Everything on the exam, in one place: the five domains and their weights, a four-week study plan, a readiness checklist you can tick off, and cryptography / protocol / access-control cheat sheets — with explained, sourced sample questions throughout.
The CompTIA Security+ (SY0-701) validates the core skills to assess risk, secure systems and networks, respond to incidents, and operate within a governance framework. Here are the numbers that shape how you should study.
Because there can be up to 90 questions in 90 minutes, pacing matters — that's roughly a minute per item, and the performance-based questions (simulations and drag-and-drop) eat more time than a multiple-choice question. The exam is weighted across five domains, and Security Operations (28%) and Threats, Vulnerabilities & Mitigations (22%) together make up half the exam, so they deserve the most study time.
What each domain covers, plus one explained, sourced sample question pulled straight from our question bank so you can see the depth the exam expects. Expand a domain to dig in.
A developer signs a software update by hashing the package and signing the hash with their private key. A recipient wants to confirm both that the file was not altered and that it genuinely came from the developer. Which property does this signing process primarily provide?
A security analyst reviews an intrusion in which attackers defaced the company's public website with political slogans and leaked internal emails to embarrass executives, demanding no payment. Which motivation best characterizes this threat actor?
A bank is replacing its perimeter-based model with zero trust. Architects want every resource request authenticated and authorized on its own, independent of the requester's network location. Which component most directly enforces this per-request evaluation?
A systems administrator must deploy 200 new Windows workstations that all enforce the same approved registry, service, and password settings before going live. Which approach best establishes and consistently enforces this secure baseline?
A security team wants to publish a mandatory, high-level document that states management's intent that all company data be encrypted, without specifying which algorithms or key lengths to use. Which governance artifact best fits this need?
A realistic schedule at roughly 10–12 hours per week. Adjust to your experience — but keep the heaviest weeks on Security Operations and Threats/Vulnerabilities, since they're the biggest slices of the exam.
Control types and functions, the CIA triad and AAA, and cryptography until symmetric vs asymmetric vs hashing — and what each provides — feels automatic. This vocabulary underpins every other domain.
Threat actors and motivations, malware and attack types, then secure design: zero trust, segmentation, data protection, and resilience (RPO/RTO, HA, backups).
The biggest domain: hardening and baselines, monitoring (SIEM/logs), IAM, and incident response — then governance, risk management, and third-party risk. Practice reading scenario → correct control.
Take full practice tests under timed conditions, use the per-domain breakdown to find weak areas, and re-drill them. Keep the last days light.
Tick off each topic as it clicks. Your progress is saved in this browser, so you can come back to it.
Saved only in your browser — nothing leaves this device.
The reference tables worth memorizing cold — cryptography, secure protocols, and access-control models. Bookmark this.
| Type | Examples | Provides |
|---|---|---|
| Symmetric | AES (128/192/256), ChaCha20 | Confidentiality — fast bulk encryption with one shared key |
| Asymmetric | RSA, ECC, Diffie-Hellman | Key exchange, signatures — public/private key pair |
| Hashing | SHA-256, SHA-3 | Integrity — one-way, fixed-length digest |
| HMAC | HMAC-SHA-256 | Integrity + authenticity — keyed hash |
| Digital signature | Hash + sign with private key | Integrity, authenticity, non-repudiation |
| Password hashing | bcrypt, PBKDF2, Argon2 | Slow, salted hashing to resist brute force |
| Insecure | Secure replacement | Port |
|---|---|---|
| HTTP 80 | HTTPS (TLS) | 443 |
| Telnet 23 | SSH | 22 |
| FTP 20/21 | SFTP / FTPS | 22 / 989/990 |
| SNMP v1/v2c 161 | SNMPv3 (auth + priv) | 161 |
| LDAP 389 | LDAPS | 636 |
| SMTP 25 | SMTP + STARTTLS / SMTPS | 587 / 465 |
| DNS 53 | DNS over TLS / DNSSEC | 853 |
| Model | How access is decided | Typical use |
|---|---|---|
| DAC — Discretionary | The resource owner sets permissions | Most file systems / OSes |
| MAC — Mandatory | System enforces labels/clearance; no owner discretion | High-security (e.g. SELinux, military) |
| RBAC — Role-based | Permissions assigned to roles, users to roles | Most enterprises — scalable |
| ABAC — Attribute-based | Policy evaluates attributes (user, resource, context) | Fine-grained, dynamic access |
| Rule-based | Global rules/ACLs (e.g. time-of-day, firewall) | Condition-driven enforcement |
| Term | Meaning |
|---|---|
| Confidentiality | Only authorized parties can read the data (encryption, access control) |
| Integrity | Data is not altered without detection (hashing, signatures) |
| Availability | Systems and data are accessible when needed (HA, backups, DDoS defense) |
| Authentication | Proving who you are (passwords, MFA, biometrics) |
| Authorization | What you're allowed to do once authenticated |
| Accounting | Logging and auditing what was done |
Take a free, explained practice test and see exactly which domains need more work.
Start a practice test