Current Exam Facts and How Security+ Tests Judgment

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Current Exam Facts and How Security+ Tests Judgment

Key Takeaways Explain This Topic AI

The current CompTIA Security+ exam is SY0-701, launched November 7, 2023 (SY0-601 retired July 31, 2024); its successor SY0-801 (V8) is expected on or around November 17, 2026, and SY0-701 retires in English on June 11, 2027.

SY0-701 includes a maximum of 90 questions, mixes multiple-choice and performance-based questions (PBQs), and has a 90-minute time limit.

The passing score is 750 on a scaled range of 100-900; the standard US exam voucher is $439.

Security+ tests applied judgment: identify the constraint, classify the risk, and choose the best next action rather than the textbook-correct definition.

Security+ is ISO/IEC 17024 accredited, and DoD's 8140 Qualification Matrix lists it at the Intermediate level for 20 DCWF work roles (one, 461, is pending OPR validation); DoDM 8140.03 (2023) cancelled DoD 8570.01-M.

Last updated: October 2026

CompTIA Security+ SY0-701 at a Glance

CompTIA Security+ is a vendor-neutral baseline cybersecurity certification. It expects you to know security vocabulary, but the harder items ask for judgment: which control fits the scenario, which action comes first, which evidence matters, or which risk is most important. The certification is accredited under ISO/IEC 17024 (through ANAB), and the US Department of Defense DoD 8140 Qualification Matrix (V2.1, effective September 19, 2025) lists Security+ at the Intermediate proficiency level for 20 DoD Cyber Workforce Framework (DCWF) work roles (one, 461 Systems Security Analyst, is pending OPR validation), such as cyber defense analyst and system administrator. DoDM 8140.03 cancelled DoD 8570.01-M in 2023. Expect questions that resemble real operational decisions, not trivia.

Official exam fact SY0-701 detail
Current series code SY0-701
Launch date November 7, 2023
Prior version retired SY0-601 retired July 31, 2024
SY0-701 retirement English June 11, 2027; Japanese, Portuguese, Spanish, and Thai August 13, 2027
Next version SY0-801 (Security+ V8), expected on or around November 17, 2026
Maximum questions 90
Question styles Multiple-choice (single and multiple response) and performance-based questions (PBQs)
Time limit 90 minutes
Passing score 750 on a 100-900 scale
Standard US voucher $439 USD (CompTIA Store list price)
Recommended experience CompTIA Network+ and ~2 years in a security/administration role
Exam focus Applied security concepts, operations, architecture, risk, and governance

The 750 passing score on a 100-900 scale is scaled , not a raw percentage. You cannot reverse-engineer it to "75%" because PBQs and harder items carry more weight. Treat any practice test showing roughly 83-85% consistently as the safety margin, and never plan to pass with exactly the minimum. The exam has no formal prerequisite , but CompTIA recommends Network+ first because Domain 3 (architecture) and Domain 4 (operations) assume you can read ports, protocols, subnets, and basic command output.

What Security+ Means by "Best"

Many questions include more than one technically true answer. The exam word best usually means the answer that fits the scenario's exact constraint. Train yourself to underline the qualifier verb before reading the options.

Scenario constraint What the exam is usually testing
"First" or "next" action Order of operations, such as identify, contain, eradicate, recover
"Most secure" Strongest risk reduction, often least privilege or defense in depth
"Least disruptive" Control that reduces risk without unnecessary outage
"Most likely" Evidence interpretation, not a control you wish had been deployed
"Best evidence" Logs, approvals, tickets, reports, and artifacts that prove what happened
"Most cost-effective" Adequate risk reduction at lowest reasonable cost, not the strongest possible control
Mini Scenario: The Almost-Right Answer

A web server begins sending unusual outbound traffic shortly after a suspicious file upload. The answer choices include:

Option Why it may be tempting Why it may be wrong
Patch the web framework Good long-term mitigation Too late as the first active-incident step

Wipe the server immediately Removes the suspected compromise Destroys volatile evidence before containment and documentation

Isolate the server and preserve logs Limits impact and keeps evidence Usually the best first operational action

Notify all customers immediately May be legally required later Premature if scope and impact are unconfirmed

The exam is not asking whether patching matters. It is asking what a competent practitioner does first during an active event. The correct sequence follows the incident response process in the SY0-701 objectives : preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Containment with evidence preservation comes before eradication (the wipe) and before external communication.

High-Yield Traps

Trap Better habit

Treating encryption as integrity Encryption protects confidentiality; hashing and digital signatures prove integrity

Treating authentication as authorization Authentication proves identity; authorization grants allowed actions
Choosing the broadest control Prefer scoped, least-privilege, monitored access
Skipping evidence In incidents and audits, proof matters as much as intent
Ignoring business impact Controls must account for outage, safety, compliance, and mission impact
Confusing risk terms Threat = actor/event, vulnerability = weakness, risk = likelihood times impact

Use this guide as a decision-training tool. For every topic, ask four questions: What asset is protected? What risk is reduced? What control type (preventive, detective, deterrent, corrective, compensating, directive) is used? What evidence would prove the control worked? If you can answer those four for each concept, you can usually eliminate two distractors immediately and choose between the remaining two on the basis of the scenario's qualifier verb.

Why the Judgment Framing Matters

SY0-701 deliberately blurred the line between knowing a term and applying it. A pure-recall item might ask you to define multifactor authentication; an applied item describes a help-desk reset workflow and asks which factor was actually added, then whether it changed the assurance level. The second style dominates the exam. This is why rote flashcard memorization alone tends to plateau candidates in the high-600s scaled range: they recognize vocabulary but cannot rank two valid-sounding controls against a constraint. The fix is to practice with full scenarios and to verbalize the constraint before reading options.

A second reason the framing matters is the performance-based questions at the start of the exam. PBQs cannot be answered by recall at all; they require you to drag controls into a diagram, fix a configuration, or order incident steps. Candidates who treated Security+ as a glossary often freeze on the first PBQ, burn ten minutes, and then rush the multiple-choice items. Going in expecting decisions rather than definitions keeps your pacing calm.

Finally, the exam reflects real job expectations. Security+ is a DoD 8140 qualification option for work roles such as cyber defense analyst, incident responder, and system administrator, and the questions reward the action a careful colleague would take. When two answers are both "correct," the tie-breaker is almost always the one that preserves evidence, limits blast radius, respects least privilege, or follows the documented process. Anchor on those four instincts and the ambiguous items become tractable.