Study guide · CompTIA Security+
Security+ SY0-701 study guide: exam structure and a 6-week plan
A practical guide to CompTIA Security+ (SY0-701): how the exam is put together, what the current outline stresses and how to spend six weeks preparing.
How the exam is structured
SY0-701 is a single exam of up to 90 minutes. It mixes multiple-choice items with performance-based items, where you work through a short task or scenario instead of picking one answer. Check CompTIA's exam page for the passing score and recommended experience.
The outline has five domains that build on each other. General Security Concepts gives you the vocabulary and core controls; Threats, Vulnerabilities, and Mitigations covers what attackers do and how you respond; Security Architecture applies those ideas to networks, cloud and infrastructure design. Security Operations, the largest domain, is the day-to-day work of monitoring, hardening, identity and incident response, and Security Program Management and Oversight ties it all to governance, risk, compliance and awareness.
Most items are scenario-based: they describe a situation and ask for the best control, the most likely threat or the right next step. Knowing definitions helps, but the exam rewards choosing the most appropriate option for the context.
Exam domains
| Domain | Share of exam |
|---|---|
| General Security Concepts | 12% |
| Threats, Vulnerabilities, and Mitigations | 22% |
| Security Architecture | 18% |
| Security Operations | 28% |
| Security Program Management and Oversight | 20% |
Source: CompTIA Security+ exam objectives, SY0-701 (opens in a new tab)
What changed in the current outline
The current exam is CompTIA Security+ V7, exam code SY0-701, which launched on 7 November 2023. Its outline is organized into the five domains shown on this page, with Security Operations carrying the most weight.
CompTIA has announced a newer version of Security+. This track stays on SY0-701 while it is offered, so check CompTIA's exam page for SY0-701's retirement date before you book.
To spot material for a different exam, look at the exam code: make sure books, courses and practice sets name SY0-701 and its five domains, not an older code or the newer version.
A 6-week study approach
Week 1: Diagnostic and general concepts
Take a diagnostic to see where you stand across all five domains. Then work through General Security Concepts: security controls, the CIA triad, zero trust, change management and cryptography basics.
Week 2: Threats, vulnerabilities and mitigations
Study threat actors, attack vectors, common vulnerabilities and indicators of malicious activity. Practice matching each attack to the mitigation that fits it best.
Week 3: Security architecture
Cover architecture models, cloud and on-premises considerations, securing enterprise infrastructure, data protection and resilience. Focus on why one design choice is safer than another in a given scenario.
Week 4: Security operations
Give this domain the most time, since it carries the most weight. Work on hardening, vulnerability management, monitoring and alerting, identity and access management, automation and the incident response process.
Week 5: Program management and oversight
Study governance, risk management, third-party risk, compliance, audits and security awareness. Then revisit your weakest domain from earlier weeks with targeted practice.
Week 6: Mock exams and review
Sit full mock exams under a 90-minute limit and review every explanation, including for items you got right. Use CompTIA's own resources to get familiar with performance-based items before exam day.
Common traps
Studying for the wrong exam code
Material written for another exam code is not built on the SY0-701 objectives. Check the code on every resource before you invest time in it.
Memorizing acronyms without context
Security+ uses many acronyms, but items ask you to apply them to a scenario. Learn what each control or protocol does and when you would choose it.
Ignoring performance-based items
Performance-based items take longer and feel different from multiple choice. CandiCerts practice is multiple choice and does not simulate them, so get hands-on familiarity from CompTIA's resources or lab work.
Underweighting Security Operations
It is the largest domain, yet many candidates spend most of their time on cryptography and attack types. Balance your hours against the domain weights.
Poor time management
Spending too long on one hard item can leave you rushing at the end. Flag it, move on and come back once you have answered what you can.
How CandiCerts helps
- A free diagnostic shows how you stand across the five SY0-701 domains.
- Your study plan is built from your diagnostic results, so time goes to the domains where you need it most.
- You can practice by domain with an explanation for every answer, and sit mock exams that follow the outline weights.
- A tutor explains concepts and answers in plain language whenever you get stuck.
Questions about this guide
How long is the Security+ SY0-701 exam?
Up to 90 minutes, with multiple-choice and performance-based items.
Is SY0-701 still the current exam?
CompTIA has announced a newer version, but SY0-701 remains available for now. Check CompTIA's exam page for its retirement date.
What score do I need to pass?
Check CompTIA's exam page for the current passing score.
Do I need experience or another certification first?
Check CompTIA's exam page for prerequisites and recommended experience.
Does CandiCerts simulate performance-based items?
No. CandiCerts practice is multiple choice and does not simulate performance-based items, so use CompTIA's resources to prepare for that format.
Last reviewed: