Stick to one main course.
Candidates describe getting overwhelmed when combining several complete courses. Finish one, then add questions or a targeted explanation where you need it.
CompTIA Security+ Exam Guide
Validates knowledge of security threats, protective controls, risk management and incident response across modern IT environments.
Security+ tests whether you can apply core security concepts, interpret common problems and choose appropriate controls. Learn the objectives, practise hands-on tasks and use timed exams to work on gaps and pacing.
Understand the exam
Syllabus
1.0General security concepts12%
- 1.1Compare and contrast various types of security controls.
- 1.2Summarize fundamental security concepts.
- 1.3Explain the importance of change management processes and the impact to security.
- 1.4Explain the importance of using appropriate cryptographic solutions.
Example scenario: A downloaded file may have changed in transit. What would let you check its integrity?
2.0Threats, vulnerabilities, and mitigations22%
- 2.1Compare and contrast common threat actors and motivations.
- 2.2Explain common threat vectors and attack surfaces.
- 2.3Explain various types of vulnerabilities.
- 2.4Analyze indicators of malicious activity.Scenario
- 2.5Explain the purpose of mitigation techniques used to secure the enterprise.
Example scenario: Employees receive an unexpected sign-in link by email. What would you inspect before deciding how to respond?
3.0Security architecture18%
- 3.1Compare and contrast security implications of different architecture models.
- 3.2Apply security principles to secure enterprise infrastructure.Scenario
- 3.3Compare and contrast concepts and strategies to protect data.
- 3.4Explain the importance of resilience and recovery in security architecture.
Example scenario: A service must recover quickly after an outage. How would its recovery-time and recovery-point targets affect the backup design?
4.0Security operations28%
- 4.1Apply common security techniques to computing resources.Scenario
- 4.2Explain the security implications of proper hardware, software, and data asset management.
- 4.3Explain various activities associated with vulnerability management.
- 4.4Explain security alerting and monitoring concepts and tools.
- 4.5Modify enterprise capabilities to enhance security.Scenario
- 4.6Implement and maintain identity and access management.Scenario
- 4.7Explain the importance of automation and orchestration related to secure operations.
- 4.8Explain appropriate incident response activities.
- 4.9Use data sources to support an investigation.Scenario
Example scenario: Repeated failed logins are followed by a success from an unusual location. Which logs and account controls would you check?
5.0Security program management and oversight20%
- 5.1Summarize elements of effective security governance.
- 5.2Explain elements of the risk management process.
- 5.3Explain the processes associated with third-party risk assessment and management.
- 5.4Summarize elements of effective security compliance.
- 5.5Explain types and purposes of audits and assessments.
- 5.6Implement security awareness practices.Scenario
Example scenario: A supplier will handle customer records. What security requirements and checks belong in the agreement?
SY0-801 launches in English on November 17, 2026. It adds AI-related threats and gives less weight to security program management.
1.0General Security Concepts16%
- 1.1Explain security concepts and controls.
- 1.2Demonstrate the impact of change management processes on security.Scenario
- 1.3Explain the importance of using appropriate cryptographic solutions.
2.0Threats, Vulnerabilities, and Attacks24%
- 2.1Explain characteristics of threats and vulnerabilities.
- 2.2Describe common threat actors and motivations.
- 2.3Describe threat vectors and sources.
- 2.4Explain types of vulnerabilities and attack surfaces.
- 2.5Analyze indicators of malicious activity.Scenario
- 2.6Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage.
3.0Security Architecture19%
- 3.1Compare and contrast security implications of different architecture models.
- 3.2Manage the security architecture to best protect the infrastructure.Scenario
- 3.3Summarize concepts and strategies used to protect data.
- 3.4Explain the importance of resilience and recovery in security architecture.
4.0Security Operations27%
- 4.1Apply mitigating controls, techniques, and solutions to secure the environment.Scenario
- 4.2Explain the security implications of proper hardware, software, and data asset management.
- 4.3Perform tasks associated with vulnerability management.Scenario
- 4.4Explain security alerting and monitoring concepts and tools.
- 4.5Apply concepts related to identity and access management.Scenario
- 4.6Apply automation and orchestration solutions to secure operations.Scenario
- 4.7Summarize concepts associated with incident response activities.
- 4.8Use data, artifacts and sources to support a security investigation.Scenario
5.0Security Program Management and Oversight14%
- 5.1Explain the importance of governance, risk, and compliance artifacts.
- 5.2Explain the impact of risk management processes on the security of the organization.
- 5.3Explain the assessment and management processes associated with third-party risk.
- 5.4Summarize elements of effective security compliance.
- 5.5Explain concepts associated with audit and assessment activities.
- 5.6Apply security awareness concepts to improve organizational security.Scenario
Format
- Questions
- Up to 90
- Duration
- 90 min
- Passing score
- 750 / 900
- Delivery
- Test centre or online
- Languages
- English, Japanese, Portuguese, Spanish, Thai
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A finance team needs two people to approve each payment so that no single user can complete one alone. Which principle is this?
Show answer
A. Separation of duties splits a sensitive task between people. Least privilege limits what each person can do but does not require a second approver.
Solve a task in a simulation or virtual environment, such as ordering firewall rules or configuring a device.
CertUp example
Order these firewall rules so web traffic is allowed, administrators can use SSH from 10.0.5.0/24, and everything else is blocked.
Show answer
Allow TCP 443 from any and Allow TCP 22 from 10.0.5.0/24 (in either order), then Deny any to any last. Rules are checked from the top, so the final deny only catches traffic nothing else allowed.
Make a study plan
Start with the objectives and a short diagnostic quiz. Choose one main course, then spend the remaining time applying the concepts and reviewing mistakes.
Plan for 40–100 hours. Plan for the low end if you already work in IT security or hold Network+; plan for the high end if networking and operating-system concepts are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.48 h
- 4Practice with mock examsTake timed practice tests and review every mistake.24 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
Learn the core concepts
Professor Messer is a good free starting point. Use a paid course if you prefer longer explanations, or CertMaster if your employer pays for official training.
Best free courseSecurity+ SY0-701 Video Course
Best for complete beginnersTOTAL: CompTIA Security+ Course + Practice Exam SY0-701Best paid video courseSecurity+ Complete Course & Practice ExamBuild a practical example. Try an MFA setup, read a sample event log or sketch a segmented network as you study the relevant topic.
Practice with mock exams
Use fresh questions to find gaps. Review why each option is right or wrong, then practise PBQs and take full timed exams.
OfficialSecurity+ (V7) Practice Test
FreeSecurity+ SY0-701 Practice TestsMost realisticProfessor Messer Security+ SY0-701 Practice ExamsAre you ready?
- You can explain the concepts in each objective without relying on an answer key.
- You can work through unfamiliar scenarios and explain your choice.
- You can complete a timed test while leaving time for review.
Prepare for exam day
Buy a voucher and schedule with Pearson VUE. The voucher is valid for 12 months, subject to the exam retirement date.
At a test centre
Testing from home
- Bring the identification listed in your appointment confirmation, with the same name as your booking.
- Arrive at the time specified in your confirmation and store personal belongings as instructed.
- Use the exam tutorial before starting the timed questions.
- Run the OnVUE system test on the computer and connection you will use.
- Prepare a private room and clear your desk.
- Have your accepted ID ready and begin check-in at the time stated in your confirmation.
Advice from exam takers
Practise PBQs as well as multiple choice.
Pass reports often describe PBQs as the most demanding part. Practise interpreting the task and managing your time, rather than only recalling definitions.