If you are studying for CompTIA Security+ right now, you have probably seen the question in every forum: should I sit the current exam, SY0-701, or wait for the new one, SY0-801?

The short answer: if you have already been studying for SY0-701 and can sit the exam before June 2027, take SY0-701. If you are starting from zero today and your exam is many months away, SY0-801 is the better long-term choice. The rest of this article explains why, with the dates and numbers taken from CompTIA's own pages.

Practising for SY0-701 now? DailyDebian has a free set of Security+ SY0-701 practice questions with answers and explanations, and the full SY0-701 practice question pack (611 questions with answers) when you want more.

The key dates

According to CompTIA's exam pages, checked on 9 November 2026:

• SY0-701 (Security+ V7) launched on 7 November 2023.
• SY0-801 (Security+ V8) launches on 17 November 2026.
• SY0-701 retires on 11 June 2027 in English. The Japanese, Portuguese, Spanish and Thai versions retire later, on 13 August 2027.

That gives you an overlap of roughly seven months in which you can choose either exam. After 11 June 2027, English candidates can only book SY0-801.

What stays the same

The exam format does not change between the two versions. Both pages list:

• A maximum of 90 questions
• A mix of multiple-choice and performance-based questions (PBQs)
• 90 minutes
• A passing score of 750 on a scale of 100 to 900

So the experience on test day will feel very similar. Your time management plan, your approach to PBQs (many people flag them and come back at the end) and your target score all carry over.

The certification you earn is also the same: CompTIA Security+. Nobody hiring for a role that asks for Security+ will be checking which exam code you passed. What matters more is that the certification is current, and CompTIA certifications run on a three-year renewal cycle (Security+ needs 50 continuing education units, or CEUs, in that cycle). A pass on SY0-701 next spring is just as valid for the next three years as a pass on SY0-801.

What changes: the domains

The five domain names are nearly the same, but the weights move. Here they are from CompTIA's pages, SY0-701 first, then SY0-801:

• General security concepts: 12% on SY0-701, 16% on SY0-801
• Threats, vulnerabilities and mitigations (V8 calls it "Threats, vulnerabilities and attacks"): 22% to 24%
• Security architecture: 18% to 19%
• Security operations: 28% to 27%
• Security program management and oversight: 20% to 14%

Three things stand out:

1. Program management and oversight drops from 20% to 14%. Governance, risk and compliance still matter, but they take up less of the exam.
2. General concepts and threats both grow. Together they move from 34% to 40% of the exam.
3. Security operations stays the biggest domain at 27 to 28%. If you are strong in operations today, that strength carries straight over.

CompTIA's V8 page also lists topics such as AI-related risks, Zero Trust principles and AI-assisted workflows. The page does not mark which items are new compared with V7, so treat any "everything that changed" list you see online with care until you have read the official exam objectives yourself.

How to decide

Take SY0-701 if:

• You have already studied a good part of the SY0-701 material. Switching now means re-mapping your notes to new objectives and new weights for very little gain.
• You can book your exam before 11 June 2027. That is a comfortable window for most people who are mid-way through their studies.
• You want the widest choice of study material. SY0-701 has been out for three years. Courses, books, labs and practice tests are mature and have been corrected many times. On launch day, SY0-801 material will be thin and some of it will be rushed.
• You need the certification soon for a job offer, a contract requirement or a promotion.

Wait for SY0-801 if:

• You are starting from scratch and realistically will not sit the exam for several months.
• Your planned date is close to or after June 2027. Studying for an exam that retires a few weeks after your test date leaves no room for a resit.
• You want your study to line up with the newest objectives, for example because your employer's training budget or course provider has already moved to V8.

The one situation to avoid

The worst outcome is studying SY0-701 slowly, then finding you need a retake after 11 June 2027 and having to switch to SY0-801 with no plan. If you choose SY0-701, book the exam early, ideally with enough room before the retirement date for a second attempt if you need one.

A simple study plan for SY0-701 before it retires

If you are going with SY0-701, here is a plan that fits most people with some IT background:

1. Download the official SY0-701 exam objectives from CompTIA and use them as your checklist. Mark each objective red, amber or green.
2. Weight your time by the domains. Security operations (28%) and threats (22%) are half of the exam, so they deserve about half of your hours.
3. Practise with timed question sets early. 90 questions in 90 minutes is tight once PBQs eat into your time. Do short timed sets of 20 to 30 questions, then full-length sets in the final two weeks.
4. Read every explanation, including for questions you got right. Getting a question right for the wrong reason is how people fall short of 750.
5. Book the exam once you score well and consistently on new questions, not on questions you have seen before.

A good place to start step 3 is the free DailyDebian SY0-701 practice questions. Each one comes with the correct answer and an explanation. When you want a full bank to work through by domain, the DailyDebian Security+ SY0-701 pack has 611 questions with answers and explanations.

Frequently asked questions

When does Security+ SY0-801 come out? CompTIA lists the launch date for Security+ V8 (SY0-801) as 17 November 2026.

When does SY0-701 retire? 11 June 2027 for the English exam, and 13 August 2027 for Japanese, Portuguese, Spanish and Thai.

Is SY0-801 harder than SY0-701? CompTIA does not publish a difficulty comparison. The format, length and passing score are the same. The difference is in the weights and the topics.

If I pass SY0-701, do I need to take SY0-801 later? No. You hold the same Security+ certification. You keep it current through CompTIA's three-year renewal cycle, not by retaking each new version.

Sources

• CompTIA, Security+ certification overview (V7 and V8): https://www.comptia.org/en-us/certifications/security/
• CompTIA, Security+ V7 (SY0-701) exam details, domains and retirement dates: https://www.comptia.org/en-us/certifications/security/v7/
• CompTIA, Security+ V8 (SY0-801) exam details and domains: https://www.comptia.org/en-us/certifications/security/v8/
• CompTIA, Earn continuing education units (three-year renewal cycle, 50 CEUs for Security+): https://www.comptia.org/en-za/resources/ce/learn/earn-continuing-education-units-ceus/

DailyDebian makes practice questions and free study tools for IT certification exams.

Most people budget for one number: the exam fee. That number is real, but it is rarely the whole bill. A retake can cost the same again. Some certifications charge every year just to stay active. A few vendors quote a different price for members. If you plan a certification path without these, the total can surprise you.

The figures below come from each vendor's own pricing page, read on 8 November 2026. They are US list prices in US dollars for a first attempt, before tax. Vendors charge different amounts in some countries, so check the vendor page before you book.

The headline exam fees

Here is a quick sample across the big vendors:

Two things stand out. First, A+ is two exams, so the real entry price is $548, not $274. Second, the spread is huge. A cloud fundamentals exam costs about $100, while a GIAC exam costs close to $1,000.

Retakes: the cost most people forget

Failing once is common, and most vendors charge the full fee again.

• CompTIA charges the full exam price for each attempt. You can buy a voucher bundled with a retake instead. For Security+ that bundle is $579, against $439 for the voucher alone. If you think there is a real chance you will need a second try, the bundle costs less than two vouchers.
• Microsoft charges again for each attempt. After a first fail you wait 24 hours. After later fails you wait 14 days between attempts.
• Cisco gives no retake fee on the page, but you must wait 5 days before trying again.
• ISC2 charges the full fee for each attempt unless you bought its retake protection. Waits grow to 30, 60 and then 90 days.
• ISACA charges the full registration fee each attempt, with waits of 30 and 90 days.
• GIAC lists a retake at $899 for GSEC, almost the price of the first attempt.

Waiting periods matter as much as money. A 90-day wait can push a job start or a promotion back by a full quarter.

Renewal: the yearly bill

Passing is not the end. Many certifications must be renewed, and the price models differ a lot:

• CompTIA: most core certifications carry a continuing education fee of $150 every 3 years if you renew by uploading CEUs ($75 for A+, Data+ and SecAI+). Tech+ has no CE fee; you renew it by passing the latest exam.
• ISC2: an annual maintenance fee of $135. It is one fee however many ISC2 certifications you hold, so CISSP plus CCSP still costs $135 a year.
• ISACA: an annual maintenance fee of $45 for members and $85 for non-members.
• Cisco: certifications are valid for 3 years. You recertify by exam or by continuing education credits.
• AWS: valid for 3 years. You recertify by taking the latest version of the exam.
• Microsoft: associate, expert and specialty certifications renew through a free online assessment. Fundamentals certifications such as AZ-900 do not expire.
• Google Cloud: for Associate Cloud Engineer, the renewal exam is $75.
• GIAC: GSEC renewal is $499.

Over three years, an ISC2 certification adds $405 in maintenance fees. An AWS certification adds the price of the next exam. A Microsoft associate certification adds nothing but your time.

Small print that changes the total

• Member prices. ISACA and PMI quote lower prices to members. PMP is $324 for members against $575 for everyone else. Membership costs money too, so do the sum before you join just for the discount.
• Delivery method. EC-Council lists the CEH v13 remote-proctored voucher at $950 and a Pearson VUE voucher at $1,199. The index also lists a $100 eligibility application fee, so check whether it applies to you.
• Bundles. PMI sells CPMAI as a prep course and exam bundle, not as an exam-only fee. Compare it with care.

How to budget a certification

A simple rule: plan for the exam fee, plus one retake, plus three years of renewal. For Security+ that is $439 + $439 + $150 = $1,028 in the worst case. Buying the retake bundle brings it to $579 + $150 = $729. For CISSP it is $749 + $749 + $405 = $1,903. That is not a reason to avoid either one. It is a reason to prepare well enough to pass the first time.

How these prices were checked

Every price comes from the vendor's own page. No third-party price lists were used. If a vendor does not publish a figure, the index says "Not published by vendor" instead of guessing. Each row shows the date it was last checked. The sources are re-read every quarter, and the next full update is due on 1 January 2027.

The full table covers 137 exams from CompTIA, ISC2, ISACA, Cisco, AWS, Microsoft, Google Cloud, GIAC, EC-Council and PMI. You can filter it by vendor, and every row has a source link: IT Certification Price Index 2026.

If you also want questions, time limits and pass marks for each exam, see the IT certification exam facts table.

Subnetting is on both CompTIA Network+ and Cisco CCNA. It also turns up in every network job you will ever have. Most people find it hard because they learn it as binary arithmetic and then try to do binary in their head on a timer. There is a faster way. You only need one number, the block size, and four short steps.

The one table worth memorising

Every step down in prefix length doubles the number of addresses. If you know that a /24 has 256 addresses, you can build the rest:

"Usable hosts" is the total number of addresses minus two. The first address in a subnet is the network address and the last is the broadcast address, so neither can go to a host. The formula is 2 to the power of h, minus 2, where h is the number of host bits.

Two exceptions are worth knowing. A /32 is one single host address. A /31 gives 2 usable addresses, but only on a point-to-point link.

The block size, or "magic number"

The block size is 256 minus the mask value in the octet that is not 0 or 255. Subnets always start on a multiple of the block size.

Once you have the block size, you never need to convert anything to binary.

The four steps

Take 192.168.10.77/26 as the example.

1. Find the mask. A /26 is 255.255.255.192. The fourth octet is the one that is neither 0 nor 255, so that is where the work happens.

2. Find the block size. 256 minus 192 is 64. Subnets in that octet start at .0, .64, .128 and .192.

3. Find the network address. Take the highest multiple of 64 that is not above 77. That is 64, so the network is 192.168.10.64.

4. Find the broadcast and the host range. The next subnet starts at .128, so the broadcast is one less: 192.168.10.127. The usable hosts are .65 to .126, which is 62 hosts.

That is the whole method. With practice it takes well under a minute, and it works the same in any octet.

Going the other way: "how many hosts do I need?"

Exams love this question. You get a number of hosts and must choose the smallest subnet that fits. Always round up:

• Up to 14 hosts: /28
• Up to 30 hosts: /27
• Up to 62 hosts: /26
• Up to 126 hosts: /25

So a subnet for 50 hosts cannot be a /27, because that only gives 30. The answer is /26, with 62.

Ranges you should recognise on sight

• 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private (RFC 1918). The 172 range runs from 172.16.0.0 to 172.31.255.255. That makes 172.32.0.1 a public address, which is a favourite trick question.
• 127.0.0.0/8 is loopback. 127.0.0.1 is the local machine.
• 169.254.0.0/16 is APIPA, or link-local. If a device has one of these, it failed to get a DHCP address. It does not mean the network is fine.
• 100.64.0.0/10 is the shared space used for carrier-grade NAT.
• 224.0.0.0/4 is multicast, the old class D.

Common exam traps

• The network and broadcast addresses cannot be assigned to a host.
• A wildcard mask, used in access lists and OSPF, is 255.255.255.255 minus the subnet mask. For a /26 that gives 0.0.0.63.
• Classful addressing is no longer used for routing, but exams still ask about classes. Class A starts at 1 to 126, B at 128 to 191 and C at 192 to 223.
• IPv6 has no broadcast at all. It uses multicast (ff00::/8) instead, and a normal LAN subnet is a /64.

How to make it stick

Reading the method once is not enough. What works is doing 10 to 20 random questions a day for a week, until the block sizes come without thinking. Then check yourself against a calculator, so you know your answers are right and you are not drilling a mistake.

Some free tools for that:

• Subnetting practice: unlimited random questions at three levels, with worked answers.
• Subnet calculator: network, broadcast, host range, mask, wildcard and binary for any IPv4 address.
• CIDR calculator and VLSM planner: for splitting one block into several subnets of different sizes.
• Wildcard mask calculator: for Cisco access lists.

The full cheat sheet, with every prefix from /32 to /8, an IPv6 quick reference and a printable one-page PDF, is here: Subnetting Cheat Sheet.