RANGER CompTIA Security+ (SY0-701) · chapter 27 of 27
V8 preview: what else is new in SY0-801
In this chapter Objectives 2.1 V8, 2.3 V8, 2.5 V8, 4.1 V8, 4.5 V8, 5.3 V8
Objective 2.1 V8
V8 preview: describing threats and flaws
Objective 2.1: threat and vulnerability characteristics
V8 opens domain 2 with a new objective about describing threats and vulnerabilities, not just naming them. Threats come from threat feeds and intelligence sources (OSINT, ISACs, government and commercial feeds), are ranked by likelihood and impact, and follow an intelligence life cycle. Vulnerabilities get a CVE ID, a CVSS score and a type (CWE), then get prioritized in context.
- CVSS ratings: Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.
- Intel life cycle: requirements, collection, processing, analysis, dissemination, feedback.
- Priority = base score + exposure + asset value + signs of active exploitation.
Exam tip V8 preview tip: a high CVSS score on an isolated lab box can rank below a lower score on an exposed, actively exploited system.
Objective 2.3 V8
V8 preview: new vectors, surfaces and indicators
Vectors and attack surfaces added in V8
V8 sorts vectors by where they arrive and adds new examples:
- Message-based: email, SMS, RCS, instant messaging and collaboration tools.
- Image-based: QR codes, embedded content and fake CAPTCHA pages.
- Browser-based: extensions, JavaScript, password managers, cookies and session tokens.
- Endpoint-based: trusted devices, built-in tools and living-off-the-land tools.
- Supply chain: third parties, MSPs, logistics providers and SaaS providers; plus OT, IoT and physical passes.
- New surfaces (2.4): hardcoded secrets, unsafe exception handling, stale credentials, rogue devices, LLMs, identity providers, public repositories and public object storage.
New attacks and indicators of compromise
Objective 2.5 adds quishing (QR phishing), deepfake impersonation, skimming and forced entry, forgery attacks such as SSRF, and credential attacks like user enumeration and MFA bypass (push fatigue, stolen session tokens). New indicators include log manipulation (a cleared audit log), plaintext strings in malware, file system artifacts and altered timestamps.
Exam tip V8 preview tip: a login page that says "unknown user" for some names and "wrong password" for others enables user enumeration.
Check yourself 1At 2 a.m. a user gets 25 sign-in approval requests in a row from his authenticator app, taps Approve to make them stop, and his account signs in from abroad. What happened?
- Credential replay
- MFA bypass through push fatigue
- User enumeration
- Log manipulation
Show the answer
Answer: B. MFA bypass through push fatigue
Flooding a user with push prompts until one is approved is an MFA bypass (push fatigue). Number matching and passkeys defeat it.
Objective 4.1 V8
V8 preview: new tools and identity ideas
Architecture and operations tools
Names to recognize on SY0-801:
- SSE (Security Service Edge): cloud web gateway, CASB and ZTNA; SASE without the SD-WAN part.
- gMSA: a Windows service account whose password Active Directory rotates automatically.
- Out-of-band management: a separate path to manage devices when the main network is down or hostile.
- CSPM: continuous checks of cloud settings; IPAM: tracks IP space and finds hosts scans miss.
- Canary account and honeynet: decoys; any use is a high-confidence alert.
- Rate limiting, captive portals, endpoint posture checks and secrets scanning of repositories.
- BIMI: shows a brand logo in inboxes, only for domains enforcing DMARC.
Identity, automation and AI in operations
Identity (4.5) adds identity proofing before accounts are issued, emergency access (break-glass) accounts, backup codes, passkeys (phishing-resistant FIDO2 keys), time-based access and compromised credential monitoring. Automation (4.6) adds AI: agentic AI acts on its own, a chatbot answers questions, predictive analysis forecasts, and AI-augmented baselines learn what normal looks like.
Exam tip V8 preview tip: the more an AI agent can do on its own, the more it needs least privilege, guardrails and human approval.
Objective 5.3 V8
V8 preview: vendors, privacy and audits
Program management additions
Domain 5 adds detail you can memorize as pairs:
- RFI (what can vendors do?), RFP (detailed proposals), RFQ (prices for a defined order), EOI (who is interested?).
- SLA is the agreement; an SLO is one measurable target inside it. A vendor registry tracks every third party.
- Privacy (5.4): opt-in vs. opt-out, data correction, processing restrictions and prevention, AML/CTF and anti-bribery training.
- Audits (5.5): MITRE ATT&CK (tactics and techniques), Cyber Kill Chain (seven phases), Diamond Model (adversary, capability, infrastructure, victim), audit charter, sampling and assertions.
- Awareness (5.6): an LMS to deliver and track training, targeted and corrective training, personnel behavior risk scoring.
Check yourself 2Mr. Barkley has a finished list of detailed requirements for a managed SOC service and wants each vendor to explain how it would meet them, with its approach, schedule and price. Which document should Kibble & Co. send?
- Request for information (RFI)
- Expression of interest (EOI)
- Request for proposal (RFP)
- Statement of work (SOW)
Show the answer
Answer: C. Request for proposal (RFP)
An RFP asks vendors for detailed proposals against defined requirements. An RFI explores options before requirements exist, an EOI only asks who is interested, an RFQ asks for prices on a defined item, and a SOW defines work after selection.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.