SY0-801 Domains Explained With Examples

The short answer

SY0-801 has five domains: General Security Concepts (16%), Threats, Vulnerabilities, and Attacks (24%), Security Architecture (19%), Security Operations (27%) and Security Program Management and Oversight (14%). The list below follows the exam objectives that CompTIA publishes and explains what each domain looks like in real work. The objectives are a preview for an exam that CompTIA expects to launch on or around November 17, 2026, so check the vendor page for the final version.

Domain 1: General Security Concepts (16%)

What it covers. The foundations. Control categories (technical, managerial, physical, operational) and control types (preventive, deterrent, corrective, detective, compensating, directive). Core ideas such as confidentiality, integrity and availability, authentication, authorization and accounting, non-repudiation, Zero Trust and least privilege. Change management and its security impact. Cryptographic solutions.

In practice. A control category says who or what runs the control. A control type says what it does. A camera is a physical control, and it can be deterrent or detective depending on how the question frames it. Change management means approvals, impact analysis, testing, a backout plan and documentation. Cryptography covers public key infrastructure, certificates, encryption levels (disk, file, database, record), key exchange, hashing, salting and digital signatures.

Typical traps.

  • Mixing category and type. Read which one the question asks for.
  • Confusing hashing with encryption, or a hash with a digital signature. A hash checks integrity. A signature adds proof of who signed.
  • Choosing a rollback when the question says rollback is impractical. Fail forward means fixing in the new state.

What to practice. Sort ten example controls by both category and type. Walk through how a certificate is requested, issued and revoked, and when you would use a certificate revocation list or the online status protocol.

Domain 2: Threats, Vulnerabilities, and Attacks (24%)

What it covers. Threat actors and their motivations, threat vectors and attack surfaces, types of vulnerabilities, indicators of malicious activity, and a new objective on artificial intelligence risks. This domain includes scoring and prioritizing vulnerabilities with CVSS and CVE identifiers.

In practice. You are given a short story and must name the actor, the vector or the attack. Examples: a hacktivist defacing a site for ideology, an insider copying files, a QR code in a phishing message (quishing), a user whose accounts show impossible travel, password spraying against many accounts, or someone manipulating an AI model with a crafted prompt.

Typical traps.

  • Matching on one keyword. Phishing, spear phishing, whaling, smishing and vishing differ by target and channel.
  • Mixing up brute force (many guesses at one account) and password spraying (a few common passwords across many accounts).
  • Confusing the AI terms: poisoning changes training data, prompt injection and jailbreaking target the running model, and evasion fools a classifier with crafted input.

What to practice. Build a table with each attack, its indicator and its best defense. Write one sentence for each AI risk in the objectives.

Domain 3: Security Architecture (19%)

What it covers. Security implications of architecture models (cloud, serverless, hybrid, on-premises, operational technology, air-gapped, microservices, infrastructure as code), managing security architecture (device placement, zones, Zero Trust, VPNs, out-of-band management), data protection concepts (data states, classifications, masking, tokenization, encryption, data roles and life cycle) and resilience and recovery.

In practice. You decide where to place a firewall, how to segment a network, how to protect data at rest and in transit, and how to recover after a failure. Resilience terms include hot, warm and cold sites, load balancing, clustering, backups with immutability, failover testing, RTO, RPO, MTTR and MTBF.

Typical traps.

  • Tokenization is reversible through a vault. Masking and de-identification are meant to remove the link.
  • Choosing the strongest option when the scenario asks for the cheapest or least disruptive one that still meets the requirement.
  • Mixing RTO (how fast you must be back) and RPO (how much data loss you can accept).

What to practice. Draw a simple network with zones. Mark data states and where each protection applies. Match three recovery scenarios to site types.

Domain 4: Security Operations (27%)

What it covers. The largest domain. Mitigating controls such as segmentation, hardening, sandboxing, honeypots, firewalls, intrusion detection and prevention, endpoint tools, network access control, and email authentication (SPF, DKIM, DMARC). Asset management. Vulnerability management. Alerting and monitoring (SIEM, NetFlow, SNMP, syslog, SCAP). Identity and access management. Automation and orchestration, including AI. Incident response. Data sources for investigations.

In practice. This is the daily work of a security administrator: tuning alerts, reading logs, granting access, scanning for weaknesses, running through an incident playbook and collecting evidence.

Typical traps.

  • Choosing eradication before containment, or reimaging before capturing evidence. Know the order of the response phases and the order of volatility.
  • Confusing access control models: role-based, rule-based, mandatory, discretionary and time-based.
  • Mixing up monitoring protocols. SNMP polls device health, syslog carries event messages and NetFlow describes traffic flows.
  • Treating an IDS as a blocker. Detection alerts. Prevention blocks.

What to practice. Read sample logs. Walk through a ransomware incident from detection to lessons learned. List what each of SPF, DKIM and DMARC actually checks.

Domain 5: Security Program Management and Oversight (14%)

What it covers. Governance artifacts (policies, standards, procedures, guidelines), risk management (assessment, register, treatment, business impact analysis, SLE, ARO, ALE), third-party risk (vendor selection, agreement types, monitoring), compliance and privacy, audit and assessment activities (penetration testing types, gap analysis, benchmarking), and security awareness training.

In practice. You read a short business situation and name the right document, agreement, calculation or assessment. It is less technical, and it has a lot of similar-sounding terms.

Typical traps.

  • Agreement types: a service-level agreement sets measurable service, a non-disclosure agreement protects information, a master services agreement sets overall terms and a statement of work defines specific work.
  • Risk treatment: transfer, accept, avoid or mitigate. Insurance transfers risk. It does not remove it.
  • Penetration test types: known, partially known and unknown environment. Passive and active reconnaissance differ in whether you touch the target.

What to practice. Do three ALE calculations by hand. List what each agreement type is for. Write a one-line difference between a policy, a standard, a procedure and a guideline.

How to use this page

Mark each domain green, amber or red after your first practice exam. Spend most time on amber and red domains, weighted by how much of the exam they represent. A weak Domain 4 costs more than a weak Domain 5. The study plan shows how to schedule that.

More guides for SY0-801

Next step

Try the sample questions to see how these topics appear in scenarios. When you want full sets with per-domain results, the SY0-801 practice tests cover all five domains.

Try the SY0-801 practice exams