Use the current SY0-701 objectives to find gaps across all five domains, then practise applying the concepts in legitimate questions and simulation tasks. This guide explains the exam format, version dates and retake rules, with an original access-control example.
What the Security+ exam certifies
Security+ validates the core skills for a career in IT security: assessing security posture, securing hybrid environments, working within governance, risk and compliance expectations, and responding to security incidents.
The official objectives document states the successful candidate can assess an enterprise security posture and recommend solutions, monitor and secure hybrid environments including cloud, mobile and IoT, operate with awareness of applicable regulations, and identify, analyze and respond to security events and incidents.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains)
Exam format, scoring and key dates
SY0-701 combines multiple-choice and performance-based questions. Its scaled passing score cannot be converted into a required percentage or number of correct answers.
CompTIA recommends Network+ and two years of experience in a security or systems administrator role. These are recommended preparation, not admission requirements.
English, Japanese, Portuguese, Spanish and Thai versions are offered. The current page lists English retirement on June 11, 2027, and the other four languages on August 13, 2027. Match your materials and booking to SY0-701 and recheck the dates before paying.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains)
The five domains and how to study each
Cover all five domains. Use their weights alongside your own knowledge gaps when deciding where extra study will help.
The table pairs official weights with optional study tasks. The objective document says its example lists are not exhaustive; use the complete document to track coverage.
For a compare objective, explain the differences between the concepts. For a scenario objective, practise using the supplied facts to choose an answer and explain why the alternatives fail. A familiar keyword alone does not decide the answer.
| Domain | Weight | Study task |
|---|---|---|
| 1.0 General Security Concepts | 12% | Compare the listed control types and summarize CIA, AAA, zero trust, change management and cryptographic solutions. |
| 2.0 Threats, Vulnerabilities, and Mitigations | 22% | Identify the actor, attack vector and vulnerability in a supplied scenario; compare mitigations against its stated constraints. |
| 3.0 Security Architecture | 18% | Compare on-premises, cloud, virtualization, IoT and ICS models, and match data states to protection methods. |
| 4.0 Security Operations | 28% | Practise hardening, asset and vulnerability management, monitoring, IAM, automation and incident-response topics from the objectives. |
| 5.0 Security Program Management and Oversight | 20% | Distinguish governance documents, risk terms, vendor agreements, compliance, audits and awareness practices. |
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains); Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary
How performance-based questions work
Security+ includes simulation performance-based questions (PBQs): simulated tools such as a firewall interface or terminal window where you solve a task rather than pick an option.
Simulations approximate an environment with restricted functionality, so not every command or menu you know will be available. CompTIA's guidance on the format is practical: you can skip a simulation PBQ and return to it later, your work is saved as you move between items, and the reset button clears only that question, not your exam.
There can be multiple valid paths to a correct solution, and scoring addresses different approaches. Partial credit may be offered on some items, but CompTIA keeps question and scoring details confidential, so no one can tell you in advance which items allow it or how points are weighted.
For preparation, work through legitimate sample tasks or a lab you are authorized to use. Read the goal and constraints, identify the starting state, attempt the task and check the result. Review mistakes against the relevant objective. This is study advice, not an official scoring procedure.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Performance-Based Questions Overview | CompTIA IT Certifications; Performance-Based Questions FAQs | CompTIA Blog — December 18, 2024
Worked example: authentication is not authorization
Authentication verifies who a user is; authorization decides what that verified user may access. Least privilege limits each entity to the minimum access needed for its assigned task.
NIST defines authentication as verifying a user, process or device identity. In access control, authorization permits or denies access to resources. Least privilege restricts privileges to the minimum needed for assigned tasks.
Try this exercise before reading the answer. Every premise you need is stated in the prompt; treat them as given for this fictional organization.
Practice task
A contractor has authenticated successfully to a backup platform. In this fictional organization, the data owner has approved read-only access to one named backup-status report for 72 hours, and an administrator implements exactly the approved permissions. The contractor needs no other resources and will make no system changes. Which grant fits the approved task? A) Read access to the named report for 72 hours. B) Permanent read access to every customer record. C) Permanent administrator access to the backup platform.
Show answer
A. Read access to the named report, for 72 hours only.
Authentication established the contractor's claimed identity. The approval specifies one resource, a read action and a 72-hour duration; option A matches all three. Option B grants unrelated records for an unlimited time. Option C adds unnecessary administrative permissions and duration. Least privilege supports the limited grant for the task stated here; the owner and administrator roles come from this exercise's explicit policy.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Least privilege - NIST CSRC Glossary; Authentication - NIST CSRC Glossary; Authorization - NIST CSRC Glossary; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains)
Retake rules if you do not pass
After your first failed attempt, there is no required wait before a second attempt. Before a third or later attempt, wait at least 14 calendar days from your last attempt.
The policy requires payment for each attempt. Some CompTIA bundles include a retake under their own terms, so check what your voucher covers.
Once you have passed and achieved the certification, retaking the same exam code requires prior CompTIA consent. Do not assume you can book it again simply for extra practice.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: CompTIA Certification Retake Policy | CompTIA IT Certifications; Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary
Preparation mistakes to avoid
Check what your materials assume about the exam, and practise the task as well as the terminology.
- Using material for another exam version without comparing its coverage with the current SY0-701 objectives.
- Treating a practice percentage as a guaranteed exam result.
- Memorizing a term without practising the comparison or scenario task attached to it.
- Preparing for simulation PBQs only with multiple-choice drills.
- Using unauthorized exam content. CompTIA warns that brain dumps can lead to certification revocation and suspension.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary; Performance-Based Questions Overview | CompTIA IT Certifications; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains)
Your preparation checklist
Use the objectives to track what you can explain and apply, then confirm your booking details.
Keep an error log that links each misunderstanding to an objective. Use mixed timed practice to work on pacing and locate remaining gaps.
- Cover each of the five domains and revisit repeated errors, including smaller domains.
- Explain the answer and alternatives in a new access-control scenario.
- Practise legitimate simulation tasks and learn the skip, return and reset controls.
- Confirm the exam code, current regional price, delivery options and retirement dates before booking.
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions: Security+ (Plus) Certification | CompTIA — Exam details and exam objectives summary; Performance-Based Questions Overview | CompTIA IT Certifications; Performance-Based Questions FAQs | CompTIA Blog — December 18, 2024; CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0 — About the Exam; Exam Objectives (Domains)
Official CompTIA pages, the SY0-701 Exam Objectives PDF, CompTIA PBQ and retake policy pages, and NIST glossary definitions
Exam facts verified against official sources, September 14, 2026:
- Security+ (Plus) Certification | CompTIA
- Least privilege - NIST CSRC Glossary
- Authentication - NIST CSRC Glossary
- Authorization - NIST CSRC Glossary
- Performance-Based Questions Overview | CompTIA IT Certifications
- Performance-Based Questions FAQs | CompTIA Blog
- CompTIA Certification Retake Policy | CompTIA IT Certifications
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives, Version 5.0