CompTIA Security+
CompTIA Security+ (SY0-701) is the entry-level vendor-neutral cybersecurity credential and the most-cited baseline cert for SOC analyst, junior security engineer, and GRC analyst hiring. The exam covers five domains spanning general security concepts, threats and mitigations, security architecture, security operations, and security program management. The exam runs 90 minutes with up to 90 multiple-choice and performance-based questions; passing score is 750 on a scaled 100-900 scale. The credential is DoD 8140 approved for IAT Level II work roles. CompTIA refreshes the exam every three years; SY0-701 is the current version released November 2023.
Exam fee at last check: $404, per the vendor. The official objectives are at www.comptia.org/en-us/certifications/security/. Verified 2026-05-22.
SY0-801 is announced. SY0-701 stays available until 2027-06-11.
- CompTIA lists SY0-801 (Security+ V8) as launching on or around 2026-11-17.1
- SY0-801: up to 90 questions, 90 minutes, passing score 750, English only at launch.1
- SY0-801 domain weights: General Security Concepts 16%, Threats, Vulnerabilities, and Attacks 24%, Security Architecture 19%, Security Operations 27%, Security Program Management and Oversight 14%.1
- SY0-701 English retires 2027-06-11. The Japanese, Portuguese, Spanish and Thai versions retire 2027-08-13.2
The practice questions on this page were written against the SY0-701 objectives. They remain valid until your exam version retires.
Sources, checked 2026-10-04
Get an email if the CompTIA Security+ exam changes
Common questions about the exam change
- When does the new CompTIA Security+ exam start?
- SY0-801 launches: on or around 2026-11-17. Source: CompTIA Security+ V8 (SY0-801), checked 2026-10-04.
- When does the old CompTIA Security+ exam retire?
- SY0-701 retires in English: 2027-06-11. SY0-701 retires in Japanese, Portuguese, Spanish and Thai: 2027-08-13. Source: CompTIA Security+ V8 (SY0-801), checked 2026-10-04.
- What changed in the CompTIA Security+ exam?
- CompTIA lists SY0-801 (Security+ V8) as launching on or around 2026-11-17. SY0-801: up to 90 questions, 90 minutes, passing score 750, English only at launch. SY0-801 domain weights: General Security Concepts 16%, Threats, Vulnerabilities, and Attacks 24%, Security Architecture 19%, Security Operations 27%, Security Program Management and Oversight 14%. SY0-701 English retires 2027-06-11. The Japanese, Portuguese, Spanish and Thai versions retire 2027-08-13. Source: CompTIA Security+ V8 (SY0-801), checked 2026-10-04.
- Which version of the CompTIA Security+ exam do the practice questions follow?
- The practice questions on this page were written against the SY0-701 objectives. They remain valid until your exam version retires.
- Starts SY0-801 launches
- Retires SY0-701 retires in English
- Retires SY0-701 retires in Japanese, Portuguese, Spanish and Thai
- General Security Concepts16%
- Threats, Vulnerabilities, and Attacks24%
- Security Architecture19%
- Security Operations27%
- Security Program Management and Oversight14%
Source: CompTIA Security+ V8 (SY0-801). Checked 2026-10-04. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
General Security Concepts 12%
Foundational vocabulary the rest of the exam builds on. Security controls (technical, managerial, operational, physical), the CIA triad with non-repudiation, change management, and cryptographic primitives.
- Control categories: technical, managerial, operational, physical, and the matching control types (preventive, deterrent, detective, corrective, compensating, directive)
- CIA triad plus authentication, authorization, accounting, and non-repudiation
- Change management: approval, scheduling, version control, rollback, ownership
- Cryptographic primitives: symmetric vs asymmetric, hashing, digital signatures, certificates, PKI, key escrow, key stretching
- Zero trust: control plane, data plane, policy decision point, policy enforcement point, adaptive identity
Primary sources: CompTIA Security+ SY0-701 Exam Objectives (official PDF), NIST SP 800-53 Rev. 5: Security and Privacy Controls, NIST SP 800-207: Zero Trust Architecture
Threats, Vulnerabilities, and Mitigations 22%
The largest single domain on the exam. Threat actors, motivations, vectors, common malicious software, application vulnerabilities, and the matching mitigation patterns.
- Threat actor categories: nation-state, organized crime, hacktivist, insider, unskilled attacker, and the matching motivations
- Attack vectors: message-based, image-based, file-based, voice call, removable media, vulnerable software, unsecured networks, open service ports, default credentials, supply chain
- Malware: virus, worm, trojan, ransomware, spyware, bloatware, keylogger, rootkit, logic bomb
- Application vulnerabilities: memory injection, buffer overflow, race conditions (TOCTOU), malicious update, hardware (firmware) vulnerabilities
- Mitigation techniques: segmentation, access control (ACL), application allow list, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, hardening
Primary sources: MITRE ATT&CK framework, OWASP Top 10, NIST SP 800-115: Technical Guide to Information Security Testing
Security Architecture 18%
How architectural choices shape the security posture. Cloud and virtualization, network architecture, infrastructure, secure data design, data states, and resilience.
- Architecture models: cloud, serverless, microservices, network infrastructure, IaC, on-premises, centralization vs decentralization, containerization, virtualization, IoT, ICS/SCADA, RTOS, embedded systems, high availability
- Network considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, compute
- Secure infrastructure: device placement, security zones, attack surface, connectivity (firewall, IDS/IPS, load balancer, sensors, proxy, gateway, jump server)
- Data classification, data states (in transit, at rest, in use), data types (sensitive, regulated, intellectual property, legal), data sovereignty
- Resilience and recovery: site redundancy (geographic dispersion, hot, warm, cold), platform diversity, multi-cloud, backups, capacity planning, testing (tabletop, fail-over, simulation, parallel processing)
Primary sources: NIST SP 800-145: The NIST Definition of Cloud Computing, NIST SP 800-160 Vol. 1 Rev. 1: Engineering Trustworthy Secure Systems, Cloud Security Alliance: Cloud Controls Matrix v4
Security Operations 28%
The largest domain by weight. Day-to-day defense: hardening, security techniques across the infrastructure, identity and access, automation, incident response, and digital forensics.
- Hardening targets: mobile, workstation, switch, router, cloud, server, ICS, IoT, embedded systems
- Wireless security: WPA3, AAA / RADIUS, cryptographic protocols, authentication protocols (PEAP, EAP-TLS, EAP-TTLS), site surveys, heat maps
- Application security: input validation, secure cookies, static analysis (SAST), code signing, sandboxing, monitoring
- Vulnerability management: discovery (scanner, agent, OSINT, static / dynamic analysis, bug bounty, penetration testing), analysis (CVSS, CVE), validation (false positive), reporting
- Identity and access: provisioning, deprovisioning, federation (SAML, OIDC), SSO, LDAP, OAuth, MFA factors (something you know / have / are / where you are / what you do), password policies, password managers, passwordless, privileged access (just-in-time, password vaulting, ephemeral credentials)
- Incident response: preparation, detection, analysis, containment, eradication, recovery, lessons learned (NIST SP 800-61 Rev 2 lifecycle)
- Digital forensics: legal hold, chain of custody, acquisition, reporting, preservation, e-discovery
Primary sources: NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide, NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management, NIST SP 800-92: Guide to Computer Security Log Management
Security Program Management and Oversight 20%
The governance and risk-management view. Security governance, risk-management process, third-party risk, compliance, audit, and security awareness.
- Security governance: policies, standards, procedures, guidelines, external considerations (regulatory, legal, industry, local / regional / national / global)
- Risk-management process: risk identification, assessment (qualitative, quantitative, SLE, ALE, ARO), analysis, treatment (transfer, accept, avoid, mitigate), reporting
- Third-party risk: vendor selection (due diligence, conflict of interest), agreements (SLA, MOA, MOU, MSA, WO/SOW, NDA, BPA), monitoring, questionnaires, rules of engagement
- Compliance: regulated industries, reporting (internal, external), monitoring, attestation, automation, due diligence, due care, attestation, acknowledgement
- Audit and assessment: internal vs external attestation, examinations, penetration testing (physical, offensive, defensive, integrated, known / partially known / unknown environment), reconnaissance (passive, active)
- Security awareness: phishing, recognizing a phishing attempt, anomalous behavior recognition (risky, unexpected, unintentional), user guidance and training
Primary sources: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, NIST SP 800-37 Rev. 2: Risk Management Framework, ISO/IEC 27001:2022 (overview via ISO)
Exam-day strategy
Read each question twice before looking at the options. SY0-701 questions are written carefully; the second read often reveals a qualifier (most, least, best, first) that changes which option is correct.
For performance-based questions (PBQs), spend time understanding the scenario, then commit to your answer and move on. PBQs cannot be revisited after you leave the section if the test environment locks them.
On multiple-choice questions, eliminate two distractors before choosing between the remaining options. The right answer is usually the most operationally complete and most aligned with NIST SP 800-53 control families.
Watch for trick distractors that swap categories (technical vs managerial vs operational vs physical) or control types (preventive vs detective vs corrective vs compensating). The SY0-701 exam tests this distinction repeatedly.
Pace for 60 seconds per multiple-choice question on the first pass; flag tough questions and return. The 90-minute clock is tight only if you spend more than 3 minutes on any single PBQ.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of CompTIA. Security+ is a trademark of CompTIA. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.