AI-assisted: written with an AI tool from CompTIA's own Security+ V8 page, then checked line by line against it. I run LearnSome.tech, which has a Security+ course; this post stands on its own.
CompTIA's Security+ V8, exam code SY0-801, has a launch date of 17 November 2026 on CompTIA's exam page. If you are deciding whether to sit it, here is what it is, from that page rather than from forum lore.
The format
As listed on CompTIA's V8 exam page:
- Questions: a maximum of 90, a mix of multiple-choice and performance-based questions (PBQs).
- Time: 90 minutes.
- Passing score: 750 on a scale of 100 to 900.
- Recommended experience: a security administrator with two years of hands-on experience. That's a recommendation, not an entry requirement.
- Lifetime: CompTIA estimates the version will retire about 3 years after launch.
PBQs are the part people underestimate. Instead of picking a letter, you classify, order or configure things in a small simulated environment. They take longer than a multiple-choice question, so plan your time around them rather than discovering them at minute 70.
The five domains
The weights, from CompTIA's published V8 objectives summary:
| Domain | Weight |
|---|---|
| Security Operations | 27% |
| Threats, Vulnerabilities, and Attacks | 24% |
| Security Architecture | 19% |
| General Security Concepts | 16% |
| Security Program Management and Oversight | 14% |
Two things stand out in V8. Security Operations is the largest domain: monitoring, identity and access, incident response, investigations. And the threats domain now has an objective on the security risks of AI systems: models, prompts, privacy and data exposure.
Read the qualifier word
Many Security+ questions offer several answers that are all good security. One word decides which one scores: BEST, FIRST, MOST, LEAST or NOT.
Try this one, in that style:
A user reports they approved an MFA prompt they did not start. What should you do FIRST?
A. Revoke the user's sessions and reset the password
B. Check the mail gateway for the phish
C. Send an awareness reminder to all staff
D. Disable MFA for the user
Every option except one is something a team might do at some point. The question only asks about the first move. Read the qualifier, then the options, and you'll stop losing marks to answers that are right but not first.
What a pass does and doesn't show
A pass shows you know core security practice across those five domains, and the PBQs show you can apply some of it in a simulation. It doesn't replace security work on real systems: nobody's first incident looks like an exam item.
Before you book
- Download CompTIA's full V8 objectives and mark each one you couldn't explain to a colleague. That list is your study plan.
- Practise PBQ-style tasks (ordering, matching, filling in tables), not just question banks.
- Do a timed run of 90 questions in 90 minutes at least once. A minute a question goes fast.
Are you sitting V8, or did you take V7 before the switch?
Top comments (0)