On this page
Intro
CompTIA Security+ is for people building the knowledge and practical judgment needed for core cybersecurity work, including protecting systems and responding to threats. This guide turns the SY0-701 exam outline into manageable study tasks, with CertMonk as one option for reviewing what you learn. The exam scope comes from CompTIA’s Security+ V7 page; the study plan below is our suggested approach.
Exam at a glance
| Detail | SY0-701 |
|---|---|
| Exam code | SY0-701, Security+ V7 |
| Questions | Maximum of 90 |
| Time | 90 minutes |
| Passing score | 750 on a scale of 100–900 |
| Question types | Multiple-choice and performance-based |
| Price | Check the vendor’s site for current pricing |
| Retirement | English: June 11, 2027; Japanese, Portuguese, Spanish and Thai: August 13, 2027 |
Source: CompTIA’s exam details, reviewed September 28, 2026.
Version update: CompTIA expects Security+ V8 to launch on or around November 17, 2026; SY0-701 remains available now, so match your materials and booking to your chosen version. See the Security+ version announcement.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| General security concepts | 12% | Understand the ideas behind security controls and protected information. |
| Threats, vulnerabilities, and mitigations | 22% | Connect a weakness or attack with a suitable way to reduce the risk. |
| Security architecture | 18% | Think through how systems, networks and data can be protected by design. |
| Security operations | 28% | Apply security measures and use evidence to investigate problems. |
| Security program management and oversight | 20% | Understand how an organization directs, evaluates and communicates security work. |
Domain labels and weights follow CompTIA’s official exam objectives summary. Use that outline as your coverage checklist; a domain’s weight should help allocate attention without becoming a reason to skip smaller topics.
What each domain really tests
General security concepts
Start with the purpose of a control. A useful study note explains what the control protects, when it acts and what it cannot do. Organize your notes around preventing problems, detecting them and recovering from them, rather than collecting disconnected definitions.
Spend time separating similar ideas. Explain confidentiality, integrity and availability in your own words, then connect each to a practical protection. For cryptography, focus on the job each technique performs before trying to remember terminology. Include change management in your review: a technically sensible adjustment still needs a controlled process.
Threats, vulnerabilities, and mitigations
Keep three concepts distinct: the source of a threat, the weakness it could exploit and the response that reduces exposure. Build a small comparison sheet as you study. Give each concept a description and a reason a particular mitigation fits it.
Avoid treating every suspicious event as the same kind of attack. Read descriptions carefully and identify the evidence that supports your interpretation. When reviewing mitigations, explain why the selected measure addresses the weakness, rather than assuming every security tool helps equally.
Security architecture
This domain asks you to think about the environment as a whole. Draw simple diagrams of where systems sit, how people reach them and where sensitive information travels. Use the diagrams to organize your reading about infrastructure and data protection.
Give recovery its own study session. Compare keeping a service running with bringing it back after a disruption. Write down the assumptions behind a proposed design, including dependencies and the information that would be needed to restore service.
Security operations
Turn operational topics into short workflows. For vulnerability management, trace work from discovery through remediation and validation. For incident response, make notes about the evidence available, the action being considered and how the result would be checked.
Study identity and access management alongside monitoring and system protection. Practice explaining why an access change is needed and what should be reviewed afterward. When reading about logs or alerts, summarize what the information supports and what remains uncertain. That habit discourages confident guesses from incomplete evidence.
Security program management and oversight
Technical actions sit inside organizational decisions. Compare policies, standards and procedures by their purpose, and explain how risk decisions influence the work a team performs. Keep your summaries short enough to explain aloud without reading them.
Include third-party risk, compliance, assessments and awareness in your coverage checklist. For each, write what information a decision-maker needs and what a useful record would show. This keeps the domain connected to everyday work rather than a list of management vocabulary.
The coverage above is organized from CompTIA’s published domain summary; the note-taking exercises are study suggestions.
A realistic 30-day study plan
Treat this as a starting schedule, not a deadline you must meet. Aim for a focused session most days, with time for reading, recall and review. If networking or operating-system basics are unfamiliar, extend the plan and work on those foundations before compressing everything into a final weekend.
Days 1–7: establish the foundations
On day one, save the objectives and mark topics as familiar, uncertain or new. Use the next four days for general concepts and an introduction to threats. After reading, close your notes and explain one idea aloud. Spend day six reviewing confusing terms and day seven revisiting the gaps you recorded.
Keep a learning log with three columns: topic, misunderstanding and next action. A next action should be specific, such as comparing two controls or revisiting a section on identity. “Study more” is too broad to help tomorrow.
Days 8–14: connect threats to architecture
Finish the threats domain, then work through architecture and recovery. Alternate a reading session with a session that produces something: a diagram, a comparison sheet or a written explanation. At the end of the week, revisit earlier material without looking at your notes first.
Reserve one session for catching up. If several concepts remain unclear, reduce the amount of new material rather than adding longer and longer study days. Your notes should become clearer as the week progresses, not simply longer.
Days 15–21: work through operations
Give security operations several separate sessions. Group your work into system protection, identity, vulnerability management, monitoring and incident response. Use untimed practice to expose reasoning gaps, then return to the relevant topic before trying again.
End the week with mixed review from every domain covered so far. Record correct guesses as uncertain knowledge. They need follow-up even though a practice score may count them as correct.
Days 22–28: add oversight and practice pacing
Cover program management and oversight, then revisit the weakest areas in your log. Include timed practice after you can explain the material without help. Review the session afterward and separate knowledge gaps from rushed reading or difficulty managing time.
Days 29–30: make a readiness decision
Review concise notes and remaining uncertainties. Check your selected exam version and booking details directly with the vendor. If important topics still feel unfamiliar, use the log to plan another week; completing a calendar is not evidence that learning is complete.
Common mistakes and how to avoid them
- Mixing exam versions. Put SY0-701 on your study checklist and verify that each resource covers that version.
- Memorizing a control without its purpose. Add a sentence explaining the problem it addresses and the limits of its use.
- Skipping management topics. Schedule them explicitly so they do not become leftover reading.
- Counting lucky guesses as mastery. Flag them for review alongside incorrect responses.
- Repeating a familiar set until the score rises. Return to the underlying concept and explain it without answer choices.
- Leaving applied work until the end. Use diagrams, workflow summaries and safe learning exercises throughout your preparation.
How to use practice questions well
Begin untimed. Read the explanation for your selected answer and each alternative, then identify the distinction you missed. Wrong-answer explanations matter because they can reveal why a familiar term does not fit the situation being described.
CertMonk offers explanations for every answer choice, randomized practice tests, timed practice and an untimed learning mode, plus flip-card flashcards, study games and progress by exam domain. Use those tools for different jobs: explanations for reasoning, flashcards and games for recall, and domain progress to choose what to review next.
After a practice session, choose a small number of gaps to repair. Read the relevant material, write a short explanation and revisit it later. Add timed practice when the concepts feel more stable. Treat practice results as feedback about your preparation, not a prediction of your exam result.
Free practice questions
Use the free samples below to explore the format and review the explanations without a purchase.
Two weeks after a phishing-led account compromise was fully contained and all systems were restored, the incident response lead gathers the responders, the help desk, and the affected business owner to review what happened, what worked, and what should change. Which phase of the incident response process is this?
- ARecovery, returning affected systems to normal service.
- BAnalysis, determining the scope and cause of the incident.
- CPreparation, since the meeting will change the response plan.
- DLessons learned, improving plans and controls from the incident.
Show the answer and explanation
Answer: D. Lessons learned, improving plans and controls from the incident.
Correct. The post-incident review of what happened and what should change is the lessons-learned phase, which feeds improvements back into preparation.
Why not the others
- A. Recovery was already complete. This meeting reviews the whole response to improve future ones.
- B. Analysis happens while the incident is live and shapes containment. This meeting looks back after the incident is closed.
- C. Its outputs feed preparation, but the review of a specific completed incident is its own phase.
Takeaway: Lessons learned closes the incident response cycle. Its findings update the plan, controls, and training, which is how preparation improves.
EDR telemetry shows an unsigned loader opening a handle to a running, signed browser process, allocating memory inside it, writing code into that memory, and starting a remote thread there. The malicious code then runs under the browser’s identity. Which technique does this describe?
- ASQL injection against the browser’s local storage database.
- BA buffer overflow in the browser’s parsing code.
- CMemory injection of code into a legitimate process.
- DA race condition between two of the browser’s threads during start-up.
Show the answer and explanation
Answer: C. Memory injection of code into a legitimate process.
Correct. Writing code into another process’s memory and running it there is memory (process) injection, used to hide malicious code behind a trusted process.
Why not the others
- A. SQL injection alters database queries. No query is involved in allocating memory and starting a remote thread.
- B. A buffer overflow overruns a buffer through crafted input. Here code is written deliberately into another process through operating system calls.
- D. A race condition exploits timing between operations. The telemetry shows a deliberate write and thread start, not a timing flaw.
Takeaway: Memory injection runs attacker code inside a trusted process, so it inherits that process’s identity and blends in. EDR watches for cross-process memory writes and remote threads.
Before any controls, the risk of payment fraud on a new checkout was rated high. After adding 3-D Secure, velocity checks, and manual review of large orders, it is rated medium, while the company’s appetite for fraud risk is low. What is the medium rating, and what should happen next?
- AInherent risk; no further action is needed now.
- BResidual risk; since it exceeds appetite, treat or formally accept it.
- CControl risk; replace the controls that were just added.
- DAccepted risk, since the controls are already in place and working.
Show the answer and explanation
Answer: B. Residual risk; since it exceeds appetite, treat or formally accept it.
Correct. Residual risk is what remains after controls. Because it is above the low appetite, leadership must add treatment or make a documented acceptance decision.
Why not the others
- A. Inherent risk is the rating before controls, which was high. The medium rating comes after the controls.
- C. Control risk is the chance that controls fail. The controls reduced risk; the issue is that the remaining level is still above appetite.
- D. Implementing controls is not acceptance. Acceptance is a separate, explicit decision by the risk owner.
Takeaway: Residual risk is what remains after controls. If it still exceeds appetite, the owner must treat it further or formally accept it.
A small accounting firm backs up its file server every night to a NAS in the same server closet and keeps each backup for 90 days. A risk review asks what would happen if a fire or flood destroyed that room. Which change BEST addresses the gap the review found?
- ARun the NAS backup every hour instead of once a night.
- BExtend the NAS backup retention from 90 days to one year.
- CKeep another backup copy offsite or in the cloud.
- DRebuild the NAS as RAID 6 so that two disks can fail safely.
Show the answer and explanation
Answer: C. Keep another backup copy offsite or in the cloud.
Correct. An onsite copy is fast to restore from, but only a copy held in another location survives an event that destroys the whole room.
Why not the others
- A. More frequent backups improve the recovery point, but they land on the same device in the same room and are lost with it.
- B. Longer retention keeps more restore points, but every one of them is still in the closet that the fire or flood would destroy.
- D. RAID 6 protects against disk failures inside the NAS. A fire or flood destroys the whole device, parity and all.
Takeaway: Onsite backups give fast restores; offsite or cloud copies survive the loss of the site. Keep both so a single event cannot destroy the data and every backup together.
Source: NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
Thousands of building sensors will connect to a corporate network with no person present to type a password. Security wants each sensor to prove its own identity so that a cloned or rogue sensor can be refused individually. Which approach BEST authenticates the sensors as systems?
- AConfigure every sensor with the same strong pre-shared key.
- BPlace all sensors in one dedicated VLAN with restrictive ACLs.
- CIssue each sensor a unique device certificate and private key.
- DAllow sensors onto the network based on a MAC address list.
Show the answer and explanation
Answer: C. Issue each sensor a unique device certificate and private key.
Correct. A per-device certificate lets each sensor prove possession of its own private key, and any single certificate can be revoked if a device is compromised.
Why not the others
- A. A shared key proves only that a device knows the common secret. One leaked key admits every clone, and no single sensor can be refused on its own.
- B. Segmentation limits what sensors can reach, which is useful, but it does not authenticate which device is which.
- D. MAC addresses are easily observed and spoofed, so a list of them identifies nothing reliably.
Takeaway: Systems authenticate with credentials they hold, typically a unique certificate and private key. Per-device credentials allow individual revocation.
Source: RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile
FAQ
Is SY0-701 still available?
Yes, as of this review date; CompTIA lists it as the available V7 exam and publishes the language-specific retirement dates shown above on its V7 page.
Should I wait for Security+ V8?
Match your decision to your timeline and materials. CompTIA currently expects a launch on or around November 17, 2026, according to its version announcement; this guide covers SY0-701.
Is 30 days enough to prepare?
It can be a useful planning window, but your starting knowledge and available time determine whether it is realistic. Extend it if you cannot explain the topics or apply what you have studied.
What experience does CompTIA recommend?
CompTIA recommends Network+ and two years in a security or systems administrator role on its exam page. Use that recommendation to assess your starting point when planning study time.
Is Security+ only a multiple-choice exam?
No. CompTIA lists both multiple-choice and performance-based questions in its exam details. Include applied learning in your preparation.
How should I decide what to revise next?
Start with concepts you cannot explain and mistakes that recur across practice sessions. Use domain weights to balance the remaining schedule, while keeping every domain on your checklist.
Next step
Try free practice questions → https://app.certmonk.app/samples
