-
Security+ 801 Countdown, T-8: From Telemetry to Evidence With syslog, Memory Dumps, and Log Parsing
801 4.4 adds a protocols group with syslog and port mirroring; scenario objective 4.8 adds memory dumps, bit-level copies, IPFIX, and log-parsing techniques.
-
Security+ 801 Countdown, T-9: Incident Response Adds Negotiation, Notification, and the PIR
801 4.7 renames detection and analysis to identification and investigation, moves playbooks into preparation, and adds negotiation, notification, and the PIR.
-
Security+ 801 Countdown, T-10: Automation Goes Scenario and AI Joins the SOC Toolkit
801 4.6 asks you to apply automation, not explain it: desired state, guardrails, CI/CD, and process risks, plus agentic, chatbot, and predictive AI tools.
-
Security+ 801 Countdown, T-11: Authentication Modernized With Passkeys, Backup Codes, and Breach Checks
801 4.5 adds passkeys, OTPs, backup codes, and compromised-credential monitoring, drops the factor list, and still lists complexity and expiration rules.
-
Security+ 801 Countdown, T-12: Accounts Become First-Class With gMSA, Break-Glass, and Access Reviews
801 adds gMSAs and privilege creep to 3.2 and account types and access reviews to 4.5, moves JIT into access models, and drops ABAC and vaulting.
-
Security+ 801 Countdown, T-13: Vulnerability Management Becomes a Scenario Workflow
801 4.3 moves from explaining vulnerability management to performing it: identify, prioritize, remediate, verify, and report, as a scenario workflow.
-
Security+ 801 Countdown, T-14: Wireless Configuration Exits as NAC, Posture Checks, and WIPS Take Over
WPA3, RADIUS, site surveys, heat maps, COPE, and CYOD vanish from 801. In their place: captive portals, 802.1X, endpoint posture checks, and wireless IPS.
-
Security+ 801 Countdown, T-15: Deception Moves to 4.1 and Adds the Canary Account
Honeypots, honeynets, honeyfiles, and honeytokens move from Domain 1 to scenario objective 4.1, joined by the canary account: a decoy identity nobody uses.
-
Security+ 801 Countdown, T-16: Objective 4.1 Becomes the Mitigating-Controls Catalog
801 4.1 absorbs 701’s mitigations, enterprise capabilities and firewall types into one scenario objective, adds rate limiting and BIMI, and drops NGFW.
-
Security+ 801 Countdown, T-17: Resilience Rewritten Around Immutable Backups and Recovery Metrics
801 3.4 swaps onsite/offsite, snapshots, and journaling for retention, immutability, and restore testing, and pulls RTO, RPO, MTTR, and MTBF in from risk.