Prepare from the current SY0-701 objectives, checking both your knowledge and your ability to apply it. This guide maps the five domains, explains simulation questions and offers an original access-control exercise, plus a sourced comparison of signing and encryption.
What the Security+ exam covers
SY0-701 certifies practical security skills across five domains: assessing security posture, securing hybrid environments, working within regulations and governance, and responding to incidents.
CompTIA's official objectives document states that the exam certifies the ability to assess an enterprise security posture and recommend solutions, monitor and secure hybrid environments including cloud, mobile, and IoT, operate with awareness of applicable regulations and policies, and identify, analyze, and respond to security events and incidents.
The current series is SY0-701, launched November 7, 2023. CompTIA labels the exam V7; the objectives PDF is document version 5.0. Match your resources to the exam code and current objectives rather than assuming a familiar title means current coverage.
The objectives also carry a warning worth remembering: the example lists under each objective are not exhaustive, and CompTIA updates test questions continuously. Cover the objectives fully rather than memorizing only the named example terms.
Sources used: CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0; Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections
Format, languages and version dates
SY0-701 combines multiple-choice and performance-based questions. The maximum question count is a ceiling, and the scaled score is not a raw percentage.
The exam is offered in English, Japanese, Portuguese, Spanish and Thai. CompTIA lists retirement on June 11, 2027 for English and August 13, 2027 for the other four languages. Check the current page and your booked exam code before paying.
Sources used: Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0
Recommended experience, not a gate
CompTIA recommends Network+ and two years of security-focused IT administration experience, but these are recommendations, not enforced prerequisites.
CompTIA recommends Network+ and two years in a security or systems administrator role. The objectives also describe relevant hands-on security knowledge. These are recommended preparation, not mandatory credentials or admission requirements.
If your background is lighter, use the objectives and practice errors to locate foundational gaps, then allow time to address them.
Sources used: Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0
The five domains and how to study them
Cover all five domains. Their weights describe exam coverage; your own gaps help determine where additional study will be useful.
The table pairs official testing areas with optional study tasks. Work through the full objectives and return to topics behind repeated errors, including domains with smaller weights.
| Domain | Weight | Topics and a study task |
|---|---|---|
| General Security Concepts | 12% | Controls, CIA, non-repudiation, AAA, zero trust, change management and cryptography. Task: compare the purposes of two concepts using their definitions. |
| Threats, Vulnerabilities, and Mitigations | 22% | Actors, attack surfaces, vulnerabilities, indicators and mitigations. Task: identify the stated weakness and compare responses against a scenario's constraints. |
| Security Architecture | 18% | Architecture models, infrastructure, data protection and resilience. Task: identify which design requirements a given scenario needs to satisfy. |
| Security Operations | 28% | Hardening, assets, vulnerability management, monitoring, IAM, automation and incident response. Task: work a legitimate lab or sample task and check the resulting state. |
| Security Program Management and Oversight | 20% | Governance, risk, third parties, compliance, audits and awareness. Task: explain the purpose and differences of the listed policies and processes. |
Sources used: CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0; Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections
Performance-based questions and how to practise them
SY0-701 includes simulation performance-based questions: restricted mock environments where you solve a task, with partial credit and multiple valid paths possible.
CompTIA describes performance-based questions (PBQs) as items testing problem-solving in real-world settings. On Security+, these are simulations — approximations of a firewall, network diagram, terminal window, or operating system with restricted functionality. CompTIA's current overview lists Security+ among the certifications using simulation PBQs.
The mechanics matter on exam day. You can skip a simulation PBQ and return to it; your work is saved as you move. The reset button inside a simulation clears only that question, not the rest of your exam. CompTIA's FAQ confirms partial credit may be offered and that scoring addresses multiple valid approaches, though which items offer it is confidential.
For preparation, use legitimate sample tasks or labs you are authorized to use. Record the starting conditions, your actions and the result, then compare that result with the task. Skipping and returning is an optional pacing choice. A sample illustrates the format and does not reveal the specific tasks on your exam.
Sources used: Performance-Based Questions Overview | CompTIA IT Certifications — Simulations and tips sections; Performance-Based Questions FAQs | CompTIA Blog — December 18, 2024 FAQ; Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections
Authentication, authorization, and least privilege
Authentication verifies identity; authorization decides what an authenticated identity may access; least privilege limits that access to the minimum needed for assigned tasks.
These three terms are distinct and the objectives test them together in Domain 4, which includes provisioning, permission assignments, identity proofing, federation, and access control models. NIST's glossary defines authentication as verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources. Authorization is a separate decision: the access privileges granted, or the act of granting them. Least privilege is the principle of restricting privileges to the minimum necessary to accomplish assigned tasks.
A successful sign-in verifies a claimed identity; it does not establish permission for every resource or action. In the example below, compare the requested resource, action and duration with the approval that the prompt supplies.
Practice exercise
Original exercise: Dana, a helpdesk technician, has authenticated successfully. In this fictional organization, the data owner has approved view-only access to one inventory report for two days, and an administrator implements approved permissions. No other access is needed. Which grant fits the approved task? A) Read access to that report, expiring in two days. B) Permanent read access to all HR files. C) Permanent edit and administrator rights to the inventory database. Which part establishes identity, and which part determines permissions?
Show answer
A. Authentication is Dana signing in to the console; authorization is the approved decision about which access to grant.
A fits the approved resource, read action and two-day duration. Authentication verifies Dana's claimed identity. Authorization is the separate access decision, and least privilege limits access to what the assigned task needs. B adds unrelated resources and duration; C adds unnecessary edit and administrator privileges. The owner approval and administrator role are stated fictional premises, not inferred powers or CompTIA policy.
Sources used: authentication - Glossary | CSRC — Definitions; authorization - Glossary | CSRC — Definitions; least privilege - Glossary | CSRC — Definitions; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0
Signing and encryption serve different purposes
A digital signature can support origin authentication, integrity and non-repudiation. Encryption transforms readable data into ciphertext to protect confidentiality.
NIST describes digital signatures as providing these assurances when properly implemented. Its glossary explains that a private key signs data and the corresponding public key verifies the signature. A digital signature by itself does not hide the message.
Encryption transforms plaintext into ciphertext using a cryptographic process. Decryption restores the original form. When studying a scenario, identify the required protection and compare the options against that requirement; signing and concealing content are different services. This comparison does not specify an implementation or guarantee that a named technology meets every requirement.
Sources used: CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0; digital signature - Glossary | CSRC — Definitions:; encryption - Glossary | CSRC — Definitions:
Retake policy and scheduling basics
After a first failed attempt there is no required wait before a second. Before the third and later attempts, wait at least 14 calendar days from your last attempt.
The retake policy requires payment for each attempt. Some CompTIA bundles include a retake under their own terms, so check your voucher coverage.
Once you pass and achieve the certification, retaking the same code requires CompTIA's prior consent. Use legitimate preparation materials: CompTIA warns that unauthorized exam content can lead to certification revocation and suspension.
Sources used: CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods and payment; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0; Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections
A preparation checklist
Work through the objectives document domain by domain, drill concept pairs with complete exercises, practise in legitimate labs, and confirm booking details on CompTIA's own pages.
Read the objectives, identify gaps, learn the relevant concepts, then practise applying them in legitimate tasks. Review mistakes by objective and by the assumption or constraint you missed.
- Cover the complete SY0-701 objectives and revisit weak areas across all five domains.
- Explain the access-control exercise and the different purposes of signing and encryption.
- Practise simulation tasks and learn the skip, return and reset controls.
- Use timed mixed practice to develop pacing and identify gaps.
- Confirm your exam code, current regional price, delivery and identification requirements before booking.
Sources used: Security+ (Plus) Certification | CompTIA — Exam details and objectives summary sections; Performance-Based Questions Overview | CompTIA IT Certifications — Simulations and tips sections; Performance-Based Questions FAQs | CompTIA Blog — December 18, 2024 FAQ; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0 — About the Exam; Test Details; Domains 1.0–5.0; least privilege - Glossary | CSRC — Definitions; authentication - Glossary | CSRC — Definitions; authorization - Glossary | CSRC — Definitions; digital signature - Glossary | CSRC — Definitions:; encryption - Glossary | CSRC — Definitions:
Sources used
Exam facts verified September 14, 2026 against CompTIA's official objectives document and certification page:
- Security+ (Plus) Certification | CompTIA
- least privilege - Glossary | CSRC
- authentication - Glossary | CSRC
- authorization - Glossary | CSRC
- Performance-Based Questions Overview | CompTIA IT Certifications
- Performance-Based Questions FAQs | CompTIA Blog
- CompTIA Certification Retake Policy | CompTIA IT Certifications
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 5.0
- digital signature - Glossary | CSRC
- encryption - Glossary | CSRC