Security+ is best learned by understanding why each control exists and practising real tasks, not by memorising definitions. The exam is scenario-driven and includes hands-on performance-based questions, so this guide is built as a full self-study course: it walks through each of the five SY0-701 domains in depth, explains the concepts the scenarios are built on, shows where cryptography, identity and incident response actually apply, and then turns all of it into a week-by-week plan and a description of exam day. It contains study guidance and original explanations only. There are no real or simulated exam questions, and you should always confirm current domains and weights against CompTIA’s official Security+ exam objectives before you book.
Chapter 1: Exam overview and how to use this guide
What Security+ actually measures
Security+ measures whether you have the broad, vendor-neutral foundation to do entry-level security work, recognising threats, applying controls, running basic operations, and understanding the governance around them. The current version, SY0-701, organises the exam into five domains, and CompTIA weights them as follows: General Security Concepts at 12%, Threats, Vulnerabilities and Mitigations at 22%, Security Architecture at 18%, Security Operations at 28%, and Security Program Management and Oversight at 20%. Those weights are your study compass. Security Operations is the largest single domain and the most hands-on, Threats is the largest knowledge domain, and the governance domain, though it feels less technical, is a full fifth of the exam and is easy marks if you prepare it.
The exam is up to 90 questions in 90 minutes, mixing multiple choice with performance-based questions (PBQs), and you need a scaled 750 out of 900 to pass. The PBQs are interactive tasks that ask you to do something, such as classify items, configure a setting, or interpret output, and they usually appear first and take the most time. That makes time management the single biggest exam-day skill, a point this guide returns to.
Why it is a judgement exam, not a memory test
Most Security+ questions describe a situation and ask for the best response rather than a definition. Two answers will often both be plausible, and the right one reflects sound security judgement: choosing the control that actually addresses the risk, preferring prevention where it is cheaper, and matching the response to the scenario. This is why understanding why a control exists beats memorising its name. The PBQs reinforce the same point by making you apply knowledge rather than recall it. Throughout this course, the worked examples are teaching illustrations of that reasoning, never exam questions.
How to use this course
Read the chapters in order. Chapter 2 establishes the vocabulary and cryptography that the later domains assume, and the operations and governance chapters build on the threats and architecture you cover first. Treat the bold terms as a checklist you can explain in a sentence. Pair every chapter with hands-on practice, because the PBQs reward doing, and use the official objectives as your master list to tick off. The final chapters turn the content into a schedule and a walk-through of the exam. One note on integrity that matters for this credential: CompTIA prohibits unauthorised training materials, including any site offering “real exam questions”, so build your skills from the objectives, reputable courses and practice, not from leaked content.
Chapter 2: General Security Concepts (12%)
This domain is the foundation the whole exam builds on. It is the vocabulary and the cryptography that the other four domains assume you already know.
The CIA triad, AAA and control classification
Security exists to serve three goals captured in the CIA triad: confidentiality (only authorised people see data), integrity (data is accurate and unaltered), and availability (data and systems are there when needed). Close behind sits non-repudiation, the assurance that someone cannot deny an action they took, usually achieved with digital signatures. Access control runs on AAA: authentication (proving who you are), authorisation (what you are allowed to do), and accounting (recording what you did), with RADIUS and TACACS+ as the protocols that centralise it.
A signature Security+ skill is classifying any control two ways at once. By category, a control is technical (enforced by technology, like a firewall), managerial (policies and procedures), operational (carried out by people, like security training), or physical (locks, fences, guards). By type, it is preventive (stops an event), deterrent (discourages one), detective (spots one), corrective (fixes it afterwards), compensating (an alternative when the primary control is not feasible), or directive (instructs behaviour). The exam loves asking for both at once, so train the habit. As a teaching example: a security guard is a control that is physical by category and can be both deterrent (their presence discourages intruders) and preventive (they physically stop entry).
Zero trust and change management
Zero trust is the modern principle of “never trust, always verify”, which abandons the old idea that being inside the network perimeter makes a request safe. For SY0-701 you should know its structure: the control plane makes access decisions and the data plane carries them out, and decisions flow through a policy engine (which decides), a policy administrator (which issues the access), and a policy enforcement point (which grants or blocks it), with adaptive identity adjusting trust to context. The domain also covers change management as a security topic, because uncontrolled changes cause outages and open gaps. A documented, approved change process, with impact analysis, testing and a rollback plan, is itself a security control.
Cryptography fundamentals
The cryptography here is foundational and reappears across the exam, so anchor it on three ideas. Symmetric encryption uses one shared key, is fast, and suits bulk data (AES); its weakness is distributing the key safely. Asymmetric encryption uses a public/private key pair (RSA, ECC), which solves key exchange and enables signatures but is slower, so real systems combine the two, using asymmetric crypto only to exchange a symmetric key. Hashing is one-way (SHA-2): it produces a fixed-length digest that proves integrity but cannot be reversed, and a salt, random data added before hashing, stops attackers using precomputed tables against stored passwords. From these come a digital signature (a hash encrypted with the sender’s private key, proving integrity and origin) and PKI, where Certificate Authorities issue certificates that bind a public key to an identity, with revocation tracked by a CRL or checked live through OCSP. Round it out with hardware roots of trust: a TPM secures keys on a device, and an HSM does so for servers at scale.
Chapter 3: Threats, Vulnerabilities and Mitigations (22%)
This is the largest knowledge domain and the heart of “knowing the enemy”. It covers who attacks, how they get in, the weaknesses they exploit, and how you reduce the risk.
Threat actors and their motivations
The exam expects you to recognise the main threat actors and what drives them, because the actor shapes the threat. A nation-state actor is well-resourced and patient, often pursuing espionage through advanced persistent threats. Organised crime is financially motivated, behind much ransomware and fraud. A hacktivist acts for a cause or ideology. An insider threat comes from someone with legitimate access, which makes it dangerous and hard to detect. An unskilled attacker (sometimes called a script kiddie) uses others’ tools without deep knowledge. Knowing the actor helps you reason about likely attacks and proportionate defences.
Attack surfaces, vectors and social engineering
An attack surface is everything that could be attacked, and a vector is the path in: email, messaging, removable media, unsecured networks, the supply chain, and people themselves. Social engineering manipulates people rather than technology, and you should know its forms: phishing (fraudulent messages at scale), spear phishing (targeted) and whaling (aimed at executives), vishing (by voice), smishing (by text), pretexting (an invented scenario), and business email compromise. The reason social engineering matters so much is that it bypasses technical controls entirely, which is why awareness training is one of its few real mitigations.
Vulnerabilities and indicators of malicious activity
A vulnerability is a weakness an attacker can exploit, and the exam spans application flaws (such as injection and cross-site scripting), operating-system and hardware weaknesses, cloud and supply-chain risks, and the zero-day, a flaw exploited before a patch exists. You also need to recognise indicators of compromise, the evidence that an attack is underway: unusual account activity, unexpected outbound traffic, new or modified files, or alerts from your tooling. The skill is reading a description and recognising the likely attack or weakness behind it.
Mitigation techniques
The payoff of this domain is knowing how to reduce risk. The core techniques recur throughout the exam: segmentation so a breach cannot spread, hardening to shrink the attack surface by removing or securing unnecessary features, patch management to close known holes, least privilege so a compromised account can do little, isolation and sandboxing to contain risk, and monitoring to catch what slips through. As a teaching example to match attack to mitigation: against phishing the layered answer is awareness training plus email filtering plus MFA, so that even a stolen password is not enough on its own. That layered instinct, rather than a single silver bullet, is what the exam rewards.
Chapter 4: Security Architecture (18%)
This domain is about designing systems that fail safely and protecting the data inside them. It rewards understanding trade-offs rather than memorising products.
Architecture models and their trade-offs
You should be able to compare the main ways systems are built and the security implications of each. On-premises gives full control but full responsibility. Cloud shifts some responsibility to a provider under a shared responsibility model, where what you must secure depends on the service type. Serverless and microservices break applications into small pieces, which improves scalability but multiplies the components to secure. IoT devices are often weakly secured and numerous, and ICS/SCADA systems that run industrial processes prioritise availability and uptime, which constrains how you patch and protect them. The exam tests whether you can pick a sensible approach for a scenario and name its risks.
Secure design principles
Several principles guide good architecture. Defense in depth layers controls so no single failure is fatal. Secure protocols should replace plaintext ones wherever possible. A key design decision is fail-open versus fail-closed: a system that fails open stays available but may be insecure, while one that fails closed stays secure but may block legitimate use, and the right choice depends on whether availability or security matters more for that system. A door that unlocks in a fire fails open to protect life; a firewall that blocks traffic when it fails closed protects the network.
Data protection, resilience and recovery
Protecting data is central. Beyond classification and encryption at rest and in transit, the exam covers tokenisation (replacing sensitive data with a non-sensitive stand-in), masking (hiding part of a value, like showing only the last four digits), and DLP (Data Loss Prevention, which stops sensitive data leaving). Resilience keeps systems available: high availability through redundancy removes single points of failure, and backups follow the 3-2-1 rule (three copies, on two media types, with one offsite). Recovery sites trade cost against speed: a hot site is ready almost immediately, a cold site is cheap but slow to bring online, and a warm site sits between them. As a teaching example to read a resilience scenario: a service that cannot tolerate downtime points toward high availability and a hot site, while one where some downtime is acceptable can use a warm or cold site to save money.
Chapter 5: Security Operations (28%)
This is the largest and most hands-on domain, the day-to-day work of keeping systems secure. Expect performance-based questions here, so practise the tasks, not just the terms.
Hardening, asset management and the device lifecycle
Operations starts with secure baselines. Hardening reduces a system’s attack surface by disabling unused services, closing unnecessary ports, enforcing strong configurations and applying patches. Asset management tracks devices and software across their lifecycle, from secure provisioning through maintenance to safe decommissioning and data destruction, because you cannot protect what you do not know you have. The recurring idea is that a known, minimal, well-configured estate is far easier to defend than a sprawling, unmanaged one.
Identity and access management in practice
IAM is where many operational marks live. Build it from provisioning and deprovisioning (creating accounts with the right access and, crucially, removing them promptly when people leave), MFA (combining two or more different factors, which defeats most stolen-password attacks), SSO and federation (one authentication across many systems, with trust extended between organisations), and privileged access management (PAM), which tightly controls and monitors powerful administrative accounts. Underpinning all of it is least privilege: grant only the access required, and review it regularly. As a teaching example of an operations instinct: when an employee changes roles, the right action is to adjust their access to the new role rather than simply adding the new permissions on top, because accumulated access (“privilege creep”) is a real risk.
Monitoring, vulnerability management and automation
Operations depends on visibility. Vulnerability management is a cycle of scanning, interpreting results, prioritising by real-world risk, remediating, and validating the fix. Monitoring centres on a SIEM (Security Information and Event Management) system that collects and correlates logs to raise alerts, fed by sources across the estate, with IDS/IPS detecting or blocking malicious traffic. SOAR (Security Orchestration, Automation and Response) automates and orchestrates repetitive response steps, which speeds reaction and reduces human error. The point the exam rewards is that data is only useful if it is collected, correlated and acted on.
Incident response and digital forensics
When prevention fails, response matters, and the exam expects the incident response lifecycle in order: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Two points recur. First, containment generally comes before eradication: you limit the spread before removing the cause, to protect the business fastest. Second, lessons learned closes the loop and improves future defence. Where evidence may be needed later, basic digital forensics applies, above all chain of custody, the documented, unbroken handling of evidence that keeps it admissible. A tabletop exercise, a discussion-based rehearsal of the plan, is the low-cost way to test readiness before a real incident.
Chapter 6: Security Program Management and Oversight (20%)
This is the governance domain. It feels less technical, but it is a full fifth of the exam and rewards preparation, because the concepts are clear once you learn the vocabulary.
Governance, policies and roles
Governance is the framework of oversight that keeps security aligned with the organisation and accountable to it. You should know the document hierarchy: policies set high-level intent, standards make specific requirements mandatory, procedures give step-by-step instructions, and guidelines offer recommended (non-mandatory) practice. Around these sit defined roles and responsibilities, including the data owner who is accountable for information and the custodian who protects it day to day. The exam treats clear, documented governance as the backbone that makes everything else enforceable.
Risk management
This domain formalises the risk thinking that runs through the whole exam. Risk management is a cycle of identifying, assessing, responding to, and monitoring risk. Assessment can be qualitative (descriptive ratings) or quantitative (monetary, using SLE, ARO and ALE, where ALE equals SLE times ARO). The four responses are mitigate (reduce it), transfer (shift it, for example via insurance), avoid (stop the risky activity), and accept (live with it knowingly). A risk register records risks and their treatment, and risk appetite and tolerance define how much risk the organisation will accept, which in turn justifies how much to spend on controls.
Third-party risk, compliance and security awareness
Organisations depend on suppliers, so third-party risk management covers assessing vendors, securing contracts, and managing supply-chain risk, because a partner’s weakness becomes yours. Compliance covers the laws, regulations and privacy rules the organisation must meet, verified through internal and external audits and attestation, and the exam treats compliance as non-negotiable. Finally, security awareness builds a security culture through training, phishing simulations and clear reporting channels, recognising that people are both the largest attack surface and, when well trained, a strong line of defence. As a teaching example of why this matters: many breaches begin with a tricked employee, so investing in awareness often reduces risk more than another technical control.
Chapter 7: Study plan, performance-based questions, and exam day
Allocate time by domain weight
With the content understood, pace it by the weights so nothing important gets squeezed out. Give the most time to Security Operations (28%) and Threats (22%), solid time to Security Program Management (20%) and Architecture (18%), and a focused pass on the foundational General Security Concepts (12%) that the rest depends on. A comfortable plan for most people runs about eight weeks at six to eight hours a week, roughly one domain a week with a weekly review, then a final two weeks on full mocks and PBQ practice. People with IT experience can compress to a four-week intensive at twelve to fifteen hours a week, while complete beginners should stretch to ten to twelve weeks and budget extra time for the hands-on tasks. To turn whichever timeline you pick into dated weeks for your own start date, use the free study-plan generator.
Practise the performance-based questions deliberately
The PBQs are where many candidates lose time, so prepare them on purpose rather than hoping. Set up a small lab, two virtual machines and a free SIEM trial are enough, and practise real tasks: classify controls, read and interpret logs, configure MFA, match attacks to mitigations, and walk the incident-response phases. The habit to build is doing, not recognising, because that is exactly what the interactive questions test. Move from reading to practice questions as soon as you have covered a domain, and review every wrong answer to understand why the better option won. If you are deciding what to study after Security+, the Security+ vs CySA+ comparison lays out the defensive-analyst next step.
Exam day and format
On the day, you have up to 90 questions in 90 minutes at a Pearson VUE centre or online with OnVUE remote proctoring, and you need 750 out of 900 to pass. The performance-based questions usually come first and are the most time-consuming, so the single most useful tactic is to flag and return: if a PBQ stalls you, mark it, bank the quicker multiple-choice marks, and come back with the time you have left. If you test online, run the system check in advance and clear your desk and room, since the proctor will require it. Apply the same scenario-driven reasoning you practised: read for the best response, choose the control that addresses the actual risk, and trust the hands-on judgement you built over the weeks of study.