Security+ is the go-to baseline certification for people moving into security, aimed at roles like security analyst, security engineer, and systems administrator. It proves you can apply core security concepts: assessing an environment's security posture, securing hybrid and cloud setups, responding to incidents, and working within governance, risk, and compliance requirements.
The exam is scenario heavy. Many questions describe a situation and ask for the best control, the next step, or the most likely cause, so this plan pushes you to apply concepts early instead of rereading notes.
Use it in order: check the exam facts, skim the domain breakdown to see where the points are, then follow the 8 week plan and adjust it to your background. One timing note: CompTIA has announced that the next version (V8, SY0-801) is expected to launch on or around November 17, 2026, and SY0-701 retires in English on June 11, 2027. Starting now, SY0-701 is still a sound choice; just test well before retirement.
The exam at a glance
| Exam code | SY0-701 |
|---|---|
| Questions | Maximum of 90 |
| Time | 90 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Question types | Multiple choice and performance-based questions |
| Price (US voucher) | $439 USD at CompTIA list price |
| Prerequisites | None required. CompTIA recommends Network+ and two years of experience in a security or systems administrator role |
| Retirement | English: June 11, 2027. Japanese, Portuguese, Spanish, and Thai: August 13, 2027 |
What each domain tests
General Security Concepts
12%The vocabulary and foundations everything else builds on: control types, core principles, change management, and cryptography.
- Control categories (technical, managerial, operational, physical) and control types (preventive, deterrent, detective, corrective, compensating, directive)
- CIA triad, non-repudiation, and AAA (authentication, authorization, accounting)
- Zero trust concepts: control plane vs data plane, policy engine and policy enforcement point
- Change management: approvals, impact analysis, backout plans, maintenance windows
- PKI, certificates, symmetric vs asymmetric encryption, hashing, salting, and digital signatures
Threats, Vulnerabilities, and Mitigations
22%Who attacks, how they get in, what weaknesses they exploit, how to spot it happening, and how to reduce the risk.
- Threat actors and motivations (nation state, organized crime, hacktivist, insider, unskilled attacker)
- Threat vectors and social engineering: phishing, vishing, smishing, pretexting, watering hole, typosquatting
- Vulnerability types: injection, buffer overflow, race conditions, misconfiguration, supply chain, zero day
- Indicators of malicious activity: malware types, password attacks, network and application attacks
- Mitigation techniques: segmentation, access control lists, patching, least privilege, hardening
Security Architecture
18%How to design and secure infrastructure across on premises, cloud, and hybrid environments, protect data, and stay resilient.
- Architecture models: cloud responsibility matrix, IaC, serverless, microservices, IoT, ICS/SCADA
- Secure infrastructure: device placement, security zones, firewalls, IDS/IPS, VPN, SD-WAN, SASE
- Data protection: data states (at rest, in transit, in use), classification, tokenization, masking
- Resilience: high availability, hot/warm/cold sites, backups, and capacity planning
Security Operations
28%The day to day work of securing systems, managing identities and vulnerabilities, monitoring, automating, and responding to incidents.
- Hardening endpoints, mobile devices, wireless (WPA3, RADIUS), and applications
- Vulnerability management: scanning, CVSS, prioritization, remediation, and validation
- Monitoring tools: SIEM, log aggregation, alerting, DLP, EDR/XDR, and secure protocols
- Identity and access management: provisioning, SSO, federation, MFA, access control models, PAM
- Incident response process and digital forensics (chain of custody, legal hold, order of volatility)
- Using data sources such as logs, packet captures, and dashboards to support an investigation
Security Program Management and Oversight
20%The governance side of security: policies, risk management, third party risk, compliance, audits, and security awareness.
- Governance documents: policies, standards, procedures, and guidelines, plus governance roles (owner, controller, processor, custodian)
- Risk management: risk registers, qualitative vs quantitative analysis, SLE, ARO, ALE, and risk responses
- Third party risk: vendor assessment, SLA, MOU, MSA, SOW, NDA, BPA
- Compliance, privacy, audits, and penetration test types
- Security awareness: phishing campaigns, anomalous behavior recognition, and training programs
Study plan
Plan on 8 to 10 hours per week, roughly an hour on weekdays and a longer session on the weekend. The schedule follows the domain weights, so Security Operations and Threats get the most time. If you already work in IT or hold Network+, you can likely compress Weeks 1 to 4 into two or three weeks and spend the saved time on practice exams. If you are new to IT, stretch the plan to 10 or 12 weeks rather than cramming, and make sure basic networking (ports, protocols, subnets) feels comfortable before Week 3.
- Weeks 1-2
Foundations and baseline
Download the official SY0-701 exam objectives and use them as your checklist. Take a short diagnostic quiz before you study anything so you know your starting point. Work through General Security Concepts, focusing on control categories and types, zero trust, and cryptography basics. Start reviewing acronyms and ports for 10 minutes a day, using CyberExamPrep flashcards or your own deck.
- Weeks 3-4
Threats, vulnerabilities, and mitigations
Study threat actors, attack vectors, vulnerability types, and indicators of compromise. For every attack, note the mitigation that stops it. End each session with 20 to 30 practice questions and read every explanation. When one doesn't click, ask Aurora, the AI tutor, to explain it another way.
- Weeks 5-6
Architecture and operations
Cover Security Architecture, then spend most of this stretch on Security Operations, the largest domain. Prioritize identity and access management, vulnerability management, monitoring tools, and the incident response process. Drill CyberExamPrep practice questions by domain to find weak objectives, and start PBQ style tasks like firewall rules and log analysis.
- Week 7
Governance, risk, and compliance
Work through Security Program Management and Oversight: policy types, risk calculations, third party agreements, audits, and awareness training. Practice the ALE formula until you can do it without notes. Take your first full length timed practice exam at the end of the week and review every miss.
- Week 8
Full exams and targeted review
Take two or three timed mock exams under realistic conditions: 90 minutes, no notes, no pausing. Use the domain score report from each one to pick your two weakest areas, and spend the days between exams on those objectives only. Aim to score comfortably above passing on several fresh exams before you book or confirm your date.
- Exam week
Light review and rest
Stop learning new material. Do a final pass on your flashcards, your list of commonly confused topics, and a handful of PBQs to stay warm. Confirm your appointment, ID, and testing setup, and get a full night of sleep before the exam.
Most-missed topics
These concepts look alike on paper, which is exactly why they trip people up. Know the difference cold.
- Control categories vs control types
- Category describes how a control is implemented (technical, managerial, operational, physical). Type describes what it does (preventive, detective, corrective, deterrent, compensating, directive). A security guard is a physical control that can be both preventive and deterrent, so read which dimension the question is asking about.
- Hashing vs encryption vs digital signatures
- Hashing is one way and proves integrity. Encryption is reversible and provides confidentiality. A digital signature is a hash encrypted with the sender's private key, verified with the sender's public key, and gives integrity, authentication, and non-repudiation. Remember: encrypt to someone with their public key, sign with your own private key.
- RTO vs RPO vs MTTR vs MTBF
- RTO is how long you can be down. RPO is how much data you can afford to lose, measured in time back to the last good backup. MTTR is the average time to repair, and MTBF is the average time between failures. A quick memory hook: RPO points backward to data, RTO points forward to restoring service.
- IDS vs IPS, and false positives vs false negatives
- An IDS detects and alerts; an IPS sits inline and can block. A false positive is an alert on harmless activity, while a false negative is a real attack that went unnoticed, which is usually the more dangerous outcome. If a scenario says traffic must be stopped automatically, think IPS.
- SAML vs OAuth vs OpenID Connect
- SAML is an XML based standard for federated authentication and single sign on, common in enterprise web apps. OAuth handles authorization, letting an app access resources on your behalf without your password. OpenID Connect adds an authentication layer on top of OAuth. Ask yourself whether the scenario is about proving who you are or granting access.
- Vulnerability scan vs penetration test
- A vulnerability scan identifies and reports possible weaknesses without exploiting them. A penetration test actively exploits weaknesses to show real impact, and needs defined rules of engagement. Credentialed scans log in and see more than non-credentialed scans, which show what an outside attacker would see.
- Incident response phases in order
- The SY0-701 objectives list preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Questions often ask for the next step, so know the order cold. A common slip is jumping to eradication before the threat is contained.
- Quantitative risk math: SLE, ARO, ALE
- SLE equals asset value times exposure factor. ALE equals SLE times ARO, the annualized rate of occurrence. If a control costs more per year than the ALE it reduces, it is hard to justify. Practice a few problems by hand so the formulas are automatic.
How to handle PBQs
CompTIA describes performance-based questions as items that test your ability to perform a task or solve a problem in a simulated environment, such as a firewall, network diagram, terminal window, or operating system. On Security+ that can mean matching controls to scenarios, placing devices in a network, configuring firewall rules, or reading logs to identify an attack. The simulations have limited functionality and reward applying concepts, not just recognizing them.
- Read the whole prompt and every tab before you click anything. Key details, like a required port or host, are often in the instructions.
- If PBQs appear early and one stumps you, flag it and move on. Bank the multiple choice points first, then come back with your remaining time.
- Budget your time. With up to 90 questions in 90 minutes, a PBQ that takes 10 minutes is borrowing time from other questions, so set a personal limit and stick to it.
- Complete every field. Partial credit is not guaranteed, so treat each blank as a possible lost point and give your best answer everywhere.
- Check your final state before submitting and make sure dragged items landed where you intended.
- Practice hands on first. Simulated tasks, like the labs at pbq.cyberexamprep.com, make the format familiar so exam time goes to thinking.
Exam day
- Schedule through Pearson VUE, at a test center or online with OnVUE, at a time of day when you are usually sharp.
- Bring the right ID. Test centers require two valid, unexpired IDs: a government issued primary ID with photo and signature, plus a secondary ID. OnVUE requires a government issued photo ID (military IDs are not accepted). Names must match your registration exactly.
- Arrive at least 15 minutes early for a test center. For OnVUE, begin check-in 30 minutes before your appointment to complete the system check, ID photos, and room scan on a clean desk.
- Before the exam starts, you must accept the CompTIA Candidate Agreement, which includes a non-disclosure agreement. Declining it means you cannot test and you forfeit the fee.
- Do the pacing math: 90 minutes for up to 90 questions is about one minute per question. Aim to be roughly halfway through the questions at the 45 minute mark, and keep 10 to 15 minutes at the end for flagged items and PBQs.
- Use flag for review. If you are stuck between two choices, pick one, flag it, and move on.
- Read the qualifier in every question: words like best, first, most likely, and least tell you which of several correct sounding answers they want.
FAQ
- How long does it take to study for Security+?
- Most candidates need 6-10 weeks of dedicated study. This depends on your background - those with IT experience may need less time, while complete beginners may need more.
- Is Security+ difficult to pass?
- CompTIA does not publish pass rates, but Security+ covers a broad range of topics and includes performance-based questions. With proper preparation using practice exams and understanding core concepts, most dedicated students pass on their first attempt.
- What score do I need to pass?
- You need 750 out of 900 points to pass SY0-701. The score is on a scaled range of 100 to 900, so it does not translate to a percentage of questions answered correctly.
- Should I take any prerequisites before Security+?
- While not required, CompTIA recommends Network+ and 2 years of IT experience. Basic understanding of networking concepts (ports, protocols, TCP/IP) helps significantly.
- How many practice questions should I complete?
- We recommend answering at least 500-800 unique practice questions before your exam. Focus on understanding why answers are correct, not just memorizing questions.