CompTIA Security+ SY0-801 study board
CompTIA Security+ SY0-801: every exam objective on a hand-drawn mind map, 1,689 flashcards and 1,261 practice questions. Free preview, $29.99 one-time.
Exam version: Follows CompTIA's Security+ SY0-801 (V8) exam objectives, version 2.0 dated 18 September 2026. CompTIA says the exam launches on or around 17 November 2026.
What you get
- 31 hand-drawn sheets: every exam objective on its own sheet, in reading order
- 1,689 flashcards written from the cards on the map, that come back just before you'd forget
- 1,261 original practice questions, each graded with the answer explained
- A Treemap of every card the flashcards and practice questions cover, painted by the score you have earned on it, so you can see what is left
- Bookmarks and sticky notes, saved to your account
- One payment of $29.99: no subscription, no expiry date
Who it is for
People studying for CompTIA Security+ SY0-801 on their own who learn best by seeing how topics connect, and who want one place to read the map, recall it with flashcards, prove it on practice questions and see their progress on a Treemap.
Who it is not for
It is not a hands-on lab, not a full video course and not a replacement for practising on real equipment or software.
Free preview: what is on the board
- Start here
- How to use this map
- Big idea: recall beats rereading
- One sheet per sitting
- Finding your way around
- Opening a card's full page
- Marks on the Security+ map
- Read the objective's verb first
- The exam at a glance
- Big idea: two codes overlap, you pick
- Which Security+ code should you book?
- Security+ version dates
- Where the SY0-801 marks are
- SY0-801 exam-day facts
- Performance-based questions
- SY0-701 to SY0-801 changes
- How to use this map
- General Security Concepts (16%)
- 1.1 Security concepts and controls
- Big idea: no single control is trusted alone
- Which control type is it?
- Layered defense and the CIA triad
- AAA: authenticate, authorize, account
- Zero Trust and least privilege
- Control categories (how it's done)
- Control types (what it does)
- Check yourself: concepts and controls
- 1.2 Change management and security
- Big idea: an unplanned change is an outage or a hole
- Back out or fail forward?
- Life of a change request
- Who decides and who owns it
- Planning a safe change
- When a change goes wrong
- Technical side effects
- Documentation and version control
- Check yourself: change management
- 1.3.1-2 PKI and certificates
- Big idea: a certificate is a signed introduction
- Which certificate fits?
- Key pairs
- CAs and the chain of trust
- Issuing and revoking certificates
- Check yourself: PKI and certificates
- 1.3.3 Encryption choices
- 1.3.4-8 Signatures, hashes and key tools
- 1.1 Security concepts and controls
- Threats, Vulnerabilities, and Attacks (24%)
- 2.1 Threats and vulnerabilities
- 2.2 Threat actors and motivations
- 2.3 Threat vectors and sources
- 2.4 Vulnerabilities and attack surfaces
- 2.5 Indicators of malicious activity
- 2.6 Threats from AI usage
- Security Architecture (19%)
- 3.1 Architecture models
- 3.2 Securing the infrastructure
- 3.3 Protecting data
- 3.4 Resilience and recovery
- Security Operations (27%)
- 4.1 Mitigating controls for the environment
- 4.2 Hardware, software and data assets
- 4.3 Vulnerability management tasks
- 4.4 Security alerting and monitoring
- 4.5 Identity and access management
- 4.6 Automation, orchestration and AI
- 4.7 Incident response activities
- 4.8 Data and artifacts for investigations
- Security Program Management and Oversight (14%)
- 5.1 GRC documents: policy to runbook
- 5.2 Risk management processes
- 5.3 Third-party risk management
- 5.4 Effective security compliance
- 5.5 Audits and assessments
- 5.6 Security awareness in practice
Sample flashcard
When sorting a security control into its type (preventive, deterrent, directive, detective, corrective, compensating), which case should you check first, and why?
Whether it is a stand-in for a control you can't deploy, which makes it compensating. A compensating control can look like any of the other types, so rule it out first.
Sample practice question
At Pellworth Shipping, a clerk typed her password into a fake sign-in page. The attacker's login was refused because it lacked her push approval, and a week later a macro from the same crew was quarantined by the endpoint agent. Which design idea do these two outcomes show?
- A. Separation of duties
- B. Least privilege
- C. Defense in depth
- D. Non-repudiation
Answer: C. Two independent safeguards (MFA and endpoint protection) each stopped a stage the attacker needed, which is layered security. Separation of duties splits one sensitive task between people, and nothing here involved two approvers. Non-repudiation is about proving who performed an action, and least privilege limits how much an identity can do once it is in.
Questions
Do I download the CompTIA Security+ SY0-801 board?
No. Boards open on the website in your browser, on a computer or a phone, once you sign in. Your flashcard progress, bookmarks and test results are saved to your account.
How long do I keep access?
It is a one-time purchase with no subscription and no expiry date.
Can I try it before I buy?
Yes. Every board has a free preview: the introduction, the first three sheets of the first domain and ten sample questions, with no account needed.
What if the exam changes?
This board follows one exam version (SY0-801). Check that it matches the exam you are booking before you buy.
What is the refund policy?
You can ask for a refund within 7 days of buying, with no reason needed. Details are in the Refund Policy.
CompTIA Security+ SY0-801 · All study boards · About
Terms · Privacy · Refunds · Contact
BoardITGuy is not affiliated with or endorsed by ISC2, ISACA, Cisco, CompTIA or Amazon Web Services. Product names are trademarks of their owners and are used only to say which exam a board is for.