CompTIA Security+ (SY0-801) — the full course

This course teaches SY0-801, the Security+ exam that launches on or around 17 November 2026. If you are booked on SY0-701, which can be taken until 11 June 2027, use our SY0-701 course instead.

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives.

47written lessons

78hands-on labs

75hours of lab work

18audio episodes

Start with lesson 1 — Security controls: the four categories and the six types

Jump to a domain: 1. General Security Concepts · 2. Threats, Vulnerabilities, and Attacks · 3. Security Architecture · 4. Security Operations · 5. Security Program Management and Oversight

What the exam weighs

Domain	Share of the exam	Lessons here
1. General Security Concepts	16%	7
2. Threats, Vulnerabilities, and Attacks	24%	11
3. Security Architecture	19%	9
4. Security Operations	27%	13
5. Security Program Management and Oversight	14%	6

The curriculum

1. General Security Concepts 16% of the exam

01 Security controls: the four categories and the six types objective 1.1 part single
- Write a compensating control that an auditor would accept applied · 75 min
- Classify the controls already running on your own machine short · 30 min
02 Defence in depth: CIA, AAA and non-repudiation, stated precisely enough to be useful objective 1.1 part single
- Produce something only you could have produced short · 30 min
03 Zero trust and least privilege, as principles rather than products objective 1.1 part single
- Replace standing admin rights with one scoped, logged permission short · 35 min
04 Change management, which is a security control and is examined as one objective 1.2 part single
- Detect drift from a baseline you recorded yourself applied · 70 min
- Write the change record for a change you actually make short · 30 min
05 PKI and certificates, and the key management that decides whether any of it works objective 1.3 part single
- Build a two-tier certificate chain and break it on purpose short · 40 min
06 Encryption: algorithms, key length, key exchange, and where to apply it objective 1.3 part single
- Watch a key exchange, and find the handshake with no forward secrecy short · 35 min
07 Hashing, salting, digital signatures and obfuscation objective 1.3 part single
- Tell tokenisation, masking and encryption apart by what survives applied · 75 min
- Sign a release, distribute it, and detect a tampered copy capstone · 120 min
- Show what salting changes and what it does not short · 30 min

2. Threats, Vulnerabilities, and Attacks 24% of the exam

01 Characterising threats and vulnerabilities: intelligence, scoring and what to fix first objective 2.1 part single
- Turn a findings export into a fix-first list applied · 70 min
- Recompute a CVSS base score, then list what it cannot see short · 35 min
02 Threat actors and their motivations, sorted by what they can afford objective 2.2 part single
- Offboard an insider completely, and find what you would have missed applied · 70 min
- Sort seven actors by what they can afford short · 30 min
03 Threat vectors: messages, attachments, networks, remote access and the supply chain objective 2.3 part single
- Answer 'are we affected?' from a bill of materials applied · 75 min
- Close the remote access door on your own VM short · 35 min
04 Threat vectors: browsers, endpoints, people, IoT and OT, physical access and radio objective 2.3 part single
- Lock down extensions and session cookies on your own lab short · 35 min
05 Application, code and operating-system vulnerabilities objective 2.4 part single
- Watch a race condition happen, then close it short · 40 min
06 Attack surfaces: systems, credentials, devices, identity providers and exposed data objective 2.4 part single
- Write the compensating control for a device that can never be patched applied · 80 min
- Count your own attack surface, then reduce it short · 35 min
07 Social engineering: phishing in all its forms, impersonation and deepfakes objective 2.5 part single
- Read the headers and decide whether the sender is real short · 35 min
08 Recognising malware, and the indicators of compromise it leaves objective 2.5 part single
- Detect a beacon by its regularity, not its content short · 40 min
09 Credential attacks, and the controls that end them objective 2.5 part single
- Tell spraying and brute force apart in your own auth log short · 40 min
10 Network, application and physical attack indicators objective 2.5 part single
- Write one detection per indicator, and prove none of them cries wolf applied · 80 min
- Take one lab VM from default install to defended, and measure every step capstone · 130 min
- Name the attack from the log line short · 35 min
11 AI threats and vulnerabilities, from the defender's side objective 2.6 part single
- Put an AI agent on a short leash, then write the rules for the people using AI applied · 70 min
- Find the instructions hidden in documents before an assistant reads them short · 35 min

3. Security Architecture 19% of the exam

01 Cloud and on-premises architecture, compared by where the risk lands objective 3.1 part single
- Make one microservice stop trusting its neighbours short · 40 min
02 Operational technology, air gaps, segmentation and infrastructure as code objective 3.1 part single
- Make the insecure configuration impossible to deploy applied · 80 min
- Break your own air gap four ways on paper short · 30 min
03 Device placement, security zones, diversity and failure modes objective 3.2 part single
- Prove a sensor is blind to the traffic you care about short · 40 min
04 Secure communication and access: VPNs, tunnels, SSE and out-of-band management objective 3.2 part single
- Give a partner file transfer and nothing else applied · 75 min
- Watch what a tunnel hides and what it does not short · 40 min
05 Zero trust architecture and identity infrastructure objective 3.2 part single
- Shrink an implicit trust zone and measure it short · 45 min
06 Data types, states, classification and the methods that protect them objective 3.3 part single
- De-identify a dataset and measure what each method leaves behind applied · 75 min
- Protect the same field in three states and find the gap short · 40 min
07 Data roles, handling, the data life cycle and compliance categories objective 3.3 part single
- Find every copy of one person's data, and who decides about it short · 45 min
08 High availability, site resilience and power objective 3.4 part single
- Measure a failover instead of assuming it short · 40 min
09 Backups, recovery testing, continuity and recovery metrics objective 3.4 part single
- Show that a snapshot is not a backup applied · 70 min
- Run a recovery exercise against a stated RTO and RPO capstone · 140 min
- Restore from a backup and time it short · 45 min

4. Security Operations 27% of the exam

01 Secure baselines, hardening, segmentation and access control objective 4.1 part single
- Make the baseline reapply itself applied · 75 min
- Apply a published benchmark and count what it changed short · 45 min
02 Mobile device management, application security, sandboxing and deception objective 4.1 part single
- Find the key in the history, then stop the next one at commit short · 45 min
03 Firewalls, intrusion detection and prevention, and choosing the network control objective 4.1 part single
- Make a deny rule fail by its position, then rate-limit a flood short · 45 min
04 Content filtering, DLP, NAC, EDR/XDR and email security objective 4.1 part single
- Publish SPF, DKIM and DMARC and check they agree short · 45 min
05 Asset management, from purchase order to certificate of destruction objective 4.2 part single
- Prove data is gone, three ways, with evidence applied · 80 min
- Find the assets your inventory does not know about short · 40 min
06 Vulnerability management, end to end objective 4.3 part single
- Prioritise a finding list that the severity column gets wrong applied · 80 min
- Show a false negative appearing between two scans short · 40 min
07 Alerting and monitoring, and the tools that do it objective 4.4 part single
- Forward the logs off the host before you need them applied · 75 min
- Write an alert, then tune it until it is worth reading short · 45 min
08 Provisioning identity, account types, single sign-on and federation objective 4.5 part single
- Build the leaver checklist by finding what you would have missed short · 50 min
09 Multifactor authentication, passwords and passkeys objective 4.5 part single
- Remove standing privilege and measure what is left applied · 80 min
- Screen passwords the way current guidance says to short · 40 min
10 Automation and orchestration, AI assistance, and when not to automate objective 4.6 part single
- Build a guard rail, then try to get a bad change past it applied · 75 min
- Automate the enrichment and leave the decision alone short · 40 min
11 The incident response process, and the preparation that decides the outcome objective 4.7 part single
- Run a tabletop and find the decision nobody owns short · 45 min
12 Threat hunting, digital forensics, root cause and the post-incident report objective 4.7 part single
- Hunt from a hypothesis and leave a detection behind applied · 80 min
- Capture memory before you lose it short · 45 min
13 Reading logs, images and other sources to support an investigation objective 4.8 part single
- Discover what you cannot answer, and fix the collection applied · 80 min
- Investigate an incident you staged a week ago capstone · 150 min
- Build a timeline from five sources and write the finding short · 50 min

5. Security Program Management and Oversight 14% of the exam

01 Policies, standards, procedures, plans and guidelines, and the difference between them objective 5.1 part single
- Adopt a benchmark as your baseline standard and prove the estate meets it applied · 80 min
- Split one requirement across the document levels short · 35 min
02 Risk management: identification, analysis, the register and treatment objective 5.2 part single
- Build a risk register somebody can actually act on applied · 75 min
- Do the arithmetic until the units stop catching you out short · 30 min
03 Third-party risk: selecting a vendor, the agreement, and monitoring after the ink dries objective 5.3 part single
- Build the vendor registry and find the one nobody owns applied · 75 min
- Match the agreement and the request to the relationship short · 35 min
04 Compliance, privacy, and the cost of getting it wrong objective 5.4 part single
- Answer an access request and an erasure request from real data applied · 80 min
- Put a legal hold on a deletion job and prove it held short · 35 min
05 Audits, assessments, gap analysis and where penetration testing fits objective 5.5 part single
- Audit your own estate and track the findings to closure applied · 80 min
- Assess the whole programme and report it to a board capstone · 150 min
- Write rules of engagement somebody could work to short · 35 min
06 Security awareness that changes behaviour rather than completion rates objective 5.6 part single
- Design an awareness programme and a phishing campaign you could defend to HR applied · 80 min

Supplementary not examined — background reading

01 A lab you can break safely, and why your laptop is not it part single
- Prove the isolation before you trust it short · 35 min

18 of the 47 lessons have an audio episode so far, and each plays in the lesson itself — there is nothing extra to sign up for.

The episodes are also a podcast: listen on Spotify.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.