CompTIA Security+ SY0-701
Follow a topic roadmap built from the published exam blueprint, with lessons, practice exercises in a real terminal and practice exams.
Security+ validates the core skills required for a career in IT security and cybersecurity.
What you'll learn
Every objective Security+ publishes, and what it asks you to be able to do. The percentage is how much of the exam each one is worth.
- General security concepts (12% of the exam)Fundamental concepts: summarizing confidentiality, integrity, and availability (CIA); non-repudiation; authentication, authorization, and accounting (AAA); zero trust; and deception/disruption technology. Security controls: comparing technical, preventive, managerial, deterrent, operational, detective, physical, corrective, compensating, and directive controls. Cryptographic solutions: using public key infrastructure (PKI), encryption, obfuscation, hashing, digital signatures, and blockchain. Change management: explaining business processes, technical implications, documentation, and version control.
- Threats, vulnerabilities, and mitigations (22% of the exam)Threat actors and motivations: comparing nation-states, unskilled attackers, hacktivists, insider threats, organized crime, shadow IT, and motivations like data exfiltration, espionage, and financial gain. Threat vectors and attack surfaces: explaining message-based, unsecure networks, social engineering, file-based, voice call, supply chain, and vulnerable software vectors. Vulnerabilities: explaining application, hardware, mobile device, virtualization, operating system (OS)-based, cloud-specific, web-based, and supply chain vulnerabilities. Malicious activity: analyzing malware attacks, password attacks, application attacks, physical attacks, network attacks, and cryptographic attacks. Mitigation techniques: using segmentation, access control, configuration enforcement, hardening, isolation, and patching.
- Security architecture (18% of the exam)Architecture models: comparing on-premises, cloud, virtualization, Internet of Things (IoT), industrial control systems (ICS), and infrastructure as code (IaC). Enterprise infrastructure: applying security principles to infrastructure considerations, control selection, and secure communication/access. Data protection: comparing data types, securing methods, general considerations, and classifications. Resilience and recovery: explaining high availability, site considerations, testing, power, platform diversity, backups, and continuity of operations.
- Security operations (28% of the exam)Identity and access management: implementing provisioning, SSO (single sign-on), MFA (multifactor authentication), and privileged access tools. Computing resources: applying secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing, and monitoring. Asset management: explaining acquisition, disposal, assignment, and monitoring/tracking of hardware, software, and data assets. Vulnerability management: identifying, analyzing, remediating, validating, and reporting vulnerabilities. Alerting and monitoring: explaining monitoring tools and computing resource activities. Data sources: using log data and other sources to support investigations. And 3 more, each a topic in the course below.
- Security program management and oversight (20% of the exam)Security governance: summarizing guidelines, policies, standards, procedures, external considerations, monitoring, governance structures, and roles/responsibilities. Risk management: explaining risk identification, assessment, analysis, register, tolerance, appetite, strategies, reporting, and business impact analysis (BIA). Third-party risk: managing vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement. Security compliance: summarizing compliance reporting, consequences of non-compliance, monitoring, and privacy. Audits and assessments: explaining attestation, internal/external audits, and penetration testing. Security awareness: implementing phishing training, anomalous behavior recognition, user guidance, reporting, and monitoring.
The exam at a glance
- Length
- 90 minutes
- Cost
- 439 USD
- Validity
- 3 years
- Style
- Hands-on
maximum of 90 a mix of multiple-choice and performance-based questions. Based on V7 (SY0-701).
Sitting the exam
The part nobody publishes in a syllabus. For Security+ the logistics are study strategy: what you are allowed to read while the clock runs changes how you should practise, and what a second attempt costs changes when you should book.
What you are asked
- The exam consists of a maximum of 90 questions, which include a combination of multiple-choice and performance-based items.
- The exam consists of a maximum of 90 questions featuring both multiple-choice and performance-based items.
- Candidates are given 90 minutes to complete the test.
How it is marked
- Passing the exam requires a score of 750 based on a scale ranging from 100 to 900.
- Passing the certification requires a minimum score of 750 on a scale ranging from 100 to 900.
If you do not pass
- Exam vouchers and any associated retakes expire 12 months after the purchase date.
- Candidates are required to register and sit for the exam and any applicable retake before the expiration date of the voucher.
- The expiration dates for vouchers cannot be extended under any circumstances.
Booking it
- Candidates must register and take the exam, including any applicable retakes, before the voucher expiration date.
- You can redeem and schedule your exam quickly through CompTIA Central.
What comes with it
- The certification package provides a frameable certificate consisting of a professionally printed 8.5 x 11 inch document.
- The certification kit includes a professionally printed 8.5 x 11" frameable certificate.
- Your certification kit includes a frameable certificate featuring a professionally printed 8.5 x 11" document.
Read off the official exam page on 10 September 2026. Rules change without notice, so confirm anything you are about to spend money on.
What the exam covers
Straight from the published curriculum. The weights are how much of the exam each area is worth, so they are the honest guide to where your study time should go.
Course content
34 topics
1. Foundational Security Principles
Core security terminology, the CIA triad, and basic security thinking that underpins all other topics.
2. Fundamental Security Concepts
- Fundamental concepts: summarizing confidentiality, integrity, and availability (CIA); non-repudiation; authentication, authorization, and accounting (AAA); zero trust; and deception/disruption technology.
3. Security Control Types
- Security controls: comparing technical, preventive, managerial, deterrent, operational, detective, physical, corrective, compensating, and directive controls.
4. Understanding the Threat Landscape
- Threat actors and motivations: comparing nation-states, unskilled attackers, hacktivists, insider threats, organized crime, shadow IT, and motivations like data exfiltration, espionage, and financial gain.
5. Attack Vectors and Attack Surfaces
- Threat vectors and attack surfaces: explaining message-based, unsecure networks, social engineering, file-based, voice call, supply chain, and vulnerable software vectors.
6. Common Vulnerabilities
- Vulnerabilities: explaining application, hardware, mobile device, virtualization, operating system (OS)-based, cloud-specific, web-based, and supply chain vulnerabilities.
7. Analyzing Malicious Activity
- Malicious activity: analyzing malware attacks, password attacks, application attacks, physical attacks, network attacks, and cryptographic attacks.
8. Cryptography Fundamentals
Symmetric and asymmetric encryption, hashing basics, and when to use each cryptographic approach.
9. Cryptographic Solutions
- Cryptographic solutions: using public key infrastructure (PKI), encryption, obfuscation, hashing, digital signatures, and blockchain.
10. Basic Mitigation Techniques
- Mitigation techniques: using segmentation, access control, configuration enforcement, hardening, isolation, and patching.
11. Security Architecture Models: Foundations
- Architecture models: comparing on-premises, cloud, virtualization, Internet of Things (IoT), industrial control systems (ICS), and infrastructure as code (IaC).
12. Security Architecture Models: Specialized Systems
Security considerations for Internet of Things devices, industrial control systems, and infrastructure as code approaches.
13. Enterprise Infrastructure Security
- Enterprise infrastructure: applying security principles to infrastructure considerations, control selection, and secure communication/access.
14. Data Protection
- Data protection: comparing data types, securing methods, general considerations, and classifications.
15. Identity and Access Management
- Identity and access management: implementing provisioning, SSO (single sign-on), MFA (multifactor authentication), and privileged access tools.
16. Resilience and Recovery
- Resilience and recovery: explaining high availability, site considerations, testing, power, platform diversity, backups, and continuity of operations
17. Secure Computing Baselines and Mobile Security
- Computing resources: applying secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing, and monitoring.
18. Application Security and Sandboxing
Securing applications through sandboxing techniques and application-level security controls.
19. Asset Management
- Asset management: explaining acquisition, disposal, assignment, and monitoring/tracking of hardware, software, and data assets.
20. Change Management
- Change management: explaining business processes, technical implications, documentation, and version control.
21. Vulnerability Management
- Vulnerability management: identifying, analyzing, remediating, validating, and reporting vulnerabilities.
22. Monitoring and Alerting
- Alerting and monitoring: explaining monitoring tools and computing resource activities.
23. Data Sources for Security
- Data sources: using log data and other sources to support investigations.
24. Network Security Capabilities
- Enterprise security: modifying firewalls, IDS/IPS, DNS filtering, DLP (data loss prevention), NAC (network access control), and EDR/XDR (endpoint/extended detection and response).
25. Endpoint and Access Security Capabilities
Network access control and endpoint detection and response technologies for comprehensive security monitoring.
26. Automation and Orchestration
- Automation and orchestration: explaining automation use cases, scripting benefits, and considerations.
27. Incident Response
- Incident response: implementing processes, training, testing, root cause analysis, threat hunting, and digital forensics.
28. Security Governance
- Security governance: summarizing guidelines, policies, standards, procedures, external considerations, monitoring, governance structures, and roles/responsibilities.
29. Risk Assessment Fundamentals
- Risk management: explaining risk identification, assessment, analysis, register, tolerance, appetite, strategies, reporting, and business impact analysis (BIA).
30. Risk Management Strategies
Risk treatment strategies, risk reporting, and ongoing risk management approaches.
31. Third-Party Risk Management
- Third-party risk: managing vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement.
32. Security Compliance and Privacy
- Security compliance: summarizing compliance reporting, consequences of non-compliance, monitoring, and privacy.
33. Audits and Assessments
- Audits and assessments: explaining attestation, internal/external audits, and penetration testing.
34. Security Awareness Programs
- Security awareness: implementing phishing training, anomalous behavior recognition, user guidance, reporting, and monitoring.
What to know before you start
- General security concepts
- Threats, vulnerabilities, and mitigations
- Security architecture
- Security operations
- Security program management and oversight
Other CompTIA certifications
All CompTIA certificationsFrequently asked questions
How much does the Security+ exam cost?
439 USD. Confirm it on CompTIA's page before you book: exam fees change.
How long is the Security+ exam?
90 minutes. maximum of 90 a mix of multiple-choice and performance-based questions.
How many questions are on the Security+ exam?
The exam consists of a maximum of 90 questions, which include a combination of multiple-choice and performance-based items. Check the current count with CompTIA before you book.
How long is Security+ valid?
3 years. Check CompTIA's recertification route before it lapses.
Is the Security+ exam hands-on?
Yes. It is performance-based: you are given a live environment and a command line, and marked on what you actually do rather than what you can recognise. Reading alone does not prepare you for it.
What is on the Security+ exam?
5 domains. The heaviest is Security operations at 28% of the exam, so it is the one worth over-preparing.
What should I know before starting Security+?
General security concepts. Threats, vulnerabilities, and mitigations. Security architecture. Security operations. Security program management and oversight.
Security+ vs SecurityX: what is the difference?
Security+: 90 minutes, 439 USD, hands-on, foundational level. SecurityX: 165 minutes, 544 USD, hands-on, expert level. Both are CompTIA exams with their own guide on this site.
Exam details from CompTIA. Always confirm on their page before booking.
What learners say about Acelro
About Acelro rather than the Security+ exam: what learners made of the gap analysis, the roadmap and the projects.
“The roadmap makes me focus on a learning curve, no matter the length.”
“Acelro has been really great for me, an inspiring experience. I've gained a lot of confidence doing projects I thought were rocket science.”
“The gap analysis maps your actual skills against what the current job market is asking for. Nobody else made it that clear where I stood.”
Not sure you are ready for Security+ yet? Check where your skills stand in under a minute, no sign-up required.
Check your career readiness, free