CompTIA Security+ (SY0-701) is the baseline security certification that HR filters, government roles and many first security jobs ask for. It is broad rather than deep: five domains covering concepts, threats, architecture, operations and governance, tested with multiple-choice and performance-based questions that reward knowing the vocabulary precisely and reasoning the way the exam does — best practice first, most secure option that meets the requirement, the control that addresses the stated risk. Engineers who have done the Cybersecurity track already know most of the substance; what they lack is CompTIA's terminology and the exam's way of framing choices. This guide maps the five domains to what you already know, lists the terms and acronyms that carry questions, explains performance-based items, and gives a five-week plan. Exam facts were checked on CompTIA's site in September 2026; confirm before booking.
- Describe the SY0-701 format, scoring, question types and retirement timeline
- Map the five domains to concepts from the Cybersecurity track and identify what is new
- Recognise the vocabulary and acronyms the exam uses and answer in its framing
- Handle performance-based questions efficiently
- Follow a five-week plan that alternates objective study, labs and timed questions
The exam at a glance
SY0-701 launched in November 2023 and is scheduled to retire on June 11, 2027 for English (later for other languages), so the current version remains valid for several test dates; a successor will be announced with an overlap period. The exam has a maximum of 90 questions in 90 minutes, mixing multiple-choice with performance-based questions (PBQs) that simulate a task: ordering steps, configuring a firewall rule set, matching attacks to controls. Scoring is scaled from 100 to 900 with 750 to pass. Certification is valid for three years and renews through continuing education or a newer exam. There is no formal prerequisite; CompTIA recommends Network+ and two years of security-adjacent experience.
| Domain | Weight | What it covers |
|---|---|---|
| 1. General security concepts | 12% | CIA triad, controls by type and function, zero trust, physical security, deception, change management, cryptography basics |
| 2. Threats, vulnerabilities and mitigations | 22% | Threat actors and motivations, attack vectors and surfaces, social engineering, malware, application and network attacks, indicators, mitigation techniques |
| 3. Security architecture | 18% | Cloud, on-premises and hybrid models, network appliances and segmentation, secure protocols, data protection, resilience and recovery |
| 4. Security operations | 28% | Hardening, asset and vulnerability management, monitoring, identity and access, automation, incident response, digital forensics, data sources |
| 5. Security program management and oversight | 20% | Governance, risk management, third-party risk, compliance, audits and assessments, awareness |
Domain 4 is the largest and the most practical; domains 1 and 5 are where engineers lose points to unfamiliar vocabulary. Study the official exam objectives document line by line — every bullet is fair game and the wording in questions mirrors it.
Domains 1 and 2: concepts and threats
General concepts is definitions and categories. Control categories (technical, managerial, operational, physical) and types (preventive, deterrent, detective, corrective, compensating, directive) appear in questions that describe a control and ask which type it is: a camera is detective (and deterrent), a backup is corrective, a guard is physical and preventive. Know the CIA triad plus non-repudiation, AAA, zero trust in CompTIA's terms (control plane with policy engine and policy administrator, data plane with policy enforcement points, adaptive identity, implicit trust zones), physical security (bollards, mantraps now called access control vestibules, sensors), deception (honeypots, honeytokens), change management as a security process (approval, impact analysis, backout plan, maintenance window, version control), and cryptography vocabulary: symmetric versus asymmetric, key exchange, hashing, salting, digital signatures, certificates and PKI (CA, CRL, OCSP, CSR, wildcard, SAN), key escrow, TPM, HSM, and blockchain and steganography at the level of recognition.
Threats is the largest recognition domain. Threat actors by attribute (nation-state, unskilled, hacktivist, insider, organised crime, shadow IT) and motivation; attack surfaces and vectors (message-based, image-based, removable media, supply chain, unsecured networks); social engineering (phishing, vishing, smishing, pretexting, business email compromise, watering hole, brand impersonation, typosquatting); vulnerability types (memory injection, buffer overflow, race conditions, TOC/TOU, misconfiguration, zero-day, VM escape, SQL injection, XSS); malware (ransomware, trojan, worm, spyware, bloatware, virus, keylogger, logic bomb, rootkit); network attacks (DDoS, DNS poisoning, on-path, credential replay, wireless attacks); password attacks (spraying, brute force); indicators of malicious activity (impossible travel, account lockout, resource consumption, out-of-cycle logging, missing logs); and mitigations (segmentation, access control, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, hardening).
| Question pattern | Answer pattern |
|---|---|
| A user reports an email urging an immediate wire transfer from the CFO | Business email compromise; verify out of band; awareness training |
| Logins for one account from two continents within an hour | Impossible travel indicator; force reauthentication, investigate |
| Many accounts each receive one login attempt with the same common password | Password spraying; MFA and lockout by source |
| Application crashes when input exceeds a field's size | Buffer overflow; input validation and memory-safe practices |
| Which control type is a data backup? | Corrective (technical) |
Domain 3: architecture
Architecture questions compare models and place controls. Models: cloud responsibility matrix, IaaS/PaaS/SaaS, hybrid, serverless, microservices, IaC, containerisation, virtualisation, SDN, on-premises, centralised versus decentralised, and considerations (availability, resilience, cost, responsiveness, scalability, ease of deployment and recovery, patch availability, power, compute). Network infrastructure: physical isolation and air gaps, logical segmentation, SDN, security zones, attack surface, connectivity, and where to place devices — jump servers, proxies (forward and reverse), IPS versus IDS (inline versus passive, fail-open versus fail-closed), load balancers, sensors, port security (802.1X, EAP), firewall types (WAF, UTM, NGFW, layer 4 versus 7), VPN types (site-to-site, remote access, IPsec, TLS), SD-WAN and SASE.
Data protection: data types and classifications (public, private, confidential, restricted, sensitive, critical), states (at rest, in transit, in use), sovereignty and geolocation, and methods (encryption, hashing, masking, tokenisation, obfuscation, segmentation, permission restrictions). Resilience: high availability (load balancing, clustering), site considerations (hot, warm, cold, geographic dispersion), platform diversity, multi-cloud, continuity of operations, capacity planning, testing (tabletop, failover, simulation, parallel processing), backups (onsite, offsite, frequency, encryption, snapshots, replication, journaling), and power (UPS, generators).
For placement questions, sketch the network in your head: a WAF sits in front of the web tier, a reverse proxy in front of internal servers, a jump server between the admin network and the secure zone, an IPS inline where blocking is required, an IDS on a tap where only alerting is acceptable.
Domain 4: operations
The largest domain is the Cybersecurity track in CompTIA's words. Hardening targets (mobile devices with MDM, workstations, switches, routers, cloud, servers, ICS/SCADA, embedded, RTOS, IoT), wireless (WPA3, RADIUS, site surveys, heat maps), mobile deployment models (BYOD, COPE, CYOD), application security (input validation, secure cookies, static and dynamic analysis, code signing, sandboxing). Asset management: acquisition, assignment, monitoring, disposal (sanitisation, destruction, certification), inventory. Vulnerability management: identification methods (scans, application analysis, threat feeds, penetration testing, bug bounties, audits), analysis (false positives and negatives, prioritisation, CVSS, CVE, exposure factor, environmental variables), response (patching, insurance, segmentation, compensating controls, exceptions), validation and reporting.
Monitoring: log aggregation, alerting, scanning, reporting, archiving, tools (SCAP, benchmarks, agents, SIEM, antivirus, DLP, SNMP traps, NetFlow, vulnerability scanners). Enterprise capabilities: firewall rules and screened subnets, IDS/IPS trends and signatures, web filtering (agent, centralised proxy, URL scanning, content categorisation, reputation), OS security (Group Policy, SELinux), secure protocols (port selection, transport methods), DNS filtering, email security (DMARC, DKIM, SPF, gateways), FIM, DLP, NAC, EDR/XDR, user behaviour analytics. Identity and access: provisioning and deprovisioning, permission assignment, identity proofing, federation, SSO (LDAP, OAuth, SAML), interoperability, attestation, access control models (mandatory, discretionary, role-based, rule-based, attribute-based, time-of-day, least privilege), MFA factors and attributes, password concepts and managers, passwordless, privileged access management (just-in-time, password vaulting, ephemeral credentials).
Automation and orchestration use cases and considerations; incident response (process: preparation, detection, analysis, containment, eradication, recovery, lessons learned; training, testing, root cause analysis, threat hunting, digital forensics: legal hold, chain of custody, acquisition, reporting, preservation, e-discovery); and data sources for investigation (logs from firewalls, applications, endpoints, OS, IPS/IDS, network, metadata; vulnerability scans, automated reports, dashboards, packet captures).
PBQ 1: Drag the phases into order.
Preparation -> Detection -> Analysis -> Containment -> Eradication -> Recovery -> Lessons learned
PBQ 2: Configure the firewall so only the web server accepts HTTPS from the internet,
the admin subnet may SSH to the web server, and everything else is denied.
1. ALLOW any -> 203.0.113.10 TCP 443
2. ALLOW 10.10.5.0/24 -> 203.0.113.10 TCP 22
3. DENY any -> any any (implicit or explicit last)
Order matters: rules are evaluated top-down, first match wins.Domain 5: governance, and how to answer
Governance: guidelines, policies (acceptable use, information security, business continuity, disaster recovery, incident response, SDLC, change management), standards (password, access control, physical security, encryption), procedures (change management, onboarding and offboarding, playbooks), external considerations (regulatory, legal, industry, local through global), monitoring and revision, governance structures (boards, committees, government entities, centralised and decentralised), and roles (owners, controllers, processors, custodians and stewards). Risk management: identification, assessment (ad hoc, recurring, one-time, continuous), analysis (qualitative, quantitative; single loss expectancy, annualised rate of occurrence, annualised loss expectancy; probability, likelihood, exposure factor, impact), risk register, tolerance and appetite, strategies (transfer, accept with exemption or exception, avoid, mitigate), reporting, business impact analysis (RTO, RPO, MTTR, MTBF).
Third-party risk: vendor assessment (penetration testing, right-to-audit, evidence of internal audits, independent assessments, supply chain analysis), vendor selection and conflicts of interest, agreement types (SLA, MOA, MOU, MSA, WO/SOW, NDA, BPA), monitoring, questionnaires, rules of engagement. Compliance: reporting, consequences (fines, sanctions, reputational damage, loss of licence, contractual impacts), monitoring, privacy (legal implications, data subject, controller versus processor, ownership, inventory and retention, right to be forgotten). Audits and assessments: attestation, internal (compliance, audit committee, self-assessment), external (regulatory, examinations, assessment, independent third-party audit), penetration testing types (physical, offensive, defensive, integrated, known/partially known/unknown environment, reconnaissance active and passive). Awareness: phishing campaigns, anomalous behaviour recognition, user guidance, reporting and monitoring, development and execution.
- Answer the way the objectives are worded; if two answers seem right, the one using the exam's own term for the scenario is the intended one.
- Prefer the control that addresses the stated risk directly over a broader improvement ("the BEST" answer is specific).
- Quantitative risk arithmetic appears: ALE = SLE × ARO, SLE = asset value × exposure factor. Compute it.
- Do PBQs last if they stall you; they are worth more but not infinitely more. The exam lets you flag and return.
- Read the whole question stem; distractors are built from words in it.
The five-week plan
| Week | Focus | Practice |
|---|---|---|
| 1 | Domain 1 and 2 objectives; vocabulary cards for control types, attacks, indicators | 50 questions; classify 30 described controls by category and type |
| 2 | Domain 3; draw the reference network and place every device type | 50 questions; five placement sketches |
| 3 | Domain 4 first half: hardening, vulnerability management, monitoring, enterprise capabilities | Lab: firewall rule set, SIEM query, email security records (SPF, DKIM, DMARC) on a test domain |
| 4 | Domain 4 second half and domain 5: identity, IR, forensics, governance, risk arithmetic, third-party, compliance | 50 questions; compute ALE for five scenarios; order the IR phases from memory |
| 5 | Two timed full practice exams; PBQ practice; weakest domain review from the objectives document | Rest the day before |
Use the official exam objectives as your checklist and a reputable question bank for practice; the free CertMaster practice samples show the style. The Cybersecurity track's modules are the depth behind domains 2 through 4 — reread the ones that map to your weakest scores. On the day, pace at one minute per multiple-choice question, leave PBQs for the end unless they are quick, and remember the pass mark is 750 of 900: you can miss a fair number and still pass.