Domain Weighting and an 8-12 Week Study Plan

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Domain Weighting and an 8-12 Week Study Plan

Key Takeaways Explain This Topic AI

SY0-701 domain weights are 12%, 22%, 18%, 28%, and 20% across the five official domains.

Security Operations is the largest domain at 28%, so monitoring, hardening, incident response, and vulnerability management need sustained practice.

An 8-week plan works for candidates with stronger networking and operations experience; a 12-week plan gives more time for fundamentals and PBQs.

Study time should follow both domain weight and personal weakness, not domain weight alone.

Practice should become more scenario-heavy in the final third of the plan, with full timed mocks only in the last 1-2 weeks.

Last updated: June 2026

Official SY0-701 Domain Weighting

The SY0-701 exam objectives organize content into five domains . The percentages below are the official weights published by CompTIA and they should anchor how you split your study time.

Domain Name Exam weight
1.0 General Security Concepts 12%
2.0 Threats, Vulnerabilities, and Mitigations 22%
3.0 Security Architecture 18%
4.0 Security Operations 28%
5.0 Security Program Management and Oversight 20%

The weighting tells you where points concentrate, but it does not make the smaller domains optional. Domain 1 terms (the CIA triad, the AAA model, control categories, PKI basics, and the six control types) appear inside incident, architecture, identity, and risk questions. Weak vocabulary makes high-weight scenario questions harder, because a Domain 4 incident question may hinge on whether you can tell a detective control from a corrective one. Note that compared to SY0-601, the 701 objectives consolidated governance and risk into a single Domain 5 worth 20% and grew Security Operations to the top weight.

8-Week Study Plan

Use this pace if you already understand basic networking, operating systems, cloud terminology, and IT operations.

Week Primary focus Output

1 Domain 1: CIA, AAA, control types, identity terms, cryptography basics One-page concept map and control-classification drills

2 Domain 2 threats: malware, social engineering, application and cloud weaknesses Threat-indicator notebook
3 Domain 2 mitigations and vulnerability management Remediation-priority drills

4 Domain 3 architecture: segmentation, resilience, secure design, data protection Network and cloud design comparison table

5 Domain 4 operations: logging, monitoring, hardening, IAM operations Log-interpretation practice set
6 Domain 4 incident response, automation, endpoint and network operations Incident-timeline exercises
7 Domain 5 governance, risk, compliance, third parties, privacy Risk register and audit-evidence drills
8 Mixed review, PBQs, timed sets, missed-question repair Two timed mixed sessions and a final weak-area list
12-Week Study Plan

Use this pace if Security+ is your first security exam or if networking and command-line operations are still new.

Weeks Primary focus What to slow down and practice
1-2 Domain 1 foundations Terms, control categories, IAM vocabulary, basic cryptography
3-4 Domain 2 threats and mitigations Attack clues, vulnerability-scan findings, patch and segmentation choices
5-6 Domain 3 architecture Secure network, cloud, identity, resilience, and data designs
7-9 Domain 4 operations Logs, alerts, hardening, incident response, account management
10 Domain 5 governance and risk Policies, risk response, compliance evidence, vendor oversight
11 Mixed scenario review Compare close answer choices and repair weak domains
12 Timed readiness PBQ practice, pacing, sleep schedule, final-day review
Time Allocation by Weight

If you have 60 total study hours, start with the weight-proportional split below and adjust after each diagnostic. The hours track the official percentages so your effort matches where the points are.

Domain Weight Approximate hours
General Security Concepts 12% 7
Threats, Vulnerabilities, and Mitigations 22% 13
Security Architecture 18% 11
Security Operations 28% 17
Security Program Management and Oversight 20% 12

Given 90 minutes for up to 90 items, your pacing target is roughly one minute per question . Plan to spend extra time on the handful of PBQs at the start, then bank time on faster multiple-choice items. If a single multiple-choice item runs past 90 seconds, flag it and move on; returning later with a fresh read often resolves the close call.

Scenario: Adjusting the Plan

A candidate scores well on definitions but misses log questions, vulnerability-remediation order, and business-impact questions. That candidate should not reread the glossary for another week. A better plan is:

Weakness Adjustment
Log questions Daily short sets using authentication, firewall, endpoint, and web-server events
Remediation order Rank by exploitability, exposure, asset value, and compensating controls
Business impact Review change management, BIA, RTO, RPO, downtime, and exception workflows

The goal is not to finish pages. The goal is to reduce repeatable mistakes. Re-run a domain diagnostic after each adjustment; if a weak domain climbs above roughly 80% on fresh questions, redistribute those hours to the next weakest area rather than over-studying a domain you have already secured.

Sequencing the Domains Deliberately

The order of the plans above is not arbitrary. Domain 1 comes first because its vocabulary (control types, the CIA triad, AAA, zero trust, cryptography primitives) is the substrate every later domain reuses. If you start with Domain 4 operations before you can distinguish a detective from a corrective control, you will memorize answers without understanding them and they will not transfer. Domain 2 (threats) follows because you cannot reason about a mitigation until you can recognize the attack: a question describing a watering-hole or a privilege-escalation chain is unanswerable if the attack name means nothing to you.

Domain 3 (architecture) and Domain 4 (operations) are the heaviest applied blocks and sit in the middle-to-late plan when your stamina for scenarios is highest. Save Domain 5 (governance, risk, program management) for late because it is the most stable and least technical material, and it cross-references the controls you have already learned. Cramming risk frameworks, RTO/RPO, and vendor-assessment language in week 7 or week 10 sticks better than learning it cold in week 1.

A Note on Diagnostics and Honesty

A diagnostic is only useful if it is honest. Take the first one before studying, untimed, and grade yourself ruthlessly by domain. A common self-deception is averaging: a 78% overall can hide a 95% in General Security Concepts and a 55% in Security Operations, which is the 28%-weight domain you most need. Always break scores out by the five domains and steer hours toward the lowest weighted-impact gap, which is the product of the domain weight and your error rate. A 55% in a 28% domain costs far more scaled points than a 70% in a 12% domain, so it gets the next block of hours.

Repeat this measure-adjust loop weekly, and reserve full 90-question timed mocks for only the final one to two weeks once your per-domain accuracy is already trending toward passing.