PasswellLog inStart free
CompTIA

Security+ prep

The entry-level security certification for administrators and analysts: proves you can recognise threats, secure hybrid environments, respond to incidents and work within governance and risk rules.

Start freeUnlock everything · $29

The real exam

Exam codeSY0-801 (V8), launches 17 Nov 2026
QuestionsUp to 90, multiple choice and performance-based
Time90 minutes
Pass mark750 on a 100 to 900 scale
Fee$439 (list price)
Recommended experienceAbout two years of hands-on security administration
Previous versionSY0-701 remains bookable until 11 Jun 2027
NavigationFlag questions, go back and use the review screen

What you get

40
lessons
6
hours of reading
170
original questions
1
full mock exams

Mocks follow the real rules: 90 questions in 90 minutes, flag and review.

Syllabus

General security concepts16%

Security principles, control categories and types, change management, cryptography and PKI.

Threats, vulnerabilities and attacks24%

Threat actors, vectors, vulnerability types, indicators of malicious activity and AI-related threats.

Security architecture19%

Cloud, on-premises and OT architecture, secure infrastructure, data protection, resilience and recovery.

Security operations27%

Hardening and defensive tools, vulnerability management, monitoring, identity and access, automation, incident response and investigations.

Security program management and oversight14%

Policies and standards, risk management, third-party risk, compliance and privacy, audits and awareness.

Course outline

  1. Security foundations · 3 lessons
  2. Cryptography and PKI · 4 lessons
  3. The threat landscape · 4 lessons
  4. Vulnerabilities, attacks and indicators · 6 lessons
  5. AI threats and risks · 2 lessons
  6. Security architecture · 5 lessons
  7. Security operations · 10 lessons
  8. Program management and oversight · 6 lessons

Try a question

A company is moving to a Zero Trust model. A manager asks why staff on the office LAN must still authenticate to each internal application. Which response BEST explains the principle?
A. Authentication is only needed because the LAN is not encrypted
B. Internal users are considered more dangerous than external users
C. Network location alone is never treated as proof of trust, so every request is verified
D. Zero Trust removes the need for perimeter firewalls entirely
Show answer
Answer: C. The core Zero Trust idea is "never trust, always verify". Being inside the perimeter grants nothing. Each request is evaluated using identity, device health and policy before access is granted.
A purchasing manager approves large orders through a web portal and later claims she never approved a disputed order. Which control would BEST prevent her from credibly denying the approval in the future?
A. Storing approvals in a database with daily backups
B. Having her digitally sign each approval with her own private key
C. Encrypting the order database at rest
D. Sending her an automatic email summary listing each approval she made
Show answer
Answer: B. Non-repudiation means a person cannot plausibly deny an action. Digital signatures provide it because only the holder of the private key could have produced the signature, and anyone with the public key can verify it.

Passwell is an independent study tool and is not affiliated with CompTIA. CompTIA and Security+ are trademarks of CompTIA, Inc. All questions and lessons are original practice material written to the published exam objectives. Facts checked 2026-11-14.