CompTIA Security+ · SY0-701 (V7)
Researching the CompTIA Security+ exam objectives comes with two traps. The first: the official list is a PDF blueprint that names every topic and explains none of them. The second is worse: much of what ranks for this search — including some official pages — still describes retired exam versions, with six-domain structures and weightings that stopped being true years ago.
This guide solves both. Below is the current SY0-701 blueprint (objectives document version 5.0, verified July 2026): all five domains and all 28 sub-objectives explained in plain English, the correct weightings, how each area tends to be tested, a way to spot outdated objectives elsewhere, and a study plan built from the weights. We update this page as CompTIA revises the exam.
| Exam code | SY0-701 (V7) |
| Launched | November 7, 2023 |
| Previous version | SY0-601 — retired July 31, 2024 |
| Questions | Up to 90 |
| Time | 90 minutes |
| Question types | Multiple-choice + performance-based (PBQs) |
| Passing score | 750 (scale of 100–900) |
| Price | $425 (US) |
| Renewal | 3 years, via CompTIA CE program |
| Objectives document | Version 5.0 |
What about SY0-801? Training providers have floated a successor arriving as early as late 2026, but CompTIA has confirmed nothing as of this writing. If you're studying now, don't wait: version transitions historically include a long overlap period where both exams are offered, and an SY0-701 certification stays valid for three years regardless of what launches after it. We'll update this page the moment CompTIA announces anything.
The blueprint spreads the exam across five domains — and the weighting is the first study decision made for you: Security Operations alone is 28% of the exam.
Two things stand out about this blueprint's shape. First, it's operations-first: the 2023 revision deliberately shifted weight toward doing security work — monitoring, incident response, identity management — and away from theory. Second, the governance domain grew to a full fifth of the exam, which surprises candidates who expected GRC to be an afterthought. Unlike a specialist exam that concentrates 40% in one place, Security+ makes you respectable everywhere — but the weights still tell you where to start.
The foundation domain: the smallest slice, but its vocabulary shows up inside every other domain's questions.
1.1Compare and contrast various types of security controls. The classic control matrix: categories (technical, managerial, operational, physical) crossed with types (preventive, deterrent, detective, corrective, compensating, directive). Expect compare-contrast questions that hand you a control and ask what kind it is — easy points if you've drilled the matrix.
1.2Summarize fundamental security concepts. CIA triad, non-repudiation, AAA, gap analysis, physical security — and the modern centerpiece: zero trust architecture, including control-plane concepts like the policy engine and policy administrator. Zero trust is new emphasis in SY0-701 and a reliable question source.
1.3Explain the importance of change management processes and the impact to security. Business processes (approvals, ownership, stakeholders), technical implications (allow lists, downtime, dependencies), and documentation. Scenario questions here describe a change gone wrong and ask what step was skipped.
1.4Explain the importance of using appropriate cryptographic solutions. The domain's monster objective: PKI, encryption levels (full-disk to record-level), symmetric vs. asymmetric, key exchange, digital signatures, certificates, plus newer terms like blockchain and salting. Crypto vocabulary pays compound interest — it reappears in architecture and operations questions.
The know-your-enemy domain, and the exam's second-heaviest. Questions here are recognition-driven: identify the actor, the vector, the vulnerability, or the indicator.
2.1Compare and contrast common threat actors and motivations. Nation-states, unskilled attackers, hacktivists, insiders, organized crime, shadow IT — and their motivations, from espionage to disruption. Know the attribute axes: internal/external, resources, sophistication.
2.2Explain common threat vectors and attack surfaces. Message-based, image-based, file-based, voice, removable media, unsecure networks, open ports, supply chain, and the full human-vector catalog: phishing, smishing, vishing, pretexting, business email compromise, watering holes.
2.3Explain various types of vulnerabilities. Application (memory injection, buffer overflow, race conditions), OS, web (SQLi, XSS), hardware (firmware, end-of-life), virtualization (VM escape), cloud-specific, supply chain, misconfiguration, mobile, and zero-day.
2.4Given a scenario, analyze indicators of malicious activity. The domain's scenario workhorse: recognize malware types (ransomware, trojan, worm, spyware, rootkit), physical and network attacks (DDoS, DNS attacks, on-path, credential replay), application attacks (injection, privilege escalation, directory traversal), and cryptographic attacks from described evidence.
2.5Explain the purpose of mitigation techniques used to secure the enterprise. Segmentation, access control, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, and hardening. Pairs naturally with 2.4: spot the attack, choose the mitigation.
The design domain: where you're asked to think like the person who builds the environment, not just defends it.
3.1Compare and contrast security implications of different architecture models. Cloud (including shared responsibility and hybrid), infrastructure as code, serverless, microservices, network infrastructure (air-gapped, logical segmentation, SDN), on-premises, centralized vs. decentralized, containerization, virtualization, IoT, ICS/SCADA, RTOS, and embedded systems — each with its considerations: availability, resilience, cost, patch availability, risk transference.
3.2Given a scenario, apply security principles to secure enterprise infrastructure. Placement decisions: security zones, attack surface, device attributes (active/passive, inline vs. tap), firewall types, IDS/IPS placement, jump servers, proxies, load balancers, VPNs, SD-WAN, SASE. This is prime PBQ material — expect drag-and-drop placement of devices into a topology.
3.3Compare and contrast concepts and strategies to protect data. Data types (regulated, trade secret, IP), classifications (public through critical), states (at rest, in transit, in use), and methods: encryption, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions, plus geographic considerations like data sovereignty.
3.4Explain the importance of resilience and recovery in security architecture. High availability (load balancing, clustering), site considerations (hot/warm/cold), platform diversity, multi-cloud, RTO/RPO thinking via testing (tabletop, failover, simulation), backups (onsite/offsite, frequency, encryption, snapshots, journaling), and power (UPS, generators).
Nine sub-objectives — nearly a third of the blueprint and the exam. This is the daily-work domain, and it's where the "Given a scenario…" objectives (and therefore PBQs) concentrate: four of the nine are scenario-framed, more than the rest of the blueprint combined. If your practice time has to be rationed anywhere, don't ration it here.
4.1Given a scenario, apply common security techniques to computing resources. Secure baselines (establish, deploy, maintain), hardening targets from mobile devices to servers to ICS, wireless security (WPA3, RADIUS, site surveys), mobile solutions (MDM, BYOD/COPE/CYOD), application security, and sandboxing.
4.2Explain the security implications of proper hardware, software, and data asset management. Acquisition, assignment and accounting (ownership, classification, inventory), and disposal — sanitization, destruction, certification, and data-retention obligations.
4.3Explain various activities associated with vulnerability management. Identification methods (scans, application analysis, threat feeds, penetration testing, bug bounties), analysis (CVSS, CVE, false positives, prioritization), response (patching, insurance, segmentation, compensating controls), and validation through rescanning, auditing, and reporting.
4.4Explain security alerting and monitoring concepts and tools. Monitoring computing resources, alert response and remediation, and the tool stack: SIEM, SCAP, antivirus, DLP, SNMP traps, NetFlow, and vulnerability scanners. Expect tool-to-purpose matching questions.
4.5Given a scenario, modify enterprise capabilities to enhance security. The configuration objective: firewall rules and screened subnets, IDS/IPS signatures, web filtering, operating system security via Group Policy and SELinux, secure protocol selection, DNS filtering, email security (DMARC, DKIM, SPF), file integrity monitoring, NAC, and EDR/XDR. Another strong PBQ candidate — ordering firewall rules is a classic.
4.6Given a scenario, implement and maintain identity and access management. Provisioning and de-provisioning, federation and SSO (SAML, OAuth), interoperability, MFA (factors and implementations), password best practices and managers, and privileged access management.
4.7Explain the importance of automation and orchestration related to secure operations. Use cases (user provisioning, ticket creation, guard rails, security-group management), benefits (efficiency, enforced baselines, faster reaction), and honest costs: complexity, technical debt, single points of failure.
4.8Explain appropriate incident response activities. The lifecycle — preparation, detection, analysis, containment, eradication, recovery, lessons learned — plus training, tabletop exercises, root cause analysis, threat hunting, and digital forensics fundamentals (legal hold, chain of custody, acquisition, preservation).
4.9Given a scenario, use data sources to support an investigation. Log data (firewall, application, endpoint, OS-specific, IPS/IDS, network, metadata) and other sources: vulnerability scans, automated reports, dashboards, packet captures. Expect a PBQ-style "read these logs, identify what happened."
The GRC domain — and at a full fifth of the exam, it decides passes. SY0-701 expanded this material substantially; candidates from technical backgrounds should not leave it for the last minute.
5.1Summarize elements of effective security governance. Guidelines, policies (AUP, information security, business continuity, incident response), standards (password, access control, encryption), procedures (change management, onboarding/offboarding), external considerations (regulatory, legal, industry), monitoring and revision, governance structures (boards, committees), and roles (owners, controllers, processors, custodians).
5.2Explain elements of the risk management process. Risk identification, assessment types (ad hoc, recurring, one-time, continuous), analysis (qualitative and quantitative: SLE, ALE, ARO), registers, tolerance and appetite, management strategies (transfer, accept, avoid, mitigate), and business impact analysis (RTO, RPO, MTTR, MTBF).
5.3Explain the processes associated with third-party risk assessment and management. Vendor assessment (due diligence, right-to-audit, supply chain analysis), selection, agreement types (SLA, MOU, MSA, NDA and more), vendor monitoring, and questionnaires.
5.4Summarize elements of effective security compliance. Reporting (internal/external), consequences of non-compliance (fines, sanctions, reputational damage, contractual impacts), monitoring and attestation, and privacy obligations — legal implications, data subjects, controller vs. processor, right to be forgotten.
5.5Explain types and purposes of audits and assessments. Attestation, internal (compliance, audit committee, self-assessment) vs. external (regulatory, examinations, independent assessments), and penetration testing concepts: offensive/defensive, known/partially known/unknown environments, reconnaissance.
5.6Given a scenario, implement security awareness practices. Phishing campaigns and recognition, anomalous-behavior recognition, user guidance and training (policies, situational awareness, insider threat, password management, social engineering), reporting and monitoring, and program execution.
Because so much stale content ranks for this keyword — including retired official PDFs — use this quick test on anything you're studying from:
| Signal | What you're actually reading |
|---|---|
| Six domains, incl. "Technologies and Tools" or "Cryptography and PKI" as domains | SY0-501 (retired 2021) |
| Five domains named "Attacks/Threats," "Architecture/Design," "Implementation," "Operations/IR," "GRC" with weights 24/21/25/16/14 | SY0-601 (retired July 2024) |
| Five domains with weights 12/22/18/28/20 and "Security Program Management and Oversight" as Domain 5 | SY0-701 — current |
If a study resource can't tell you which exam version it targets, that's your answer about its quality. (It's also why we print the objectives document version — 5.0 — at the top of this page.)
The weights above are a ready-made study order. Here's the sequence, with a matching practice test for every domain:
Nine objectives, the most scenario-based material, and the highest PBQ density. Drill it with the Security Operations practice test and the Security+ PBQ practice page until log-reading and rule-ordering feel routine.
Recognition material rewards repetition — the Threats & Vulnerabilities practice test plus flashcards for attack types.
GRC vocabulary (risk formulas, agreement types, audit types) is memorization-friendly — the Security Program Management practice test tells you quickly which terms haven't stuck.
Use the Security Architecture and General Security Concepts tests, keeping the cheat sheet beside you for the control matrix and crypto vocabulary.
Rate yourself 1–3 against each of the 28 objectives above; drill the 1s. Not sure where you stand? The 10-minute quick-start test gives you a baseline today. Finish with full-length timed practice — 90 questions in 90 minutes is a stamina exam.
Download the official document from the CompTIA Security+ page — always the primary source, and this article annotates rather than replaces it. But be careful where else you get it: third-party sites still rank while hosting the retired SY0-601 version, and a static PDF can't warn you when it goes stale. This page names its document version, tracks the SY0-801 situation, and gets updated as CompTIA changes anything.
One more thing worth knowing: the objectives document itself carries CompTIA's authorized-materials policy — candidates who prepare with unauthorized "braindump" content have their certifications revoked and are suspended from future testing. If shortcut sites are tempting you, read our honest breakdown of why Security+ exam dumps are a bad bet first.
General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%). Security Operations is the heavyweight, and the governance domain is a full fifth of the exam.
The SY0-701 blueprint (objectives document version 5.0) contains 28 sub-objectives across five domains: four in General Security Concepts, five in Threats and Vulnerabilities, four in Security Architecture, nine in Security Operations, and six in Program Management and Oversight.
Yes. SY0-701 (also labeled V7) is the only active version as of July 2026 — SY0-601 retired on July 31, 2024. A successor (SY0-801) has been rumored by training providers for late 2026, but CompTIA has not confirmed it.
From CompTIA's official Security+ certification page, free of charge. Avoid third-party PDF copies: several that rank in search results still host the retired SY0-601 objectives, and there's no way to tell a stale copy from a current one at a glance.
Yes. The exam mixes multiple-choice with PBQs — simulated tasks like ordering firewall rules, placing devices in a network topology, or analyzing logs. The blueprint signals where they live: the "Given a scenario" objectives, which cluster heavily in the Security Operations domain.
Take SY0-701 now. The successor is unconfirmed, CompTIA historically runs long overlap periods when versions change, and a certification earned today stays valid for three years either way. Waiting for an unannounced exam mostly means studying twice.
The objectives are the exam: all 28 sub-objectives above, weighted exactly as shown, from a blueprint you've now read in plain English rather than PDF shorthand. Study in weight order — Operations first and deepest — self-score against the list, and check anything else you study against the version table so stale content doesn't cost you points. When you're ready to test yourself, start with the free Security+ practice tests, and if the exam itself is still an open question, the complete SY0-701 guide covers cost, difficulty, and career value in depth. Adding AI security to your roadmap next? The same blueprint-first approach works there too — see our SecAI+ exam objectives breakdown.
