CompTIA Security+ SY0-801 (V8) Exam Objectives

Control categories and types, defense in depth, change management (with its documentation and version control), and the crypto toolkit: PKI, certificates, encryption, hashing, salting and digital signatures.

1. 1.1Explain security concepts and controls.
2. 1.2Given a scenario, demonstrate the impact of change management processes on security.
3. 1.3Explain the importance of using appropriate cryptographic solutions.

Who attacks and why, the vectors they use (messages, browsers, remote access, supply chains, OT), the weaknesses they look for, and the indicators that an attack is under way. Objective 2.6 is new and covers AI usage.

1. 2.1Explain characteristics of threats and vulnerabilities.
2. 2.2Describe common threat actors and motivations.
3. 2.3Describe threat vectors and sources.
4. 2.4Explain types of vulnerabilities and attack surfaces.
5. 2.5Given a scenario, analyze indicators of malicious activity.
6. 2.6Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage.

Architecture models and their trade-offs, Zero Trust and secure access, protecting data in every state and classification, and resilience: backups, redundancy, disaster recovery and recovery metrics.

1. 3.1Compare and contrast security implications of different architecture models.
2. 3.2Given a scenario, manage the security architecture to best protect the infrastructure.
3. 3.3Summarize concepts and strategies used to protect data.
4. 3.4Explain the importance of resilience and recovery in security architecture.

The day-to-day work: mitigating controls and hardening, asset management, vulnerability management, alerting and monitoring, identity and access, automation (AI included), incident response, and investigations built on logs.

1. 4.1Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment.
2. 4.2Explain the security implications of proper hardware, software, and data asset management.
3. 4.3Given a scenario, perform tasks associated with vulnerability management.
4. 4.4Explain security alerting and monitoring concepts and tools.
5. 4.5Given a scenario, apply concepts related to identity and access management.
6. 4.6Given a scenario, apply automation and orchestration solutions to secure operations.
7. 4.7Summarize concepts associated with incident response activities.
8. 4.8Given a scenario, use data, artifacts and sources to support a security investigation.

Governance documents, risk management from identification to treatment, third-party risk, compliance, audits and assessments (penetration testing included), and security awareness training.

1. 5.1Explain the importance of governance, risk, and compliance artifacts.
2. 5.2Explain the impact of risk management processes on the security of the organization.
3. 5.3Explain the assessment and management processes associated with third-party risk.
4. 5.4Summarize elements of effective security compliance.
5. 5.5Explain concepts associated with audit and assessment activities.
6. 5.6Given a scenario, apply security awareness concepts to improve organizational security.