CompTIA · free study guide

CompTIA Security+ study guide

CompTIA Security+

Free CompTIA Security+ study guide and exam blueprint. 90 questions in 90 minutes. Written from CompTIA's SY0-701 objectives v5.0, last checked 20 July 2026. Domain weightings, glossary, and practice questions with worked explanations.

Written from CompTIA's SY0-701 objectives v5.0. Last checked against that document on 20 July 2026.

90 questions 90 minutes 5 domains

Orientation

The current version.

The most expensive mistake in Security+ prep is studying the wrong version. Candidates fail not because they studied too little but because they studied SY0-601, retired in July 2024. Everything here is built to the current exam, SY0-701, objectives version 5.0.

Is SY0-701 still current?

Yes. As of July 2026, SY0-701 is the only active version. A successor, SY0-801, has been floated by training providers for late 2026, but CompTIA has not confirmed it, and no official objectives exist. When 801 does launch, 701 stays available for roughly six more months, and any Security+ you earn on 701 is valid for three years regardless. Ignore third-party pages claiming an "April 2026 objectives refresh": CompTIA's own objectives document is still version 5.0, unchanged since 2023.

What you are walking into

A maximum of 90 questions in 90 minutes, so roughly one minute each. Two question types: standard multiple-choice, and performance-based questions (PBQs) that put you in a simulated environment to do a task, configure a firewall rule, match attacks to indicators, order incident-response steps. PBQs usually come first and are worth more, so a common tactic is to flag them and return after clearing the faster multiple-choice.

Scoring is scaled from 100 to 900, and you need 750 to pass. CompTIA does not publish this as a percentage, so ignore anyone who tells you "you need 83%." The scaled score weights harder questions more.

CompTIA recommends about two years of IT administration experience with a security focus, but there is no formal prerequisite. Anyone can sit it.

The nature of the exam

Security+ is dense with terminology, and much of it tests distinctions: which category a control falls in, which attack matches an indicator, symmetric versus asymmetric, MAC versus DAC versus RBAC. The objectives are long lists of specific technologies, and the exam expects you to recognize and separate them. This is not a conceptual essay exam; it is recognition and applied recall at speed. The acronym list alone runs to hundreds of entries, and the exam assumes you know them.

The order that works

Blueprint first. Five domains, and the weighting is lopsided: Security Operations is 28%, more than double General Security Concepts at 12%.
Security Operations and Threats carry half the exam (28% + 22% = 50%). If your study time is scarce, it goes here first.
Drill the distinctions. Control categories and types, attack-to-indicator matching, access control models, cryptographic concepts. These are where points are won and lost.
Learn the acronyms. The exam is full of them, and a question you cannot decode is a question you cannot answer.
Practice performance-based questions. They are worth more and unfamiliar; do not let them be the first ones you see under time pressure.

Your study plan

Exam Objectives

What the exam is made of.

Five domains, published weights. Security Operations dominates at more than a quarter of the exam, and the two operational domains together are half of it.

12%General Concepts22%Threats18%Architecture28%Operations20%Program Mgmt

Five domains · 28 objectives max 90 questions

Security Operations is 28%, the single largest domain, and Threats, Vulnerabilities, and Mitigations is 22%. Together they are half the exam. General Security Concepts, despite being the foundation everyone starts with, is the smallest at 12%. Study time should follow the weights, not the chapter order of a textbook.

The five domains

Domain	Weight	What it covers
1.0 General Security Concepts	12%	Control categories and types, CIA and AAA, zero trust, physical security, change management, cryptographic solutions. Four objectives.
2.0 Threats, Vulnerabilities, and Mitigations	22%	Threat actors and motivations, threat vectors, vulnerability types, indicators of malicious activity, mitigation techniques. Five objectives.
3.0 Security Architecture	18%	Architecture models, securing infrastructure, protecting data, resilience and recovery. Four objectives.
4.0 Security Operations	28%	Hardening, asset management, vulnerability management, monitoring, enterprise security capabilities, identity and access management, automation, incident response, investigation. Nine objectives.
5.0 Security Program Management and Oversight	20%	Governance, risk management, third-party risk, compliance, audits and assessments, security awareness. Six objectives.

The format

Questions	Maximum of 90.
Time	90 minutes. About one minute per question.
Types	Multiple-choice and performance-based (PBQ) simulations.
Pass mark	750 on a scaled 100-900 range. No published percentage.
Experience	About two years in IT with a security focus recommended, but not required.
Delivery	Pearson VUE test center or online proctored.
Validity	Three years; renew with continuing education units (CEUs).

What this practice tool reproduces, and what it cannot

The mock matches the blueprint weighting, the 90-question length, and the 90-minute clock, and it reproduces multiple-choice items. It cannot reproduce performance-based questions, which need a simulated environment to configure or drag-and-match. Expect several PBQs on the real exam; the knowledge they test, control types, attack indicators, incident-response order, is covered here in multiple-choice form.

What this exam is not

Not SY0-601. The prior version retired July 2024. Any material referencing six domains or an "Implementation" domain is outdated; SY0-701 has five domains.
Not vendor-specific. Security+ is vendor-neutral. It tests concepts and categories, not one firewall vendor's menus.
Not a definitions quiz alone. Much of it is applied: given a scenario or an indicator, identify the attack, the control, or the correct next step.

Domain 1 12% · 4 objectives

General security concepts.

The smallest domain at 12%, but the foundation the other four build on. It defines the vocabulary, control categories, the CIA triad, zero trust, and cryptography, that every other domain assumes you already know.

1.1 Security controls

Controls are classified two ways at once, and the exam tests both axes.

By category (what kind)	By type (what it does)
Technical (implemented in tech: firewalls, encryption)	Preventive (stops it: a lock, a firewall rule)
Managerial (policies, procedures, risk assessments)	Deterrent (discourages: a warning sign, a guard)
Operational (run by people: guards, training, awareness)	Detective (finds it: logs, IDS, cameras)
Physical (real-world: fences, bollards, locks)	Corrective (fixes it after: backups, patching)
	Compensating (an alternative when the primary is not possible)
	Directive (instructs: an acceptable use policy)

A camera is physical by category and can be both deterrent (visible, discourages) and detective (records, finds). The exam loves questions that ask you to place a control on both axes.

1.2 Fundamental concepts

CIA triad: Confidentiality (only the right people see it), Integrity (it is not altered), Availability (it is there when needed). The three goals security exists to serve.
Non-repudiation: you cannot deny you did it. Digital signatures provide this.
AAA: Authentication (who are you), Authorization (what may you do), Accounting (what did you do). Applies to people and to systems.
Zero Trust: never trust, always verify. Split into a Control Plane (adaptive identity, policy engine, policy administrator, policy-driven access control) and a Data Plane (the policy enforcement point, subject/system, implicit trust zones). Access is decided per request, not granted once at the perimeter.
Deception technology: honeypot (a decoy system), honeynet (a decoy network), honeyfile (a bait file), honeytoken (bait data). They detect and study attackers.
Gap analysis: compare current security posture against the desired state to find what is missing.

1.3 Change management

Security depends on controlled change: an approval process, clear ownership, identified stakeholders, impact analysis, test results, a backout plan, and a maintenance window.
Technical implications include allow/deny lists, downtime, service and application restarts, legacy applications, and dependencies.
Every change updates documentation (diagrams, policies) and is tracked with version control. Unmanaged change is one of the most common sources of vulnerability.

1.4 Cryptographic solutions

Symmetric encryption uses one shared key, fast, but key exchange is the hard part. Asymmetric uses a public/private key pair, solving key exchange but slower. Real systems combine them.
PKI: public and private keys, certificate authorities, CRLs and OCSP for revocation, CSRs to request certificates, root of trust, wildcard and self-signed certificates.
Hashing proves integrity (a one-way fingerprint); salting adds randomness so identical inputs hash differently; key stretching makes weak keys harder to brute-force.
Digital signatures combine hashing and asymmetric keys to give integrity, authentication, and non-repudiation.
Obfuscation: steganography (hiding data in other data), tokenization (swapping data for a token), data masking (hiding part of a value).
Hardware roots of trust: TPM (on the motherboard), HSM (dedicated key hardware), secure enclave, key management system.

Domain 2 22% · 5 objectives

Threats, vulnerabilities, and mitigations.

The second-largest domain at 22%. This is the attacker's half of the exam: who attacks, how they get in, what weaknesses they exploit, how you spot them, and how you stop them. Much of it is matching, actor to motivation, attack to indicator.

2.1 Threat actors and motivations

Actors: nation-state (highly resourced, patient, espionage/war), unskilled attacker (uses others' tools, the "script kiddie"), hacktivist (political/philosophical), insider threat (already inside), organized crime (financial), shadow IT (unsanctioned internal tech).
Attributes: internal vs external, resources/funding, level of sophistication. A nation-state and an unskilled attacker sit at opposite ends of all three.
Motivations: data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political belief, ethical, revenge, chaos, war. The exam pairs an actor with a plausible motivation.

2.2 Threat vectors and attack surfaces

Message-based: email, SMS, instant messaging; also image-based, file-based, voice call, removable device.
Technical surfaces: vulnerable/unsupported software, unsecure networks, open service ports, default credentials, supply chain (MSPs, vendors, suppliers).
Human/social engineering: phishing (email), vishing (voice), smishing (SMS), impersonation, business email compromise, pretexting, watering hole, brand impersonation, typosquatting, misinformation/disinformation. Know which channel each uses, that is the common question.

2.3 Vulnerability types

Application: memory injection, buffer overflow, race conditions (TOC/TOU), malicious update.
Web: SQL injection (SQLi), cross-site scripting (XSS).
Hardware: firmware, end-of-life, legacy. Virtualization: VM escape, resource reuse.
Other: cloud-specific, supply chain, cryptographic, misconfiguration, mobile (side loading, jailbreaking), and zero-day (no patch exists yet).

2.4 Indicators of malicious activity

This objective is heavy on matching an attack to what you would observe. Know the malware family, the attack, and the tell-tale indicator.

Malware: ransomware (encrypts for payment), trojan (disguised), worm (self-spreading), spyware, rootkit (hides deep), logic bomb (triggers on a condition), keylogger, virus, bloatware.
Network/application attacks: DDoS (amplified, reflected), DNS attacks, on-path (formerly man-in-the-middle), credential replay, injection, privilege escalation, directory traversal, forgery.
Cryptographic attacks: downgrade, collision, birthday. Password attacks: spraying, brute force.
Indicators: account lockout, concurrent session usage, impossible travel (logins from two distant places too close in time), resource consumption or inaccessibility, out-of-cycle logging, missing logs, blocked content.

2.5 Mitigation techniques

Segmentation (limit blast radius), access control (ACLs, permissions), isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning.
Hardening: endpoint protection, host-based firewall, HIPS, disabling unused ports/protocols, changing default passwords, removing unnecessary software, application allow lists.
The exam pattern: given an attack or weakness, pick the mitigation that addresses it most directly.

Domain 3 18% · 4 objectives

Security architecture.

18% of the exam. How you design and structure systems securely: the trade-offs of different architectures, how you secure infrastructure, how you protect data in its various states, and how you build in resilience so you can recover.

3.1 Architecture models

Cloud: the responsibility matrix (who secures what, you vs the provider), hybrid considerations, third-party vendors. Understand where the provider's duty ends and yours begins for IaaS, PaaS, and SaaS.
Modern models: infrastructure as code (IaC), serverless, microservices, containerization, virtualization, software-defined networking (SDN).
Specialized: IoT, ICS/SCADA (industrial control), RTOS, embedded systems, on-premises, centralized vs decentralized.
Trade-off considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment and recovery, patch availability, and the risk of an inability to patch (a defining problem for ICS and embedded systems).

3.2 Securing infrastructure

Placement and design: device placement, security zones, attack surface, connectivity, failure modes (fail-open lets traffic through, fail-closed blocks it).
Appliances: jump server, proxy, IPS/IDS, load balancer, sensors. Firewall types: WAF (web apps), UTM (all-in-one), NGFW (application-aware), Layer 4 vs Layer 7.
Port security: 802.1X, EAP. Secure access: VPN, tunneling (TLS, IPSec), SD-WAN, SASE.
Active vs passive, inline vs tap/monitor: whether a device sits in the traffic path (and can block) or observes a copy (and can only alert).

3.3 Protecting data

Data states: at rest (stored), in transit (moving), in use (being processed). Each needs different protection; encryption at rest and in transit, careful handling in use.
Classifications: public, private, sensitive, confidential, restricted, critical. Types: regulated, trade secret, intellectual property, financial, legal, human- and non-human-readable.
Methods: encryption, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions, geographic restrictions.
Data sovereignty and geolocation: where data physically lives can decide which laws apply to it.

3.4 Resilience and recovery

High availability: load balancing (spread traffic across active servers) vs clustering (servers act as one, with failover).
Recovery sites: hot (ready now, expensive), warm (partial, some setup), cold (space only, cheap but slow). Geographic dispersion protects against regional disaster.
Testing: tabletop exercises (talk it through), failover, simulation, parallel processing. Testing is what turns a plan into a capability.
Backups: onsite/offsite, frequency, encryption, snapshots, replication, journaling. Power: UPS (bridges short outages), generators (sustain long ones).

Domain 4 28% · 9 objectives

Security operations.

The largest domain, more than a quarter of the exam, with nine objectives. This is security as a running practice: hardening systems, managing assets and vulnerabilities, monitoring, controlling identity and access, automating, and responding to incidents. If your study time is limited, it starts here.

4.1 Secure computing techniques

Secure baselines: establish, deploy, maintain. Hardening targets: mobile devices, workstations, servers, switches, routers, cloud, ICS/SCADA, embedded, RTOS, IoT.
Mobile deployment: BYOD (personal device), COPE (company-owned, personal use allowed), CYOD (choose from approved). Managed by MDM.
Wireless security: WPA3 (current standard), RADIUS/AAA, cryptographic and authentication protocols. Application security: input validation, secure cookies, static code analysis, code signing, sandboxing.

4.3 Vulnerability management

Identification: vulnerability scans, static/dynamic analysis, penetration testing, threat feeds (OSINT, dark web), bug bounty programs, audits.
Analysis: confirm (rule out false positives and false negatives), prioritize using CVSS (severity score) and CVE (the catalog of known vulnerabilities), weigh exposure and environmental factors.
Response: patching, insurance, segmentation, compensating controls, exceptions/exemptions. Validate by rescanning and verification. A remediation you never confirm is not remediated.

4.4 Alerting and monitoring

Activities: log aggregation, alerting, scanning, reporting, archiving, alert response, and alert tuning (cutting noise so real alerts are not lost).
Tools: SIEM (aggregates and correlates logs), DLP (stops data leaving), SNMP traps, NetFlow, antivirus, vulnerability scanners, SCAP, benchmarks.
The SIEM is the hub of a security operations center: it is where logs from everywhere come together to be correlated into alerts.

4.5-4.6 Enterprise capabilities and identity

Capabilities: firewall rules and ACLs, IDS/IPS signatures, web/DNS filtering, email security (SPF, DKIM, DMARC, the three email-authentication records), FIM, EDR/XDR, user behavior analytics.
Access control models: MAC (mandatory, labels, most rigid), DAC (discretionary, owner decides), RBAC (role-based), rule-based, attribute-based. Know which gives the owner control (DAC) and which the system enforces by classification (MAC).
MFA factors: something you know (password), have (token), are (biometric), somewhere you are (location). True MFA combines different factors, not two passwords.
Federation and SSO: LDAP, OAuth, SAML. PAM: just-in-time permissions, password vaulting, ephemeral credentials.

4.7 Automation and orchestration

Use cases: user and resource provisioning, guard rails, ticket creation, escalation, enabling/disabling services, continuous integration.
Benefits: efficiency, enforcing baselines, secure scaling, faster reaction, workforce multiplier. Risks: complexity, cost, single point of failure, technical debt.
This is the SOAR idea: security orchestration, automation, and response, letting a small team handle a large workload consistently.

4.8 Incident response

Learn this sequence cold; the exam tests the order.

Step	What happens
1. Preparation	Build the plan, tools, and training before anything happens.
2. Detection	Identify that an incident is occurring.
3. Analysis	Determine scope, impact, and what is affected.
4. Containment	Stop the spread; limit the damage.
5. Eradication	Remove the cause: malware, the attacker's access.
6. Recovery	Restore systems to normal operation.
7. Lessons learned	Review to improve for next time.

4.9 Investigation data

Log sources: firewall, application, endpoint, OS-security, IPS/IDS, network logs, metadata.
Digital forensics: legal hold, chain of custody (documented handling so evidence is admissible), acquisition, preservation, e-discovery, reporting.
Chain of custody is the point candidates miss: evidence that cannot be shown to be untampered is worthless in a proceeding.

Where to spend your time

This domain is 28% of the exam. Within it, the highest-yield items are the access control models (MAC/DAC/RBAC), the incident response order, the email authentication trio (SPF/DKIM/DMARC), and the role of the SIEM. They are heavily tested and quick to confuse.

Domain 5 20% · 6 objectives

Security program management and oversight.

20% of the exam, and the most managerial. This is security as governance: the policies and structures that run a program, the formal process of managing risk, overseeing vendors, meeting compliance obligations, running audits, and training people. Much of it is definitions and process.

5.1 Governance

The document hierarchy: policies (high-level intent, AUP, information security, business continuity), standards (specific mandatory rules: password, encryption), procedures (step-by-step: onboarding, playbooks), and guidelines (recommended, not mandatory). Know which is binding and which is advisory.
Governance structures: boards, committees, government entities, centralized vs decentralized.
Data roles: owner (accountable), controller (decides purpose), processor (acts on the controller's behalf), custodian/steward (day-to-day handling). These pair heavily with privacy questions.

5.2 Risk management

This objective carries the exam's quantitative risk formulas. Learn them; they are among the few calculations Security+ asks.

Term	Meaning
SLE (Single Loss Expectancy)	Cost of one occurrence = Asset Value x Exposure Factor.
ARO (Annualized Rate of Occurrence)	How many times per year it is expected to happen.
ALE (Annualized Loss Expectancy)	Expected yearly cost = SLE x ARO.

Analysis: qualitative (ratings: high/medium/low) vs quantitative (dollars and numbers).
Strategies: transfer (insure it), accept (live with it), avoid (don't do it), mitigate (reduce it).
Appetite: expansionary, conservative, neutral. Plus a risk register with key risk indicators, risk owners, and thresholds.
Business impact: RTO (how fast you must recover), RPO (how much data you can afford to lose), MTTR, MTBF.

5.3 Third-party risk

Assessment: penetration testing, right-to-audit clause, independent assessments, supply chain analysis, due diligence.
Agreement types (a heavily-tested acronym cluster): SLA (service levels), MOA/MOU (agreement/understanding), MSA (master terms), SOW/WO (specific work), NDA (confidentiality), BPA (business partners).
Know what each agreement governs; the exam asks which one fits a scenario.

5.4-5.5 Compliance and audits

Compliance: reporting (internal/external), consequences of non-compliance (fines, sanctions, reputational damage, loss of license), privacy concepts (data subject, controller vs processor, right to be forgotten, data retention).
Audits and assessments: internal (self-assessment, audit committee) vs external (regulatory, independent third-party).
Penetration testing environments: known (white box, full info), partially known (gray box), unknown (black box, no info). Reconnaissance is passive (observe) or active (probe).

5.6 Security awareness

Phishing programs: run campaigns, teach recognition, define how to report suspicious messages.
Anomalous behavior: risky, unexpected, unintentional. Plus user training on insider threat, password management, removable media, social engineering, and remote work.
Awareness is a control: the human is both the biggest attack surface and, trained well, a strong sensor.

Reference

Glossary.

High-yield terms as SY0-701 uses them, weighted toward the distinctions the exam tests and the acronyms it assumes you know.

AAA: Authentication (who you are), Authorization (what you may do), Accounting (what you did). Applies to people and systems.
ALE: Annualized Loss Expectancy = SLE x ARO. The expected yearly cost of a risk.
ARO: Annualized Rate of Occurrence. How many times per year an event is expected.
CIA triad: Confidentiality, Integrity, Availability. The three goals security exists to protect.
Chain of custody: Documented handling of evidence proving it was not tampered with, so it is admissible.
Compensating control: An alternative control used when the primary one is not feasible.
CVE: Common Vulnerabilities and Exposures: the public catalog of known vulnerabilities.
CVSS: Common Vulnerability Scoring System: a 0-10 severity score used to prioritize.
DAC: Discretionary Access Control: the data owner decides who gets access.
DMARC / DKIM / SPF: The three email-authentication mechanisms. SPF authorizes sending servers, DKIM signs messages, DMARC ties them together and sets policy.
Impossible travel: Logins from two locations too far apart to travel between in the elapsed time; an indicator of compromise.
MAC: Mandatory Access Control: the system enforces access by classification labels; the most rigid model.
MFA: Multifactor authentication: combining different factor types (know, have, are, somewhere). Two passwords is not MFA.
Non-repudiation: The inability to deny an action. Provided by digital signatures.
On-path attack: An attacker positioned between two parties, intercepting or altering traffic. Formerly "man-in-the-middle."
PKI: Public Key Infrastructure: certificate authorities, public/private keys, and revocation (CRL, OCSP) that make asymmetric cryptography trustworthy.
RBAC: Role-Based Access Control: permissions assigned to roles, and users to roles.
RPO: Recovery Point Objective: the maximum acceptable data loss, measured in time.
RTO: Recovery Time Objective: the maximum acceptable time to restore a system.
SIEM: Security Information and Event Management: aggregates and correlates logs into alerts; the hub of a SOC.
SLE: Single Loss Expectancy = Asset Value x Exposure Factor. The cost of one occurrence.
SOAR: Security Orchestration, Automation, and Response: automating security workflows to multiply a team.
Symmetric vs asymmetric: Symmetric uses one shared key (fast, hard to exchange); asymmetric uses a public/private pair (solves exchange, slower).
TPM vs HSM: TPM is a crypto chip on the motherboard of one device; an HSM is dedicated hardware for managing keys at scale.
Zero Trust: Never trust, always verify. Access is decided per request via a control plane and enforced at a data-plane policy enforcement point.
Zero-day: A vulnerability with no available patch, unknown to the vendor or newly disclosed.

Common questions

CompTIA Security+ exam questions, answered

How many questions are on the CompTIA Security+ exam?

The CompTIA Security+ exam has 90 questions and lasts 90 minutes. CompTIA uses a scaled score rather than a published percentage, so there is no fixed pass mark to quote.

What is on the CompTIA Security+ exam?

The exam covers 5 domains: General Concepts (12%), Threats (22%), Architecture (18%), Operations (28%), Program Mgmt (20%). These weightings come from CompTIA's SY0-701 objectives v5.0.

Is this CompTIA Security+ material current?

Yes. This guide was written from CompTIA's own published outline, SY0-701 objectives v5.0, and last checked against that document on 20 July 2026. That date is shown on every page so you can judge for yourself rather than take our word for it.

Are there free CompTIA Security+ practice questions?

Yes. Sample questions with full worked explanations are free and need no account. The complete question bank and the full-length 90-question timed mock are paid.

Practise it

The guide above is free. The question bank and the full-length timed mock are the paid part.

Open Security+ →

Other exams:
PMP · CAPM · PMI-ACP · PSM I · PRINCE2 · ITIL · ISTQB CTFL · CC · Network+ · CISSP · AWS CCP

Cutscores is independent and is not affiliated with, authorised by, endorsed by or sponsored by CompTIA or any certification body. Security+ and all certification names and marks are the property of their respective owners, and are used here only to describe which exam this material prepares you for. We do not reproduce live exam content.