Security+ SY0-701 Exam Objectives, Domain by Domain (2026 Study Guide)

Last updated September 2026

Updated October 26, 2026. This is our Security+ study hub: exam facts, every SY0-701 exam objective domain by domain, how SY0-801 changes the map, a study plan, five practice questions and an FAQ. Exam facts and objectives come from CompTIA’s Security+ V7 page and Security+ V8 page, checked on that date. Exam fees change often, so this guide leaves them out.

Security+ exam facts at a glance

Short version: if you can sit the exam before June 11, 2027 and you have already started studying, SY0-701 is still a fine choice. If you are starting from zero in late 2026, look at SY0-801 so your materials match the exam you will actually take. For who usually pays and where to buy, see who pays for the Security+ exam below.

Years ago a relative told me Security+ was “one of the easy ones.” I had already passed it. It was not easy, and it still is not a participation trophy. It is the vendor-neutral baseline most employers and many DoD-related roles still treat as the front door to cybersecurity work.

If you want the wider map of which credentials actually help a career move, start with our Best Cybersecurity Certifications in 2026 guide. If you are changing careers at any age, pair this with How to Transition to a Cybersecurity Career at Any Age.

Who should take Security+

Security+ fits people who need a credible, hands-on baseline. Not a management thesis, and not a niche specialist badge:

• Early-career security and IT folks aiming at security specialist, security administrator, or systems administrator roles.
• Help desk / network / sysadmin people who already touch tickets and configs and need a security credential hiring managers recognize.
• Career changers who need a structured outline and a finish line before they attempt heavier certs.
• DoD / contract-adjacent paths where Security+ still shows up as a common baseline (always verify the current DoD 8140/8570 mapping for your role, because those lists change).

CompTIA recommends Network+ and about two years in a security or systems admin role. You can sit Security+ without Network+, but skipping networking fundamentals leaves a real gap. You cannot secure what you do not understand.

SY0-701 exam objectives, domain by domain

SY0-701 has five domains and 28 objectives. The weights and objective summaries below come from CompTIA’s Security+ V7 page; the numbering follows CompTIA’s official SY0-701 exam objectives document, which CompTIA offers as a download. Use it as your checklist. CompTIA notes that the examples in the objectives are not exhaustive, so treat each line as a topic to understand, not a word list to memorize.

1.0 General Security Concepts (12%)

• 1.1 Security controls: comparing technical, managerial, operational and physical controls, and preventive, deterrent, detective, corrective, compensating and directive control types.
• 1.2 Fundamental security concepts: confidentiality, integrity and availability (CIA); non-repudiation; authentication, authorization and accounting (AAA); zero trust; and deception and disruption technology.
• 1.3 Change management: business processes, technical implications, documentation and version control.
• 1.4 Cryptographic solutions: public key infrastructure (PKI), encryption, obfuscation, hashing, digital signatures and blockchain.

Small weight, but the vocabulary shows up in every other domain. If you cannot classify a control as preventive or compensating quickly, scenario questions in Domains 4 and 5 get harder.

2.0 Threats, Vulnerabilities, and Mitigations (22%)

• 2.1 Threat actors and motivations: nation-states, unskilled attackers, hacktivists, insider threats, organized crime and shadow IT, and motives such as data exfiltration, espionage and financial gain.
• 2.2 Threat vectors and attack surfaces: message-based, unsecure networks, social engineering, file-based, voice call, supply chain and vulnerable software.
• 2.3 Vulnerabilities: application, hardware, mobile device, virtualization, operating system, cloud-specific, web-based and supply chain.
• 2.4 Indicators of malicious activity: malware, password, application, physical, network and cryptographic attacks.
• 2.5 Mitigation techniques: segmentation, access control, configuration enforcement, hardening, isolation and patching.

Objective 2.4 asks you to analyze indicators, so practice naming the attack from its symptoms, as in practice question 2 below.

3.0 Security Architecture (18%)

• 3.1 Architecture models: on-premises, cloud, virtualization, Internet of Things (IoT), industrial control systems (ICS) and infrastructure as code (IaC).
• 3.2 Enterprise infrastructure: applying security principles to infrastructure, control selection, and secure communication and access.
• 3.3 Data protection: data types, classifications, methods for securing data and general considerations.
• 3.4 Resilience and recovery: high availability, site considerations, testing, power, platform diversity, backups and continuity of operations.

Expect “which design fits this requirement” questions. Know what each architecture model gives up as well as what it gains.

4.0 Security Operations (28%)

• 4.1 Computing resources: secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing and monitoring.
• 4.2 Asset management: acquiring, assigning, monitoring and tracking, and disposing of hardware, software and data assets.
• 4.3 Vulnerability management: identifying, analyzing, remediating, validating and reporting vulnerabilities.
• 4.4 Alerting and monitoring: monitoring tools and computing resource activity.
• 4.5 Enterprise security capabilities: modifying firewalls, IDS/IPS, DNS filtering, data loss prevention (DLP), network access control (NAC) and EDR/XDR.
• 4.6 Identity and access management: provisioning, single sign-on (SSO), multifactor authentication (MFA) and privileged access tools.
• 4.7 Automation and orchestration: automation use cases, the benefits of scripting, and other considerations.
• 4.8 Incident response: processes, training, testing, root cause analysis, threat hunting and digital forensics.
• 4.9 Data sources for investigations: using log data and other sources to support an investigation.

The biggest domain, with the most objectives. Practice the hands-on tasks here, such as reading firewall rules, setting up access control and working through logs, because they suit performance-based questions. If incident response is where you want your career to go, our incident response certifications guide covers what comes after Security+.

5.0 Security Program Management and Oversight (20%)

• 5.1 Security governance: guidelines, policies, standards and procedures, external considerations, monitoring, governance structures, and roles and responsibilities.
• 5.2 Risk management: risk identification, assessment and analysis, risk registers, tolerance and appetite, strategies, reporting and business impact analysis (BIA).
• 5.3 Third-party risk: vendor assessment and selection, agreements, monitoring, questionnaires and rules of engagement.
• 5.4 Security compliance: compliance reporting, consequences of non-compliance, monitoring and privacy.
• 5.5 Audits and assessments: attestation, internal and external audits, and penetration testing.
• 5.6 Security awareness: phishing training, recognizing anomalous behavior, user guidance, reporting and monitoring.

One fifth of SY0-701, and it drops to 14% in SY0-801. Technical candidates often under-study it. Learn the difference between risk tolerance and risk appetite, and between an agreement type and an assessment type.

The weights shift a little in V8. AI-related risk becomes its own objective under threats, and program management drops from 20% to 14%. Here is how the two versions compare, using CompTIA’s published weights:

Either way, Security Operations is the biggest slice, and threats come second. Spend your time there first.

Where people trip on Security+

• Under-weighting Security Operations. It is 28% of SY0-701, the biggest domain, and it is where monitoring, vulnerability management and incident response scenarios live.
• Memorizing acronyms instead of controls. Reworded questions punish flashcard-only prep. Know why a control exists.
• Letting PBQs eat the clock. Flag them, clear the quick questions, and come back.
• Studying the wrong version. V8 is expected around mid-November 2026. Check which exam you will actually sit before you buy materials.

From Donald: This test is harder than I thought. The scenario questions are heavily weighted, so be sure to get them right. There is a ton of information you need to know.

A study plan that does not require buying every book

You do not need five textbooks and three boot camps. You need the objectives, one coherent explanation path, labs or demos for the hands-on bits, and a lot of practice questions. A realistic 6 to 10 week plan for someone with some IT background:

1. Week 1: map the objectives. Print or split-screen CompTIA’s SY0-701 objectives. Mark what you already know versus what is foggy. That list is your curriculum.
2. Weeks 2 to 5: one domain deep at a time. Weight your time toward Security Operations (28%) and Threats/Vulnerabilities (22%). Use one primary video or eBook track, not five competing ones. When a topic is abstract (PKI, secure protocols, SIEM triage), find a short lab or screenshot walkthrough.
3. Weeks 5 to 7: practice under exam conditions. Timed sets. Review every miss: was it vocabulary, a process step, or a scenario you rushed? Keep a “wrong twice” list.
4. Final week: weak-domain drills and PBQ comfort. Re-read your notes for Domains 4 and 5. Practice reading performance-based style tasks slowly. Sleep matters more than one more 2 a.m. cram.

Budget for what actually moves the needle: the objectives PDF (free), one solid primary course or book, and a reputable practice bank. Skip “guaranteed pass” dumps. They are a career risk and often outdated.

5 Security+ practice questions with explanations

These are original practice questions written in the style of SY0-701 scenarios. They are not real exam items. Try each one before you open the answer.

Want more? The CyberExperts Certification Lab has five more public Security+ sample questions, and a Security+ 10-question readiness check if you are not sure where to start.

Exam habits that still work

Habits that pay off on harder exams apply here too:

• Eliminate before you choose. Many Security+ items are won by killing two obviously wrong answers first.
• Read the last sentence of the scenario first. Know what the question is asking before you drown in distractors.
• Say the control family out loud. Preventive, detective, corrective, deterrent. If you can classify the control, you usually pick the right one.
• Treat PBQs as slow, not scary. They eat time. Flag, breathe, come back with a clear checklist mindset.
• Study the “why,” not the meme. Acronym flashcards help; understanding why a control exists is what survives a reworded question.

If you learn better by ear than by chapter, audio plus practice questions is a valid path. It’s the same idea I used for CISSP in How I passed the CISSP exam without reading any books. Security+ is shorter and more hands-on, but the principle holds: repetition beats a shelf of unread PDFs.

Where Security+ fits next to CySA+ and CISSP

Security+ is the baseline: prove you can think like a defender across architecture, operations, threats, and light governance. It is the common first cybersecurity cert for people entering the field.

CySA+ (CompTIA Cybersecurity Analyst) sits above Security+ for people who will live in alerts, threat hunting, and analysis. If your day job is already SOC-ish, CySA+ is often the more natural next CompTIA step than jumping straight to management-heavy credentials. Torn between the two? Our side-by-side look at Security+ and CySA+ compares cost, difficulty and who should take which first.

CISSP is a different animal: broader, more managerial, experience-gated for full certification, and overkill as a first move for most early-career folks. Use Security+ (and real work) first; treat CISSP as a later career credential. When you are ready, that CISSP path is documented in the guide linked above.

Going a different direction? If networking is your weak spot, start with our CompTIA Network+ guide. If you want offensive work after Security+, compare CompTIA PenTest+ and EC-Council CEH. Brand new to IT? CompTIA A+, the Google Cybersecurity Certificate or ISC2’s Certified in Cybersecurity (CC) can come first. Years into a technical security career? CompTIA SecurityX is CompTIA’s advanced practitioner certification. Want a pricier, lab-heavy alternative baseline? See our GIAC GSEC guide.

Also useful nearby reading: the 2026 certifications guide for sequencing, and the Daily Brief so you keep seeing how these domains show up in real incidents while you study.

Once you know which lane you want, the certification roadmap shows what to take after Security+ and in what order.

CompTIA’s cybersecurity certifications and where Security+ sits

People searching for “the CompTIA cybersecurity certification” usually mean Security+, but CompTIA runs a whole line of security exams. In order of how most people take them:

• Security+ (SY0-701, then SY0-801): the core security exam. CompTIA’s V7 page lists DoD 8140 work roles it supports, including cyber defense analyst, incident responder, vulnerability analyst, security control assessor and system administrator (CompTIA). In the DoD 8140 Qualification Matrix V2.1 it is an Intermediate option for 19 work roles (DoD 8140 Document Library; see our DoD 8140 guide).
• CySA+ (CS0-004): the analyst exam for SOC and vulnerability management work. Version 4 launched on June 23, 2026 (CompTIA). See our CySA+ guide.
• PenTest+: the offensive security exam. See our PenTest+ guide.
• SecurityX (CAS-005, formerly CASP+): CompTIA’s advanced practitioner exam for senior engineers and architects (CompTIA). See our SecurityX guide.
• SecAI+ (CY0-001): CompTIA’s AI security exam, launched February 17, 2026, for people who already have security experience (CompTIA). Our AI security certifications guide compares it with the alternatives.

CompTIA A+ and Network+ sit before Security+ for people coming from help desk or networking. Our cybersecurity certification path shows the full order by job.

Who pays for the Security+ exam

This guide does not list exam fees because they change and differ by country. The usual ways people cover the cost:

• Your employer. Ask about a training or certification budget before you buy anything yourself. For DoD and contractor positions coded to an 8140 work role, the certification is part of the job requirement, so raise who pays when the requirement comes up.
• Bundles with a retake. CompTIA sells Security+ bundles that pair CertMaster training with an exam voucher and Retake Assurance, which covers a second attempt (CompTIA).
• Buying direct. Current voucher and bundle options for your region are on CompTIA’s Security+ buy page.

If you are comparing total cost across several certifications, our certification cost calculator and cheapest cybersecurity certifications guide do the math.

What to tell anyone who calls Security+ easy

Do not call Security+ easy. Call it focused. Download the objectives. Pick one study track. Practice until your weak domains stop surprising you. Schedule the exam when your timed scores are consistently comfortable, not when you are tired of studying.

And once you pass, keep the signal coming. Certifications get you interviews; staying current is what keeps you useful. That is what the weekday brief is for: five minutes each weekday morning on what changed in security.

Security+ FAQ

Sources: CompTIA, Security+ V7 (SY0-701), Security+ V8 (SY0-801), Security+ overview, CySA+ V4, SecurityX and SecAI+; DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1). Accessed October 26, 2026.

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.