Security+ 801 Countdown, T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives

Every CompTIA exam begins as a blueprint: a public objectives document that fixes the domains the exam covers, the weight each domain carries in the score, and the numbered objectives beneath each domain, each with a bulleted list of example content. For Security+, that blueprint is the CompTIA Security+ SY0-801 V8 Certification Exam Objectives, Document Version 2.0, which is new for the V8 exam and replaces the SY0-701 objectives, Version 5.0 (CompTIA 2023; CompTIA 2025); it takes effect when SY0-801 launches on November 17, 2026 (CompTIA 2026a). The document is short, free, and the only authoritative statement of what the exam can test, which makes it the first thing a candidate should read, before any book or video course.

This post reads the document the way an instructor reads a syllabus: what the exam looks like from the outside (the question count, the clock, and the passing score), how its five domains and 27 objectives are organized, what the published weights do and do not tell you, and what the front matter says about the audience, the examples, and the accreditation behind the exam. The practical payoff is a study budget. The weights are the only quantitative guidance CompTIA gives about where the questions come from, and a candidate who plans hours by the length of each domain’s bullet list instead of by its weight will put those hours in the wrong place.

The shape of the exam

The objectives document describes the exam in a handful of rows. The required exam is Security+ SY0-801 V8. A form contains a maximum of 90 questions, a mix of multiple-choice and performance-based items (the latter require the candidate to carry out a task rather than pick an answer), and the candidate has 90 minutes to answer them. The recommended experience is stated as a job role, a security administrator with two years of hands-on experience, and About the Exam repeats it in a sentence: “The target audience consists of security administrators with two years of hands-on experience.” It remains a recommendation, not a prerequisite.

Ninety is a maximum, not a fixed form length. CompTIA publishes no per-domain item counts and does not say whether any items are unscored, so any “questions per domain” figure a candidate derives from the weights is an estimate of expected share, not a count of what will appear on screen. That caveat matters later, when the weights become a study budget.

The document also prints the passing score: 750 on a scale of 100 to 900. This is a scaled score, meaning raw performance on a given form is transformed onto a fixed reporting scale so that the same number represents the same standard across forms. Dividing 750 by 900 and calling the result 83.3 percent is therefore meaningless as a percent-correct conversion. CompTIA says passing scores “are set using statistical analysis and are subject to change,” and it does not release scoring keys or detailed scoring information (CompTIA 2026d). The number itself is not new: CompTIA’s V7 page lists 750 on the same 100 to 900 scale for SY0-701 (CompTIA 2026b); what is new is that the objectives document prints it.

Three labels on the cover are easy to conflate, so separate them on day one. SY0-801 is the exam series code, V8 is the exam version, and Document Version 2.0 is the revision of the objectives document itself.

Five domains and 27 objectives

Below the test details, the blueprint is a two-level outline. The top level is the domain, a named area of practice that carries a percentage weight in the score. The second level is the objective, a numbered statement that begins with a verb and ends with a bulleted list of example content; objective 4.1, “Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment,” is a representative example. SY0-801 has five domains and 27 objectives.

Domain	Weight	Objectives
1.0 General Security Concepts	16%	3
2.0 Threats, Vulnerabilities, and Attacks	24%	6
3.0 Security Architecture	19%	4
4.0 Security Operations	27%	8
5.0 Security Program Management and Oversight	14%	6

Domain 4.0, Security Operations, is the heaviest at 27 percent and the longest at eight objectives; Domain 5.0, Security Program Management and Oversight, is the lightest at 14 percent. From heaviest to lightest the order runs 4.0, 2.0, 3.0, 1.0, 5.0, which is neither the order the domains are numbered nor the order of their objective counts: Domain 1.0 has only three objectives and outweighs Domain 5.0’s six. Count the objectives from the PDF itself. The split is 3, 6, 4, 8, and 6. CompTIA’s own V8 web page summarizes the exam with 26 paraphrased objectives, and a source claiming 25 is wrong, so the document, not a page about it, is the reference.

The domain titles are a fair guide to content, with two placements worth knowing before you open a study guide. Mitigation, the application of controls that reduce the likelihood or impact of a threat, is not filed in Domain 2.0 beside the threats and attacks it answers; it is objective 4.1 in Security Operations, quoted above, and a scenario objective at that (T-16 covers 4.1 in detail). Internet of Things (IoT) devices are tested under objective 2.3, which lists “Internet of Things (IoT)-based” vectors with cameras, sensors, and printers beneath it (T-22 covers that objective), even though the About the Exam summary at the front of the document never names IoT. The habit to build is to locate a topic by its objective, not by a domain title or a summary bullet.

What the bullets are, and are not

Beneath every objective sits a bulleted list, and the document says twice that the list is a set of examples rather than a syllabus. The PLEASE NOTE clause states that the bulleted examples “are not exhaustive lists,” and About the Exam adds that the content examples “should not be construed as a comprehensive listing of all the content of this examination.” The practical reading is that a question may test a mechanism that no bullet names, provided it falls under an objective. A candidate who memorizes the bullets as a checklist has memorized the examples, not the scope; the objective sentence is the unit of scope, and the bullets show the kind of content it reaches.

Weight is not list length

CompTIA reports each domain’s weight as a “percentage of examination,” and that phrase is the whole of what the number promises: a domain weighted at 16 percent contributes about 16 percent of the scored exam, however many bullets sit beneath it. CompTIA publishes no per-objective weights, so dividing a domain’s weight by its objective count gives only an average. By that average an 801 Domain 1.0 objective is worth 5.33 percent of the exam, about 4.8 question equivalents at the 90-item maximum, while a Domain 5.0 objective is worth 2.33 percent, about 2.1. Basically, the three Domain 1.0 objectives are the densest real estate on the exam.

The bullet lists point the other way. Counting every bulleted item at every level, objective titles excluded, Domain 1.0 lists about 74 items and Domain 5.0 about 182, out of about 849 in the whole document; treat every count as approximate. Per weight point, that is about 4.62 listed items in Domain 1.0 and about 13.00 in Domain 5.0. A plan that allocates time by list length would spend roughly two and a half times as long on governance as on general security concepts, when the score rewards the reverse. Domain 5.0 content is not unimportant; its share of the score is simply smaller than its share of the page.

Here is the arithmetic for a budget of 60 study hours, in Python 3:

w801 = {"D1": 16, "D2": 24, "D3": 19, "D4": 27, "D5": 14}
hours = 60
print(f"{'dom':<4}{'801%':>5}{'q@90':>6}{'hours':>7}")
for d, w in w801.items():
    print(f"{d:<4}{w:>5}{0.9 * w:>6.1f}{hours * w / 100:>7.1f}")

dom  801%  q@90  hours
D1     16  14.4    9.6
D2     24  21.6   14.4
D3     19  17.1   11.4
D4     27  24.3   16.2
D5     14  12.6    8.4

The q@90 column is illustrative only, for the reasons above: weight is a percentage of examination, there are no published per-domain item counts, unscored items are not ruled out, and ninety is a maximum. Rounded, the question equivalents (14, 22, 17, 24, 13) sum to exactly 90, which makes them a handy mental model and nothing more. My advice to ITN 260 students is to set the base budget by percentage, then move hours toward whichever objectives a practice set shows they miss.

The front matter: audience, examples, and accreditation

Before the domains, the About the Exam section describes the successful candidate in five bullets. The first is incident response: the candidate can “Identify, interpret, and support activities as part of the incident response process.” The second concerns security posture, scoped to an environment. The third is to “Manage and monitor” what the document calls “modern operating environments, including cloud, mobile, and hybrid.” The fourth covers regulations and policies, and the fifth is to “Understand and apply mitigation techniques.” Read beside the recommended experience, the bullets sketch a security administrator who supports an incident response process rather than leading it, works across cloud, mobile, and hybrid environments, and applies mitigations as routine work.

The front matter ends with an EXAM ACCREDITATION section: the exam is accredited by the ANSI National Accreditation Board (ANAB) to show compliance with ISO 17024 and therefore “undergoes regular reviews and updates to the exam objectives.” The printed section is new; the accreditation is not. CompTIA’s Exam Development page lists Security+ among certifications “accredited by the ANSI National Accreditation Board (ANAB) under the ISO 17024 standard,” and an Internet Archive snapshot of that page dated June 25, 2025, when SY0-701 was the only Security+ exam, carries the identical sentence (CompTIA 2026c).

Accreditation is a statement about the certifying body, not about the candidate or the candidate’s employer. The full identifier is ISO/IEC 17024, a conformity-assessment standard for bodies that certify persons; it is not ISO/IEC 27001, the organizational information security management system (ISMS) standard. The public 2012 text explains what “regular reviews” means. Clause 8.4 e) requires a job or practice analysis “conducted and updated” to identify tasks and required competence and to “confirm the assessment mechanisms and examination content,” and clause 9.3.1 requires exam design that ensures comparable results “both in content and difficulty” (ISO/IEC 2012). CompTIA does not connect those clauses to its own choices, so the following is inference rather than a CompTIA statement: a reweighted blueprint is the visible output of an updated job analysis, and a fixed scaled cut of 750 is one common way to keep pass and fail decisions comparable across forms. The 801 document names no edition of the standard; the third edition, ISO/IEC 17024:2026, was published in March 2026 (SFS 2026), with a transition that ends March 27, 2029 (International Accreditation Service 2026).

What you need to know for SY0-801

• The five SY0-801 domains and weights: 1.0 General Security Concepts, 16 percent; 2.0 Threats, Vulnerabilities, and Attacks, 24 percent; 3.0 Security Architecture, 19 percent; 4.0 Security Operations, 27 percent; and 5.0 Security Program Management and Oversight, 14 percent.
• Domain 4.0 is the largest and Domain 5.0 the smallest; from heaviest to lightest the order is 4.0, 2.0, 3.0, 1.0, 5.0.
• SY0-801 has 27 objectives, split 3, 6, 4, 8, and 6. A source claiming 25 is wrong, and CompTIA’s own V8 web page lists 26 paraphrased objectives, so study from the PDF.
• Weight is a “percentage of examination.” It is not list length, not a per-objective weight, and not a question count; CompTIA publishes none of those.
• Mitigation is tested under scenario objective 4.1 in Domain 4.0 and named in the fifth About the Exam bullet.
• IoT is tested under objective 2.3, which lists IoT-based vectors, even though About the Exam does not name it.
• The exam shell is a maximum of 90 questions, multiple-choice and performance-based items, and 90 minutes; ninety is a maximum, not a fixed form length.
• The passing score is 750, a scaled score on 100 to 900, not a percentage; it is the same cut CompTIA’s V7 page lists for SY0-701 (CompTIA 2026b).
• The recommended experience is a security administrator with two years of hands-on experience; it is a recommendation, not a prerequisite.
• The bulleted examples “are not exhaustive lists” and “should not be construed as a comprehensive listing” of exam content; the objective, not its bullets, defines scope.
• ANAB accreditation to ISO/IEC 17024 covers bodies that certify persons, not ISMS compliance under ISO/IEC 27001; it predates SY0-801, and only the printed section is new.
• Three labels: SY0-801 is the exam series code, V8 is the exam version, and Document Version 2.0 is the revision of the objectives document.

Check yourself

These are original practice questions.

1. A candidate has 50 study hours left before an SY0-801 appointment and allocates them in proportion to the published domain weights. How many hours go to Domain 1.0, General Security Concepts?

• A. 6 hours.
• B. 7 hours.
• C. 8 hours.
• D. 10 hours.

Answer: C. Domain 1.0 carries 16 percent, and 16 percent of 50 is 8. Option A applies the old 701 weight of 12 percent; B uses Domain 5.0’s 14 percent.

2. A study group sees that SY0-801 Domain 5.0 lists about 182 items and Domain 1.0 lists about 74, so it plans to spend more than twice as long on Domain 5.0. What is the best correction?

• A. The plan is sound because longer lists produce more questions.
• B. The plan should follow the published weights, which give Domain 1.0 16 percent and Domain 5.0 14 percent.
• C. The plan should skip Domain 5.0 because governance items are unscored.
• D. The plan should skip Domain 1.0 because it appears only in performance-based items.

Answer: B. Representation is stated as a percentage of the examination, not as list length. CompTIA says nothing about unscored items or about mapping domains to item types, so C and D invent facts.

3. A hiring manager reads that SY0-801 is accredited by ANAB to ISO 17024 and asks what that means. Which answer is most accurate?

• A. The candidate’s employer must run an ISO/IEC 27001 information security management system.
• B. CompTIA operates as a body certifying persons under a standard that requires job analysis and periodic review of the exam scheme.
• C. The exam objectives are frozen until SY0-801 retires.
• D. Security+ became accredited for the first time with SY0-801.

Answer: B. ISO/IEC 17024 governs personnel certification bodies, and the 801 document says accreditation means the exam “undergoes regular reviews and updates.” CompTIA already listed Security+ as ANAB accredited while SY0-701 was the only version, so D is false.

This is T-38 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-37: Same Objective Numbers, Different Topics.

References

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CompTIA. 2026a. “Security+ V8.” Accessed October 12, 2026.

CompTIA. 2026b. “Security+ V7.” Accessed October 12, 2026.

CompTIA. 2026c. “Exam Development.” Accessed October 12, 2026.

CompTIA. 2026d. “Candidate Testing Policies.” Accessed October 12, 2026.

International Accreditation Service. 2026. IAS Transition Policy for International Standard ISO/IEC 17024:2026. IAS/PCB/033.

ISO/IEC. 2012. Conformity Assessment: General Requirements for Bodies Operating Certification of Persons. ISO/IEC 17024:2012, second edition.

SFS. 2026. “ISO/IEC 17024:2026.” Finnish Standards Association store listing. Accessed October 12, 2026.