All certifications
CompTIASY0-701
CompTIA Security+
Exam overview, official domain weights and free sample questions. Subscribers get 230 practice questions, 119 flashcards, 14 labs, a study guide and video lessons for this exam.
Exam at a glance
- Exam code
- SY0-701
- Questions
- Maximum of 90
- Time
- 90 minutes
- Question types
- multiple choice, performance-based
- Passing score
- 750 on a scale of 100–900
- Exam fee
- not published in readable form on the official page when checked
- Delivery
- not published on the pages checked
- Prerequisites
- Recommended: CompTIA Network+ and two years of experience in a security or systems administrator role (exam page). The objectives PDF says at least 2 years of IT administration focused on security. Not required
- Renewal
- not published on the pages checked. See CompTIA Continuing Education
- Version notes
- SY0-701 English retires June 11, 2027 (Japanese, Portuguese, Spanish, and Thai retire August 13, 2027). Successor SY0-801 (V8) is expected to launch on or around November 17, 2026; both can be taken until SY0-701 retires. SteadfastIQ practice items follow the SY0-701 objectives
From the official exam page (checked 2026-11-09). Always confirm details with the vendor: official exam page, official objectives.
Domains and weights
General Security Concepts12%
- 1.1 Compare and contrast various types of security controls.
- 1.2 Summarize fundamental security concepts.
- 1.3 Explain the importance of change management processes and the impact to security.
- 1.4 Explain the importance of using appropriate cryptographic solutions.
Threats, Vulnerabilities, and Mitigations22%
- 2.1 Compare and contrast common threat actors and motivations.
- 2.2 Explain common threat vectors and attack surfaces.
- 2.3 Explain various types of vulnerabilities.
- 2.4 Given a scenario, analyze indicators of malicious activity.
- 2.5 Explain the purpose of mitigation techniques used to secure the enterprise.
Security Architecture18%
- 3.1 Compare and contrast security implications of different architecture models.
- 3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
- 3.3 Compare and contrast concepts and strategies to protect data.
- 3.4 Explain the importance of resilience and recovery in security architecture.
Security Operations28%
- 4.1 Given a scenario, apply common security techniques to computing resources.
- 4.2 Explain the security implications of proper hardware, software, and data asset management.
- 4.3 Explain various activities associated with vulnerability management.
- 4.4 Explain security alerting and monitoring concepts and tools.
- 4.5 Given a scenario, modify enterprise capabilities to enhance security.
- 4.6 Given a scenario, implement and maintain identity and access management.
- 4.7 Explain the importance of automation and orchestration related to secure operations.
- 4.8 Explain appropriate incident response activities.
- 4.9 Given a scenario, use data sources to support an investigation.
Security Program Management and Oversight20%
- 5.1 Summarize elements of effective security governance.
- 5.2 Explain elements of the risk management process.
- 5.3 Explain the processes associated with third-party risk assessment and management.
- 5.4 Summarize elements of effective security compliance.
- 5.5 Explain types and purposes of audits and assessments.
- 5.6 Given a scenario, implement security awareness practices.
Free sample questions
Original questions in the style of the exam. Pick an answer to see the explanation.
Sample question 1 · General Security Concepts
A parking garage operator installs prominent signs reading 'Area under 24/7 video surveillance' to discourage break-ins, even before the cameras are wired up. Which control type do the signs primarily represent?
Correct — “Deterrent”: The signs aim to discourage an attacker from trying at all, which is the definition of a deterrent control. Incorrect — “Detective”: Detective controls identify an event as or after it happens; a sign records and alerts on nothing. Incorrect — “Corrective”: Corrective controls restore systems or fix damage after an incident; a sign fixes nothing. Incorrect — “Compensating”: A compensating control substitutes for a required control that cannot be implemented; the signs are not standing in for a mandated control.
Sample question 2 · Threats, Vulnerabilities, and Mitigations
A group defaces a fossil-fuel company's website with protest messages and leaks internal emails to embarrass executives. No ransom is demanded. Which threat actor is most likely?
Incorrect — “Organized crime”: Organized crime is mainly financially motivated and would typically demand payment. Correct — “Hacktivist”: Hacktivists are driven by ideology or a cause and use defacement and leaks to make a statement. Incorrect — “Nation-state”: Nation-states usually pursue long-term espionage or disruption quietly, not public protest messages. Incorrect — “Unskilled attacker”: An unskilled attacker relies on others' tools and rarely has a clear ideological campaign behind the attack.
Sample question 3 · Security Architecture
A company runs its application on IaaS virtual machines from a cloud provider. A critical OS vulnerability is announced for the guest operating system. Who is responsible for patching it?
Correct — “The customer”: In IaaS, the customer manages the guest OS, applications, and data, so OS patching is the customer's job. Incorrect — “The cloud provider”: The provider secures the physical hosts and hypervisor, not the customer's guest OS in IaaS. Incorrect — “The OS vendor, automatically”: OS vendors release patches, but someone must apply them to the VM, and in IaaS that's the customer. Incorrect — “Responsibility is undefined in IaaS”: The shared responsibility model clearly defines that the guest OS belongs to the customer in IaaS.
Unlock every question, lab and guide
Full access to all 20 certifications for $4.99/month. Cancel anytime.