SY0-801
CompTIA Security+ Complete Review Guide 2026–2027
Every exam topic in a 28-page Arabic PDF, ordered from the heaviest unit to the lightest. The first three chapters alone cover about 70% of the exam questions.
- 28Pages
- 79Key points
- 30Common mistakes
- 40Flashcards
Guide map
Each chapter is one exam unit, ordered by its weight in the real exam.
| Chapter | Unit | Weight | Exam questions | Key points |
|---|---|---|---|---|
| 1 | Security Operations | 27% | 24 | 16 |
| 2 | Threats, Vulnerabilities, and Attacks | 24% | 22 | 15 |
| 3 | Security Architecture | 19% | 17 | 16 |
| 4 | General Security Concepts | 16% | 14 | 17 |
| 5 | Security Program Management and Oversight | 14% | 13 | 15 |
Chapter 1 in full: Security Operations
27% of the exam, about 24 questions. These are its key points, as in the guide.
- Hardening: remove unneeded services, change defaults, apply patches, enable host firewalls and encrypt storage; use baselines.
- Endpoint protection: EDR and XDR detect behavior, application allow lists block unknown software, and mobile device management controls phones.
- Asset management: maintain an inventory, assign owners, track the lifecycle and sanitize or destroy media at disposal (shredding, degaussing, overwrite).
The rest of chapter 1, on this page
- Vulnerability management: identify with scans, analyze, prioritize with CVSS and exploitability, remediate, verify and report.
- Credentialed scans see more than non-credentialed scans; false positives need validation; patching may need compensating controls where not possible.
- Penetration testing and bug bounty programs find weaknesses by simulating attackers; rules of engagement define scope.
- SIEM aggregates and correlates logs and raises alerts; tuning reduces false positives; baselines help detect anomalies.
- Monitoring tools: NetFlow, packet capture, SNMP, agents, DLP and vulnerability scanners.
- Identity and access: MFA combines something you know, have or are; single sign-on reduces password sprawl; federation uses SAML or OIDC.
- Access models: role-based, attribute-based, mandatory and discretionary; privileged access management vaults and time-limits admin credentials.
- Provisioning and deprovisioning: grant at hire, change with role, remove immediately at departure; review access periodically.
- Automation and orchestration (SOAR, scripts, infrastructure as code) speed response and cut human error but need testing and oversight.
- Incident response phases: preparation, detection and analysis, containment, eradication, recovery and lessons learned.
- Contain before eradicating; preserve evidence with chain of custody and capture volatile data first (memory before disk).
- Order of volatility: CPU registers and cache, memory, temporary files, disk, remote logs and backups.
- Investigation sources: firewall, application, endpoint and authentication logs, packet captures, metadata and vulnerability scan data.
Common mistakes in this chapter
- Detection is not containment; do not skip containment.
- Imaging a disk is not the first step if volatile memory would be lost.
- A false positive is a benign event flagged as bad; a false negative is a missed attack.
- CVSS score is not the only factor; asset criticality and exposure matter.
- SSO is not MFA.
- Automation does not remove the need for human review of high-impact actions.
The other chapters are in the full guide
One purchase · lifetime access · review guide included
7-day review plan
The chapters are spread over 6 days by weight so each day carries a similar load. Day 7 is a full exam.
Day 1 · 27% of the exam
Chapter 1: Security Operations
Day 2 · 24% of the exam
Chapter 2: Threats, Vulnerabilities, and Attacks
Day 3 · 19% of the exam
Chapter 3: Security Architecture
Day 4 · 16% of the exam
Chapter 4: General Security Concepts
Day 5 · 14% of the exam
Chapter 5: Security Program Management and Oversight
Day 6
Full mock exam: 90 questions in 90 minutes, then review the common mistakes in the units where you lost marks.
Before you read: see your score today
10 free questions from the main units, no sign-up. Then you know which chapter to start with.
Try 10 free questions and see your levelA look at each chapter
The first three key points of each chapter, as they appear in the guide (in Arabic in the PDF).
Chapter 1: Security Operations
- Hardening
- Endpoint protection
- Asset management
Chapter 2: Threats, Vulnerabilities, and Attacks
- Threat actors
- Threat vectors
- Phishing uses email, smishing uses SMS, vishing uses voice; spear phishing targets individuals and…
Chapter 3: Security Architecture
- In cloud models the provider secures more as you go from IaaS to PaaS…
- Architecture models
- Segmentation limits lateral movement
Chapter 4: General Security Concepts
- Control categories
- Control types
- CIA triad
Chapter 5: Security Program Management and Oversight
- Policies state intent, standards give mandatory requirements, procedures give steps and guidelines advise; common…
- Governance structures include boards, committees and data roles: owner, controller, processor, custodian and steward.
- Risk process
The full guide comes with lifetime access
The full guide (28 pages) is included with lifetime access to this exam, together with every question and full mock exam. Chapter 1 is free for everyone.
Questions about the guide
Is the guide free?
Chapter 1 is free to read on the guide page. The full guide comes with lifetime access to this exam; 7-day access does not include it.
Is it up to date for 2026–2027?
Yes. Unit weights and exam facts follow what the exam body last published, and the last check date is printed in the guide. If the standards change we update the file and buyers download the new version.
Does the guide have questions?
No. The guide covers key points and common mistakes; scoring, weak-area practice and full mock exams are on the site.
Can I read it on my phone?
Yes. A5 pages in a single column, with chapters linked from the contents.
- Pages
- 28
- Edition
- 1448 AH · 2026–2027
- Language
- Arabic
- Last updated
Buy this exam
Pick the access that lasts until your test date.
Included
- Timed supplementary practice sessions: 90 questions in 90 minutes
- 519 questions, every option explained with its source
- Practice that starts with your weakest units, plus a review of your mistakes
- Complete Review Guide 2026–2027 (PDF), with lifetime access only
Continue with your Google account and you go straight to the payment page.
You pay on the Waffo Pancake checkout page (in English). The amount is in US dollars and your bank converts it to riyals. One payment with no automatic renewal, by Visa, Mastercard (a mada card with either logo works too), Apple Pay or Google Pay. Your statement shows "WAFFO". Purchases are not refundable.