CompTIA Security+ SY0-701 — the complete study guide

Security+ is the exam most people sit first, and the one most people prepare for badly. It is not a memory test. It is a test of whether you can read a short scenario, work out what is actually being asked, and pick the most appropriate control — which is often not the strongest one.

This guide is organised the way the exam is organised, and it tells you where the marks actually are.

The exam at a glance#

The performance-based questions (PBQs) come first. They are worth more than a single multiple-choice item and they eat time. Flag them, skip them, do the multiple choice first, then come back. Nearly everyone who runs out of time on Security+ ran out because they wrestled a PBQ for fifteen minutes at the start.

Domain weightings — where to spend your hours#

Two things fall out of that table. First, Security Operations is more than a quarter of the exam — if your revision is all attack types and no logging, hardening or incident response, you are studying the wrong quarter. Second, Domain 5 is a fifth of the exam and it is governance: policies, risk, third-party management, compliance. Technical people routinely skip it and routinely fail because of it.

Domain 1 — General Security Concepts (12%)#

The vocabulary layer. Get this wrong and every other domain becomes harder, because the exam writes its questions in this language.

• The CIA triad, plus non-repudiation and authenticity. Know which property a given control protects — encryption at rest protects confidentiality, a hash protects integrity, a backup protects availability.
• AAA: authentication, authorisation, accounting. Be able to say which one has failed in a scenario.
• Control categories (technical, managerial, operational, physical) and control types (preventive, deterrent, detective, corrective, compensating, directive). This is a guaranteed question. A security guard is physical and can be deterrent or preventive depending on how the question frames it; a log review is detective; a compensating control is what you use when the primary control is not feasible.
• Zero Trust, split into the control plane (policy engine, policy administrator, policy enforcement point) and the data plane. Know the phrase "never trust, always verify" and what an adaptive identity actually is.
• Change management — approval, ownership, impact analysis, backout plans, maintenance windows. The exam cares that changes are documented and reversible.
• Cryptography basics: symmetric vs asymmetric, PKI, key escrow, digital signatures, hashing, salting, key stretching, blockchain, certificates and their lifecycle.

Domain 2 — Threats, Vulnerabilities and Mitigations (22%)#

The domain people enjoy, which is why it is usually the best-prepared one.

• Threat actors by motivation and sophistication: nation-state, organised crime, hacktivist, insider, unskilled attacker, shadow IT. The exam will describe behaviour and ask you to identify the actor — funding and persistence point to nation-state; financial motive points to organised crime.
• Attack surfaces and vectors: message-based, image-based, file-based, voice call, removable device, vulnerable software, unsupported systems, unsecured networks, supply chain.
• Social engineering: phishing, vishing, smishing, misinformation, impersonation, business email compromise, pretexting, watering hole, brand impersonation, typosquatting.
• Vulnerabilities: application (buffer overflow, race condition/TOCTOU, memory injection), web (SQLi, XSS), operating system, hardware (firmware, end-of-life, legacy), virtualisation (VM escape, resource reuse), cloud, supply chain, cryptographic (downgrade, collision, birthday), and misconfiguration.
• Indicators of each attack type — this is the heart of the domain. Account lockouts and concurrent session usage suggest credential attacks; impossible travel suggests account takeover; blocked content and out-of-cycle logging suggest tampering.
• Mitigations: segmentation, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning, hardening.

Domain 3 — Security Architecture (18%)#

Design decisions and their trade-offs.

• Architecture models: cloud (responsibility matrix, hybrid, third-party vendors), infrastructure as code, serverless, microservices, network infrastructure (physical, software-defined), on-premises, centralised vs decentralised, containerisation, virtualisation, IoT, ICS/SCADA, RTOS, embedded systems.
• Design considerations — availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, compute.
• Secure infrastructure: device placement, security zones, attack surface, connectivity, and the failure modes — fail-open vs fail-closed, active vs passive, inline vs tap/monitor. Know when a device sitting inline is a single point of failure.
• Data protection: classify data (regulated, trade secret, intellectual property, legal, financial; sensitive, confidential, public, restricted, critical), know states (at rest, in transit, in use), and the methods — geographic restrictions, encryption, hashing, masking, tokenisation, obfuscation, segmentation, permission restrictions.
• Resilience and recovery: high availability, load balancing vs clustering, site considerations (hot, warm, cold, geographic dispersion), platform diversity, multi-cloud, continuity of operations, capacity planning, testing (tabletop, failover, simulation, parallel processing), backups, and power (generators, UPS).

Domain 4 — Security Operations (28%)#

The largest domain. If your study time is limited, this is where it goes.

• Hardening: mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS/SCADA, embedded, RTOS, IoT. Know the standard moves — disable unnecessary services, default password changes, host-based firewalls, HIPS, patching, encryption.
• Asset management: acquisition, assignment/ownership, classification, monitoring, tracking, and disposal (sanitisation, destruction, certification, data retention).
• Vulnerability management: identification (scanning, threat feeds, OSINT, penetration testing, responsible disclosure, bug bounty, system/process audits), analysis (CVSS, CVE, false positive/negative, prioritisation, exposure factor, environmental variables), response (patching, insuring, segmentation, exceptions and exemptions), validation (rescanning, audit, verification), and reporting.
• Alerting and monitoring: log aggregation, alerting, scanning, reporting, archiving; SCAP, benchmarks, agent vs agentless, SIEM, antivirus, DLP, SNMP traps, NetFlow.
• Enterprise capability modification: firewall rules and ACLs, screened subnets, IDS/IPS trends and signatures, web filtering, DNS filtering, email security (DMARC, DKIM, SPF, gateways), file integrity monitoring, DLP, network access control, EDR/XDR, user behaviour analytics.
• Identity and access management: provisioning and deprovisioning, permission assignment, identity proofing, federation, SSO (LDAP, OAuth, SAML), interoperability, attestation, access controls (mandatory, discretionary, role-based, rule-based, attribute-based, time-of-day, least privilege), MFA factors, and password concepts.
• Automation and scripting for user provisioning, resource provisioning, guard rails, security groups, ticket creation, escalation, enabling and disabling services, continuous integration and testing, and API integration.
• Incident response: preparation, detection, analysis, containment, eradication, recovery, lessons learned. Training, testing (tabletop, simulation), root cause analysis, threat hunting, and digital forensics (legal hold, chain of custody, acquisition, reporting, preservation, e-discovery).

Domain 5 — Security Program Management and Oversight (20%)#

The domain technical candidates lose marks on. Do not skip it.

• Governance: guidelines, policies (AUP, information security, business continuity, disaster recovery, incident response, SDLC, change management), standards (password, access control, physical security, encryption), procedures (change management, onboarding/offboarding, playbooks), external considerations (regulatory, legal, industry, local/regional, national, global), monitoring and revision, governance structures (boards, committees, government entities, centralised/decentralised), and roles (owners, controllers, processors, custodians/stewards).
• Risk management: identification, assessment (ad hoc, recurring, one-time, continuous), analysis (qualitative, quantitative, SLE, ALE, ARO), risk register, key risk indicators, risk appetite and tolerance, and risk response (transfer, accept — with exemption and exception — avoid, mitigate). Business impact analysis: RTO, RPO, MTTR, MTBF.
• Third-party risk: vendor assessment (penetration testing, right-to-audit clause, evidence of internal audits, independent assessments, supply chain analysis), vendor selection (due diligence, conflict of interest), agreement types (SLA, MOA, MOU, MSA, WO/SOW, NDA, BPA), and monitoring.
• Compliance: reporting, monitoring, consequences of non-compliance (fines, sanctions, reputational damage, loss of licence, contractual impacts), attestation, and privacy (legal implications, data subject, controller vs processor, ownership, retention, right to be forgotten).
• Audits and assessments: internal (compliance, audit committee, self-assessment) and external (regulatory, examinations, assessment, independent third-party audit), plus penetration testing (physical, offensive, defensive, integrated, known/partially known/unknown environment).
• Security awareness: phishing campaigns and recognition, anomalous behaviour recognition, user guidance and training, reporting and monitoring, development and execution.

Formulas worth memorising#

SLE  = Asset Value × Exposure Factor
ALE  = SLE × ARO
ARO  = expected occurrences per year
 
RTO  = how long you can be down
RPO  = how much data you can afford to lose
MTTR = mean time to repair
MTBF = mean time between failures

These appear as straightforward calculation questions. They are free marks.

A six-week study plan#

Week 1 — Domain 1 and crypto. Build the vocabulary. Make a table of control categories against control types and fill it with ten real examples.

Week 2 — Domain 2. Threat actors, attack vectors, vulnerability types, indicators. Map each attack to its indicator; that mapping is the exam.

Week 3 — Domain 3. Architecture models and data protection. Draw the network zones yourself rather than reading someone else's diagram.

Week 4 — Domain 4, part one. Hardening, vulnerability management, monitoring tooling. Get hands-on: run a scan, read a real CVSS vector, patch something.

Week 5 — Domain 4, part two, and Domain 5. IAM, incident response, governance, risk formulas, agreement types. Drill the acronyms until they are automatic.

Week 6 — Practice exams only. Sit full-length timed papers. For every wrong answer write one sentence explaining why the right answer is better — not what the right answer was. That sentence is the actual revision.

How the questions are written#

Four patterns cover most of the exam:

1. "Which is the BEST/MOST likely…" — several answers are defensible. Pick the one that addresses the root of the scenario, not a symptom.
2. "An analyst observes X. What is happening?" — indicator-to-attack mapping.
3. "Which control would have prevented this?" — note the tense. Prevented rules out every detective control in the answer list.
4. Calculation — SLE/ALE/ARO. Read the units carefully.

Resources that are actually worth the time#

• The official CompTIA exam objectives PDF. Free. It is a checklist — print it, and tick items off only when you could explain them to someone else.
• Professor Messer's SY0-701 course — free, complete, and mapped to objectives.
• One good practice-exam bank. Use it for diagnosis, not for memorising items.
• A lab. Anything you can break and fix: a home hypervisor, a free-tier cloud account, TryHackMe. The hands-on domains stop being abstract the moment you have typed the commands.

The last thing#

Security+ rewards steady, structured preparation more than intensity. Six focused weeks beats two frantic ones, and the people who fail are usually the ones who studied only the half of the syllabus they found interesting.

Work the objectives list. All of it.