” in 5.6 is a training type, and 4.5 uses similar slash pairs (“Logical/technical,” “Administrative/business”) for access-management policies.

Check yourself

These are original practice questions, not exam items.

1. A clinic cannot patch an imaging workstation because its vendor no longer supports the operating system. The team moves it to an isolated segment reachable only from one jump host and logs every denied connection. Using SY0-801 1.1 terms, which pair best describes this arrangement?

• A. Technical/logical; compensating.
• B. Operational; corrective.
• C. Technical/logical; corrective.
• D. Managerial/administrative; compensating.

Answer: A. Segmentation and firewall rules are implemented by technology, and they substitute for patching, the infeasible primary control. Corrective controls act after an event, which is not why this segment exists.

2. A data center adds humidity alarms, water-detection cable under the raised floor, and a clean-agent fire suppression system. Which SY0-801 category name fits these controls, and which type is the suppression system?

• A. Physical/environmental; corrective.
• B. Operational; preventive.
• C. Technical/logical; detective.
• D. Physical/environmental; deterring.

Answer: A. 801 pairs physical with environmental, and NIST groups heat, water, and fire hazards in its PE family. Suppression acts after a fire starts to limit damage, so it is corrective; the smoke detector would be detective.

3. A Linux server logs alice : command not allowed ; ... COMMAND=/usr/bin/systemctl stop nginx after alice successfully ran systemctl restart nginx with sudo. Which AAA function produced the denial, and which principle does the rule enforce?

• A. Authentication; separation of duties.
• B. Authorization; least privilege.
• C. Accounting; need-to-know.
• D. Authentication; least privilege.

Answer: B. Alice had already authenticated; the sudoers rule decided she may restart nginx but not stop it, which is authorization enforcing minimum rights. The log line is accounting, which records the decision rather than making it.

This is T-36 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-35: Change Management Becomes a Scenario Objective. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Aboba, Bernard, Pat R. Calhoun, Steven Glass, et al. 2000. Criteria for Evaluating AAA Protocols for Network Access. RFC 2989. Internet Engineering Task Force.

Barker, Elaine. 2020. Recommendation for Key Management, Part 1: General. NIST Special Publication 800-57 Part 1 Rev. 5.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

ISC2. 2026. “Certified in Cybersecurity Exam Outline.” Effective September 1, 2026. Accessed October 12, 2026.

Joint Task Force. 2009. Recommended Security Controls for Federal Information Systems and Organizations. NIST Special Publication 800-53 Rev. 3.

Joint Task Force. 2013. Security and Privacy Controls for Federal Information Systems and Organizations. NIST Special Publication 800-53 Rev. 4. Withdrawn September 23, 2021.

Joint Task Force. 2020. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53 Rev. 5.

NIST (National Institute of Standards and Technology). 2006. Minimum Security Requirements for Federal Information and Information Systems. FIPS 200.

NIST (National Institute of Standards and Technology). n.d. “Defense-in-Depth.” CSRC Glossary. Accessed October 12, 2026. See also the entries for need-to-know and compensating controls.

Nieles, Michael, Kelley Dempsey, and Victoria Yan Pillitteri. 2017. An Introduction to Information Security. NIST Special Publication 800-12 Rev. 1.

Rose, Scott, Oliver Borchert, Stu Mitchell, and Sean Connelly. 2020. Zero Trust Architecture. NIST Special Publication 800-207.

Ross, Ron, Mark Winstead, and Michael McEvilley. 2022. Engineering Trustworthy Secure Systems. NIST Special Publication 800-160 Vol. 1 Rev. 1.

Sudo Project. n.d. “Sudoers Manual.” Accessed October 12, 2026.

An exam blueprint is the document that fixes what a certification is allowed to test. For Security+ that document is the exam objectives, and everything built to prepare a candidate (textbook chapters, practice banks, course outcomes, flashcard decks) is tagged, directly or by inheritance, with its objective numbers. On SY0-801 the blueprint is Document Version 2.0: five domains and 27 numbered objectives, of which 2.1, characteristics of threats and vulnerabilities, and 2.6, AI threats and vulnerabilities, are new (CompTIA 2025).

The numbers are the interface between the blueprint and your study material, and that is the problem this post solves. A flashcard tagged “4.6” is only useful if you and the blueprint agree on what 4.6 means; on SY0-801 it means automation and orchestration, and a candidate who believes it means identity and access management will spend an evening on the wrong chapter. What follows is a reader’s map: how the five domains are laid out, where the large topics sit, what the verb at the front of each objective says about how the topic is tested, and how to move older material onto the 801 numbers without corrupting it. Domain weights were covered at T-38.

How the blueprint is organized

Every objective has three parts: a number, a verb, and a title. The number is domain and position, so 2.5 is the fifth objective in Domain 2. The verb is the opening word or phrase of the title, and SY0-801 uses five of them: Explain, Given a scenario, Summarize, Compare and contrast, and Describe. The title names the topic, and the bullets beneath it list the testable content. Objective 2.5, for instance, reads “Given a scenario, analyze indicators of malicious activity”: number 2.5, verb Given a scenario, topic indicators of malicious activity.

The domains are uneven. Domain 1 has three objectives (1.1 to 1.3), Domain 2 has six (2.1 to 2.6), Domain 3 has four (3.1 to 3.4), Domain 4 has eight (4.1 to 4.8), and Domain 5 has six (5.1 to 5.6). That is 27 in total; there is no 1.4 and no 4.9, and a reference to either number is a reliable sign of older material. The verbs are distributed just as unevenly: Explain leads 11 objectives, Given a scenario leads nine, Summarize four, Describe two, and Compare and contrast exactly one. Where the scenario objectives fall is the single most useful thing to know about the blueprint, because, as the later sections argue, the verb is the best available signal of how a topic will be tested.

Domain	Objectives	Scenario objectives	Series posts
1	1.1 to 1.3	1.2	T-36 to T-34
2	2.1 to 2.6	2.5	T-33 to T-23
3	3.1 to 3.4	3.2	T-22 to T-17
4	4.1 to 4.8	4.1, 4.3, 4.5, 4.6, 4.8	T-18, T-16 to T-8
5	5.1 to 5.6	5.6	T-7 to T-2

One caution before using the map. CompTIA’s V8 web page carries a 26-line objectives summary whose verbs do not match the document’s; it lists “Implement incident response activities” where the document’s 4.7 says Summarize (CompTIA 2026a). The document is the blueprint. Take numbers, verbs, and titles from Document Version 2.0 and treat the web summary as marketing copy.

Where the big topics live

Domain 1: foundations

Domain 1 is short and conceptual. Objective 1.1 (Explain) holds security controls and the core concepts, and it is one of the two places where least privilege is listed (T-36). Objective 1.2, change management, is the domain’s only scenario objective: the testable skill is choosing the backout plan or the approval path for a given change, not reciting the vocabulary of change control (T-35). Objective 1.3 (Explain) is cryptographic solutions, and encryption as a control is defined here rather than in the operations domain (T-34).

Domain 2: threats and vulnerabilities

Domain 2 is the second-largest domain and holds both of the new objectives. Objective 2.1 (Explain) opens the domain with the characteristics of threats and vulnerabilities, and it is the home of threat feeds, CVSS, and CVE (T-33). Objectives 2.2 and 2.3 are the only two Describe objectives on the exam: 2.2 covers threat actors (T-32), and 2.3, “Describe threat vectors and sources,” covers the paths by which a threat reaches a target (T-31). Objective 2.4, “Explain types of vulnerabilities and attack surfaces,” pairs weaknesses with the surfaces that expose them, and shadow IT is listed here as an attack surface rather than among the actors (T-29, T-28). Objective 2.5 is the domain’s scenario objective, indicators of malicious activity (T-30, T-28 to T-25), and 2.6 (Summarize) is AI threats and vulnerabilities (T-24, T-23).

Domain 3: architecture

Domain 3 is where the exam’s single Compare and contrast objective lives: 3.1, architecture models (T-22). Objective 3.2 (scenario) is securing the infrastructure, and it is where Zero Trust sits, alongside the second listing of least privilege (T-21, T-20). Objective 3.3 (Summarize) is protecting data (T-19, T-18), and 3.4 (Explain) is resilience and recovery (T-17).

Domain 4: operations

Domain 4 has eight objectives, five of them scenario objectives, and it carries most of the hands-on work. Objective 4.1, “apply mitigating controls, techniques, and solutions to secure the environment,” is the largest objective in the document, with 17 top-level bullets: hardening, application security (input validation through code signing), sandboxing, monitoring and alerting, MDM, firewalls, IDS/IPS, content filter, NAC, endpoint security, email security, operating system security, segmentation, access controls, application control, deception, and repositories with secrets scanning. Firewall types and 802.1X are here as well (T-16 to T-14, with deception at T-15). Objective 4.2 (Explain) is asset management, including decommissioning (T-18). Objective 4.3, “Given a scenario, perform tasks associated with vulnerability management,” asks you to rank and act on scan findings (T-13). Objective 4.4 (Explain) is alerting and monitoring (T-8). Objective 4.5 (scenario) is identity and access management: SAML, OAuth, MFA, and the rest of the identity stack (T-12, T-11). Objective 4.6 (scenario) is automation and orchestration (T-10); 4.7 (Summarize) is incident response, with isolation among its activities (T-9); and 4.8 (scenario) is investigation data and artifacts (T-8).

Domain 5: governance

Domain 5 is Explain-heavy: 5.1 governance artifacts, 5.2 risk management, 5.3 third-party risk, and 5.5 audits and assessments all carry Explain (T-7, T-6, T-5, T-3). Secure baselines live under Standards in 5.1 rather than in operations (T-7), gap analysis is in 5.5, and legal hold is listed under compliance in 5.4, the domain’s Summarize objective (T-4). The domain’s one scenario objective is 5.6, security awareness (T-2).

What the verb tells you about the test

Neither objectives document defines its verbs or ties an objective to an item type; each says only that questions are multiple-choice and performance-based (CompTIA 2023; CompTIA 2025). So the verb carries no official promise, and anything it tells you is inference from two further sources. CompTIA’s PBQ overview lists Security+ among the certifications with simulation PBQs but names no objectives (CompTIA n.d.b), and its testing-approach page links simulations to job tasks without naming a verb (CompTIA n.d.a). Scenario objectives are written as job tasks performed in a situation, so they are the most likely PBQ material. That is inference, not policy, and no CompTIA document limits PBQs to them.

Bloom’s taxonomy, the usual tool for ranking verbs, does not separate the four non-scenario verbs either. In the revised taxonomy, Explaining, Summarizing, and Comparing are all processes in one category, Understand; Describe is not among the 19 named processes, and the strict hierarchy was relaxed (Krathwohl 2002). Basically, Explain, Describe, Summarize, and Compare and contrast all ask the same thing: know the topic well enough to say what it is, how it works, and how it differs from its neighbors. Do not read Summarize on 4.7 (incident response) as a lighter requirement than Explain on 4.4 (alerting and monitoring); the taxonomy puts them in the same category. The defensible step is from those four verbs to Given a scenario, whose action verbs (apply in 4.1, perform in 4.3) mostly fit Apply, “Carrying out or using a procedure in a given situation,” while the analyze in 2.5 fits Analyze. That mapping is my interpretation; CompTIA publishes none.

In practice the verb changes what you rehearse. For an Explain or Describe objective, a definition and a distinction are the unit of study: what a threat vector is, and how it differs from a vulnerability. For a scenario objective, the unit of study is a decision made under stated constraints: given a change request, pick the backout plan (1.2, T-35); given a scan report, rank the findings (4.3, T-13); given a repetitive task, choose the automation (4.6, T-10). Those three deserve special attention from anyone working from older material, because change management, vulnerability management, and automation were Explain-level topics in 701-era study guides, and the habit of memorizing definitions where SY0-801 expects a choice is the habit most likely to survive unnoticed.

Nine of 27 objectives carry Given a scenario, one third of the blueprint by count. CompTIA publishes only domain weights, so any finer estimate is a model rather than a CompTIA figure, but giving each objective an equal share of its domain’s weight puts about 33.3 percent of the exam under scenario objectives, and the plain count agrees. Domain 4 alone holds five of the nine.

Retagging older study material

CompTIA’s V8 page links only to the objectives document and offers no mapping from the previous exam’s numbers (CompTIA 2026a), so anyone holding a question bank, flashcard deck, or course outline tagged with 701 numbers has to build the map. The renumbering has a simple mechanism. Domain 1 shifts down by one from 1.2 onward, because 1.1 absorbed the old 1.2. Domain 2 shifts up by one, because the new 2.1 was inserted at the top; the old 2.5, mitigation techniques, did not shift but folded into 4.1. Domain 4 shifts down by one from 4.6 onward, because 4.1 absorbed the old 4.5. Domains 3 and 5 keep every number. The result is that eleven numbers name a different topic on the two exams, and the worst pair is 2.4 and 2.5: a 701-era book’s chapter 2.4 carries the exact title of 801 2.5, so the matching sentence tempts you to keep the old number.

The tempting tool is a chain of find-and-replace rules, and it fails. Run in ascending order, the chain cascades:

>>> s = "SY0-701 2.1"
>>> for a, b in [("2.1","2.2"),("2.2","2.3"),("2.3","2.4"),("2.4","2.5"),("2.5","4.1")]: s = s.replace(a, b)
>>> s
'SY0-701 4.1'

The threat-actor item lands in 4.1, because each rule rewrites the previous rule’s output. Descending order breaks Domain 4 instead (4.6 to 4.5, then 4.5 to 4.1), so no single order is safe. An unanchored sed 's/1\.2/1.1/g' fails differently: it also rewrites “TLS 1.2” inside a question stem. The correct tool is one lookup per tag, anchored on the tag, using a dictionary that lists only the numbers that change; MAP.get(old, old) passes everything else through unchanged. The script below also flags the six 701 objectives whose content split across several 801 objectives, because those items need a human reader.

import csv, re, sys

MAP = dict(pair.split(">") for pair in (
    "1.2>1.1 1.3>1.2 1.4>1.3 2.1>2.2 2.2>2.3 2.3>2.4 2.4>2.5 "
    "2.5>4.1 4.5>4.1 4.6>4.5 4.7>4.6 4.8>4.7 4.9>4.8").split())
REVIEW = {"1.2", "2.2", "2.5", "4.1", "4.3", "4.5"}

out = csv.writer(sys.stdout, lineterminator="\n")
out.writerow(["item_id", "old_tag", "new_tag", "flag"])
for item_id, tag in csv.reader(sys.stdin):
    old = re.fullmatch(r"SY0-701 ([1-5]\.[1-9])", tag).group(1)
    new = MAP.get(old, old)
    out.writerow([item_id, tag, "SY0-801 " + new,
                  "REVIEW" if old in REVIEW else ""])

$ python3 retag.py < bank.csv
item_id,old_tag,new_tag,flag
Q0142,SY0-701 2.1,SY0-801 2.2,
Q0177,SY0-701 2.5,SY0-801 4.1,REVIEW
Q0203,SY0-701 4.6,SY0-801 4.5,
Q0311,SY0-701 4.9,SY0-801 4.8,
Q0356,SY0-701 1.2,SY0-801 1.1,REVIEW

The flagged objectives are not one-to-one, which is why a number map cannot finish the job. 701 1.2 sends deception to 4.1, gap analysis to 5.5, and Zero Trust to 3.2; 701 4.3 sends CVSS and CVE to 2.1. Smaller moves hit unflagged objectives too: shadow IT left the 701 2.1 actor list for 801 2.4, the 701 3.2 firewall types and 802.1X now sit under 801 4.1, and legal hold moved from 701 4.8 to 801 5.4. Basically, a number map retags and only a person re-reads. My own ITN 260 week overview pages cite 701 objective numbers, so moving them to 801 means this map plus that review.

What you need to know for SY0-801

• SY0-801 has 27 objectives in five domains; 1.4 and 4.9 do not exist.
• An objective number is domain and position, and the verb is the opening word of the title: Explain (11 objectives), Given a scenario (9), Summarize (4), Describe (2), or Compare and contrast (1).
• The nine scenario objectives are 1.2, 2.5, 3.2, 4.1, 4.3, 4.5, 4.6, 4.8, and 5.6.
• Describe appears only on 2.2 (threat actors) and 2.3 (threat vectors and sources); Compare and contrast appears only on 3.1 (architecture models).
• 2.5 is indicators of malicious activity; 4.5 is identity and access management; 4.6 is automation and orchestration; mitigations, firewalls, and endpoint security live in 4.1.
• “Attack surfaces” sits with vulnerabilities in 2.4; 2.3 is vectors and sources.
• Objective 4.1 is the largest in the document, 17 top-level bullets from hardening to secrets scanning.
• For scenario objectives, practice decisions, not definitions: pick a backout plan (1.2), rank scan findings (4.3), and choose an automation (4.6).
• Scenario objectives are the most likely PBQ source; no CompTIA document limits PBQs to them.
• Take verbs and titles from Document Version 2.0, not the V8 web page summary, which lists different verbs.
• If your material carries 701-era numbers, retag with a single-pass anchored lookup, then re-read anything tagged 701 1.2, 2.2, 2.5, 4.1, 4.3, or 4.5.
• A matching title does not mean a matching number: 701-era 1.4 cryptography is 801 1.3, and 701-era 2.4 indicators is 801 2.5.

Check yourself

1. A candidate’s 701-era flashcards tag every SAML, OAuth, and MFA card “4.6.” She is reorganizing them by SY0-801 objective. Where do they belong?

• A. Objective 4.6.
• B. Objective 4.5.
• C. Objective 4.1.
• D. Objective 2.4.

Answer: B. 701 4.6, identity and access management, is now 801 4.5. Keeping 4.6 is the trap: on 801, 4.6 is automation and orchestration.

2. An instructor retags a quiz bank by running these replacements in order: 2.1 to 2.2, 2.2 to 2.3, 2.3 to 2.4, 2.4 to 2.5, then 2.5 to 4.1. A threat-actor question starts tagged 701 2.1. Where does it end?

• A. 2.2, the correct 801 objective.
• B. 2.5, indicators of malicious activity.
• C. 4.1, mitigating controls.
• D. 2.1, because the tag is unchanged.

Answer: C. Each rule rewrites the previous rule’s output, so the tag cascades to 4.1. A single-pass lookup gives the correct 2.2.

3. Which change promotes an objective from Explain to Given a scenario on SY0-801?

• A. Incident response, 701 4.8 to 801 4.7.
• B. Vulnerability management, 701 4.3 to 801 4.3.
• C. Threat actors, 701 2.1 to 801 2.2.
• D. Governance, 701 5.1 to 801 5.1.

Answer: B. 801 4.3 reads “Given a scenario, perform tasks associated with vulnerability management.” Incident response went to Summarize, threat actors to Describe, and governance from Summarize to Explain.

This is T-37 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-36: Objective 1.1 Now Starts With Defense in Depth. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

CompTIA. n.d.a. “Approach to Performance-Based Testing.” CompTIA Exam Development. Accessed October 12, 2026.

CompTIA. n.d.b. “Performance-Based Questions Overview.” CompTIA Exam Development. Accessed October 12, 2026.

Krathwohl, David R. 2002. “A Revision of Bloom’s Taxonomy: An Overview.” Theory Into Practice 41 (4): 212 to 218.

Every CompTIA exam begins as a blueprint: a public objectives document that fixes the domains the exam covers, the weight each domain carries in the score, and the numbered objectives beneath each domain, each with a bulleted list of example content. For Security+, that blueprint is the CompTIA Security+ SY0-801 V8 Certification Exam Objectives, Document Version 2.0, which is new for the V8 exam and replaces the SY0-701 objectives, Version 5.0 (CompTIA 2023; CompTIA 2025); it takes effect when SY0-801 launches on November 17, 2026 (CompTIA 2026a). The document is short, free, and the only authoritative statement of what the exam can test, which makes it the first thing a candidate should read, before any book or video course.

This post reads the document the way an instructor reads a syllabus: what the exam looks like from the outside (the question count, the clock, and the passing score), how its five domains and 27 objectives are organized, what the published weights do and do not tell you, and what the front matter says about the audience, the examples, and the accreditation behind the exam. The practical payoff is a study budget. The weights are the only quantitative guidance CompTIA gives about where the questions come from, and a candidate who plans hours by the length of each domain’s bullet list instead of by its weight will put those hours in the wrong place.

The shape of the exam

The objectives document describes the exam in a handful of rows. The required exam is Security+ SY0-801 V8. A form contains a maximum of 90 questions, a mix of multiple-choice and performance-based items (the latter require the candidate to carry out a task rather than pick an answer), and the candidate has 90 minutes to answer them. The recommended experience is stated as a job role, a security administrator with two years of hands-on experience, and About the Exam repeats it in a sentence: “The target audience consists of security administrators with two years of hands-on experience.” It remains a recommendation, not a prerequisite.

Ninety is a maximum, not a fixed form length. CompTIA publishes no per-domain item counts and does not say whether any items are unscored, so any “questions per domain” figure a candidate derives from the weights is an estimate of expected share, not a count of what will appear on screen. That caveat matters later, when the weights become a study budget.

The document also prints the passing score: 750 on a scale of 100 to 900. This is a scaled score, meaning raw performance on a given form is transformed onto a fixed reporting scale so that the same number represents the same standard across forms. Dividing 750 by 900 and calling the result 83.3 percent is therefore meaningless as a percent-correct conversion. CompTIA says passing scores “are set using statistical analysis and are subject to change,” and it does not release scoring keys or detailed scoring information (CompTIA 2026d). The number itself is not new: CompTIA’s V7 page lists 750 on the same 100 to 900 scale for SY0-701 (CompTIA 2026b); what is new is that the objectives document prints it.

Three labels on the cover are easy to conflate, so separate them on day one. SY0-801 is the exam series code, V8 is the exam version, and Document Version 2.0 is the revision of the objectives document itself.

Five domains and 27 objectives

Below the test details, the blueprint is a two-level outline. The top level is the domain, a named area of practice that carries a percentage weight in the score. The second level is the objective, a numbered statement that begins with a verb and ends with a bulleted list of example content; objective 4.1, “Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment,” is a representative example. SY0-801 has five domains and 27 objectives.

Domain	Weight	Objectives
1.0 General Security Concepts	16%	3
2.0 Threats, Vulnerabilities, and Attacks	24%	6
3.0 Security Architecture	19%	4
4.0 Security Operations	27%	8
5.0 Security Program Management and Oversight	14%	6

Domain 4.0, Security Operations, is the heaviest at 27 percent and the longest at eight objectives; Domain 5.0, Security Program Management and Oversight, is the lightest at 14 percent. From heaviest to lightest the order runs 4.0, 2.0, 3.0, 1.0, 5.0, which is neither the order the domains are numbered nor the order of their objective counts: Domain 1.0 has only three objectives and outweighs Domain 5.0’s six. Count the objectives from the PDF itself. The split is 3, 6, 4, 8, and 6. CompTIA’s own V8 web page summarizes the exam with 26 paraphrased objectives, and a source claiming 25 is wrong, so the document, not a page about it, is the reference.

The domain titles are a fair guide to content, with two placements worth knowing before you open a study guide. Mitigation, the application of controls that reduce the likelihood or impact of a threat, is not filed in Domain 2.0 beside the threats and attacks it answers; it is objective 4.1 in Security Operations, quoted above, and a scenario objective at that (T-16 covers 4.1 in detail). Internet of Things (IoT) devices are tested under objective 2.3, which lists “Internet of Things (IoT)-based” vectors with cameras, sensors, and printers beneath it (T-22 covers that objective), even though the About the Exam summary at the front of the document never names IoT. The habit to build is to locate a topic by its objective, not by a domain title or a summary bullet.

What the bullets are, and are not

Beneath every objective sits a bulleted list, and the document says twice that the list is a set of examples rather than a syllabus. The PLEASE NOTE clause states that the bulleted examples “are not exhaustive lists,” and About the Exam adds that the content examples “should not be construed as a comprehensive listing of all the content of this examination.” The practical reading is that a question may test a mechanism that no bullet names, provided it falls under an objective. A candidate who memorizes the bullets as a checklist has memorized the examples, not the scope; the objective sentence is the unit of scope, and the bullets show the kind of content it reaches.

Weight is not list length

CompTIA reports each domain’s weight as a “percentage of examination,” and that phrase is the whole of what the number promises: a domain weighted at 16 percent contributes about 16 percent of the scored exam, however many bullets sit beneath it. CompTIA publishes no per-objective weights, so dividing a domain’s weight by its objective count gives only an average. By that average an 801 Domain 1.0 objective is worth 5.33 percent of the exam, about 4.8 question equivalents at the 90-item maximum, while a Domain 5.0 objective is worth 2.33 percent, about 2.1. Basically, the three Domain 1.0 objectives are the densest real estate on the exam.

The bullet lists point the other way. Counting every bulleted item at every level, objective titles excluded, Domain 1.0 lists about 74 items and Domain 5.0 about 182, out of about 849 in the whole document; treat every count as approximate. Per weight point, that is about 4.62 listed items in Domain 1.0 and about 13.00 in Domain 5.0. A plan that allocates time by list length would spend roughly two and a half times as long on governance as on general security concepts, when the score rewards the reverse. Domain 5.0 content is not unimportant; its share of the score is simply smaller than its share of the page.

Here is the arithmetic for a budget of 60 study hours, in Python 3:

w801 = {"D1": 16, "D2": 24, "D3": 19, "D4": 27, "D5": 14}
hours = 60
print(f"{'dom':<4}{'801%':>5}{'q@90':>6}{'hours':>7}")
for d, w in w801.items():
    print(f"{d:<4}{w:>5}{0.9 * w:>6.1f}{hours * w / 100:>7.1f}")

dom  801%  q@90  hours
D1     16  14.4    9.6
D2     24  21.6   14.4
D3     19  17.1   11.4
D4     27  24.3   16.2
D5     14  12.6    8.4

The q@90 column is illustrative only, for the reasons above: weight is a percentage of examination, there are no published per-domain item counts, unscored items are not ruled out, and ninety is a maximum. Rounded, the question equivalents (14, 22, 17, 24, 13) sum to exactly 90, which makes them a handy mental model and nothing more. My advice to ITN 260 students is to set the base budget by percentage, then move hours toward whichever objectives a practice set shows they miss.

The front matter: audience, examples, and accreditation

Before the domains, the About the Exam section describes the successful candidate in five bullets. The first is incident response: the candidate can “Identify, interpret, and support activities as part of the incident response process.” The second concerns security posture, scoped to an environment. The third is to “Manage and monitor” what the document calls “modern operating environments, including cloud, mobile, and hybrid.” The fourth covers regulations and policies, and the fifth is to “Understand and apply mitigation techniques.” Read beside the recommended experience, the bullets sketch a security administrator who supports an incident response process rather than leading it, works across cloud, mobile, and hybrid environments, and applies mitigations as routine work.

The front matter ends with an EXAM ACCREDITATION section: the exam is accredited by the ANSI National Accreditation Board (ANAB) to show compliance with ISO 17024 and therefore “undergoes regular reviews and updates to the exam objectives.” The printed section is new; the accreditation is not. CompTIA’s Exam Development page lists Security+ among certifications “accredited by the ANSI National Accreditation Board (ANAB) under the ISO 17024 standard,” and an Internet Archive snapshot of that page dated June 25, 2025, when SY0-701 was the only Security+ exam, carries the identical sentence (CompTIA 2026c).

Accreditation is a statement about the certifying body, not about the candidate or the candidate’s employer. The full identifier is ISO/IEC 17024, a conformity-assessment standard for bodies that certify persons; it is not ISO/IEC 27001, the organizational information security management system (ISMS) standard. The public 2012 text explains what “regular reviews” means. Clause 8.4 e) requires a job or practice analysis “conducted and updated” to identify tasks and required competence and to “confirm the assessment mechanisms and examination content,” and clause 9.3.1 requires exam design that ensures comparable results “both in content and difficulty” (ISO/IEC 2012). CompTIA does not connect those clauses to its own choices, so the following is inference rather than a CompTIA statement: a reweighted blueprint is the visible output of an updated job analysis, and a fixed scaled cut of 750 is one common way to keep pass and fail decisions comparable across forms. The 801 document names no edition of the standard; the third edition, ISO/IEC 17024:2026, was published in March 2026 (SFS 2026), with a transition that ends March 27, 2029 (International Accreditation Service 2026).

What you need to know for SY0-801

• The five SY0-801 domains and weights: 1.0 General Security Concepts, 16 percent; 2.0 Threats, Vulnerabilities, and Attacks, 24 percent; 3.0 Security Architecture, 19 percent; 4.0 Security Operations, 27 percent; and 5.0 Security Program Management and Oversight, 14 percent.
• Domain 4.0 is the largest and Domain 5.0 the smallest; from heaviest to lightest the order is 4.0, 2.0, 3.0, 1.0, 5.0.
• SY0-801 has 27 objectives, split 3, 6, 4, 8, and 6. A source claiming 25 is wrong, and CompTIA’s own V8 web page lists 26 paraphrased objectives, so study from the PDF.
• Weight is a “percentage of examination.” It is not list length, not a per-objective weight, and not a question count; CompTIA publishes none of those.
• Mitigation is tested under scenario objective 4.1 in Domain 4.0 and named in the fifth About the Exam bullet.
• IoT is tested under objective 2.3, which lists IoT-based vectors, even though About the Exam does not name it.
• The exam shell is a maximum of 90 questions, multiple-choice and performance-based items, and 90 minutes; ninety is a maximum, not a fixed form length.
• The passing score is 750, a scaled score on 100 to 900, not a percentage; it is the same cut CompTIA’s V7 page lists for SY0-701 (CompTIA 2026b).
• The recommended experience is a security administrator with two years of hands-on experience; it is a recommendation, not a prerequisite.
• The bulleted examples “are not exhaustive lists” and “should not be construed as a comprehensive listing” of exam content; the objective, not its bullets, defines scope.
• ANAB accreditation to ISO/IEC 17024 covers bodies that certify persons, not ISMS compliance under ISO/IEC 27001; it predates SY0-801, and only the printed section is new.
• Three labels: SY0-801 is the exam series code, V8 is the exam version, and Document Version 2.0 is the revision of the objectives document.

Check yourself

These are original practice questions.

1. A candidate has 50 study hours left before an SY0-801 appointment and allocates them in proportion to the published domain weights. How many hours go to Domain 1.0, General Security Concepts?

• A. 6 hours.
• B. 7 hours.
• C. 8 hours.
• D. 10 hours.

Answer: C. Domain 1.0 carries 16 percent, and 16 percent of 50 is 8. Option A applies the old 701 weight of 12 percent; B uses Domain 5.0’s 14 percent.

2. A study group sees that SY0-801 Domain 5.0 lists about 182 items and Domain 1.0 lists about 74, so it plans to spend more than twice as long on Domain 5.0. What is the best correction?

• A. The plan is sound because longer lists produce more questions.
• B. The plan should follow the published weights, which give Domain 1.0 16 percent and Domain 5.0 14 percent.
• C. The plan should skip Domain 5.0 because governance items are unscored.
• D. The plan should skip Domain 1.0 because it appears only in performance-based items.

Answer: B. Representation is stated as a percentage of the examination, not as list length. CompTIA says nothing about unscored items or about mapping domains to item types, so C and D invent facts.

3. A hiring manager reads that SY0-801 is accredited by ANAB to ISO 17024 and asks what that means. Which answer is most accurate?

• A. The candidate’s employer must run an ISO/IEC 27001 information security management system.
• B. CompTIA operates as a body certifying persons under a standard that requires job analysis and periodic review of the exam scheme.
• C. The exam objectives are frozen until SY0-801 retires.
• D. Security+ became accredited for the first time with SY0-801.

Answer: B. ISO/IEC 17024 governs personnel certification bodies, and the 801 document says accreditation means the exam “undergoes regular reviews and updates.” CompTIA already listed Security+ as ANAB accredited while SY0-701 was the only version, so D is false.

This is T-38 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-37: Same Objective Numbers, Different Topics.

References

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

CompTIA. 2026b. “Security+ V7.” Accessed October 12, 2026.

CompTIA. 2026c. “Exam Development.” Accessed October 12, 2026.

CompTIA. 2026d. “Candidate Testing Policies.” Accessed October 12, 2026.

International Accreditation Service. 2026. IAS Transition Policy for International Standard ISO/IEC 17024:2026. IAS/PCB/033.

ISO/IEC. 2012. Conformity Assessment: General Requirements for Bodies Operating Certification of Persons. ISO/IEC 17024:2012, second edition.

SFS. 2026. “ISO/IEC 17024:2026.” Finnish Standards Association store listing. Accessed October 12, 2026.