CompTIA Security+ (SY0-701)

This guide is for readers preparing for CompTIA Security+ SY0-701 and for IT professionals who need a stronger baseline in modern security operations. Security+ is broad on purpose. It tests whether you can choose the control that actually fits the scenario, explain why one option reduces risk better than another, and avoid answers that sound secure but break least privilege, evidence handling, availability, or business practicality.

PBQ: Performance-based question, a hands-on exam item that asks you to apply the concept instead of only recognizing the right definition.

Least privilege: Giving identities and systems only the access they need to perform the task and nothing broader.

Current exam snapshot

As of March 28, 2026, CompTIA’s Security+ certification page identifies SY0-701 as the active exam series and lists:

Because CompTIA usually retires an exam about three years after launch, this guide is deliberately modular. Each official domain has its own chapter page, and each major objective group has its own section page so the guide is easier to refresh when CompTIA revises the blueprint.

How to use this guide well

    flowchart LR
	  S["Study Plan"] --> D["Domain chapters"]
	  D --> L["Objective-group lessons"]
	  L --> C["Cheat Sheet and Glossary"]
	  C --> M["Mixed practice and miss-log review"]
	  M --> R["Resources for final scope check"]

What to notice:

• the chapter pages route you into the right domain quickly
• the section pages are the main learning units
• the appendix pages support review, but they should not replace the lesson pages

If you are building from scratch, start with the study plan. If you already know the basics but keep missing mixed scenario questions, go directly into the five domain chapters and keep the cheat sheet open beside your practice set. If you are close to exam day, use the faq, glossary, and resources pages to tighten scope and eliminate avoidable misses.

Best entry path by background

Security+ is broad enough that your weak spots usually depend on where you are starting.

Coverage map against the current exam objectives summary

CompTIA’s current Security+ page breaks the exam into five weighted domains. This guide follows those domains directly.

The cross-domain patterns you should expect repeatedly

Security+ keeps reusing the same design ideas in different wording:

• least privilege beats convenience when access choices are close
• detection alone is not enough if the scenario is really asking for prevention, containment, or recovery
• confidentiality, integrity, and availability trade off differently depending on the system and business goal
• identity and segmentation often matter more than a bigger perimeter appliance
• evidence handling and documentation matter whenever incident response, change management, or audits appear

What CompTIA keeps mixing together on purpose

Many wrong answers come from treating the domains like isolated silos. Security+ usually blends them:

• threat questions often become mitigation or operations questions after the first sentence
• architecture questions often become recovery, privacy, or data-handling questions by the end
• governance and compliance questions still expect you to choose technically realistic controls

If you are under time pressure, protect 4. Security Operations first, then 2. Threats, Vulnerabilities & Mitigations, then the domain where your professional background is weakest.

Use the appendix pages as support layers rather than substitutes for the main guide:

• Study Plan for paced preparation
• Cheat Sheet for compressed review
• Glossary when similar terms blur together
• FAQ for exam logistics and strategy
• Resources for CompTIA and primary security references

In this section

• CompTIA Security+ (SY0-701) Study Plan
  Use a realistic SY0-701 study sequence built around CompTIA's five Security+ domains, quizzes, labs, and mixed review.
• Study General Security Concepts for Security+ (SY0-701)
  Work through control types, security principles, change management, and core cryptography for the opening Security+ domain.
  • Compare Security Controls for Security+ (SY0-701)
    Learn how Security+ classifies technical, managerial, operational, physical, preventive, detective, corrective, compensating, deterrent, and directive controls.
  • Explain Security Principles and Zero Trust for Security+ (SY0-701)
    Understand CIA, AAA, non-repudiation, zero trust, and deception technology well enough to apply them correctly in Security+ scenarios.
  • Use Change Management Safely for Security+ (SY0-701)
    Understand approval, testing, rollback, documentation, and version-control decisions for the Security+ change-management objectives.
  • Use Cryptographic Solutions for Security+ (SY0-701)
    Understand PKI, encryption, hashing, digital signatures, obfuscation, and certificate workflows for the cryptography objectives on Security+.
• Study Threats, Vulnerabilities, and Mitigations for Security+ (SY0-701)
  Map attacker motives, attack paths, vulnerabilities, malicious activity, and defensive responses for the heaviest early Security+ scenario set.
  • Compare Threat Actors and Motivations for Security+ (SY0-701)
    Understand how Security+ distinguishes insider, criminal, hacktivist, nation-state, shadow IT, and other actor motives in scenario questions.
  • Analyze Threat Vectors and Attack Surfaces for Security+ (SY0-701)
    Recognize phishing, social engineering, exposed services, unsecure networks, supply-chain paths, and other attack surfaces on Security+.
  • Identify Vulnerabilities for Security+ (SY0-701)
    Understand application, hardware, mobile, virtualization, operating system, cloud, web, and supply-chain vulnerabilities for Security+.
  • Analyze Malicious Activity for Security+ (SY0-701)
    Recognize malware, password, application, physical, network, and cryptographic attacks well enough to separate them in Security+ scenarios.
  • Choose Mitigation Techniques for Security+ (SY0-701)
    Use segmentation, access control, hardening, isolation, patching, and related defensive choices correctly in Security+ scenarios.
• Study Security Architecture for Security+ (SY0-701)
  Learn how Security+ frames architecture models, enterprise infrastructure, data protection, and resilience as connected design decisions.
  • Compare Architecture Models for Security+ (SY0-701)
    Understand on-premises, cloud, virtualization, IoT, ICS, and infrastructure-as-code models through the lens Security+ uses.
  • Apply Enterprise Infrastructure Security for Security+ (SY0-701)
    Learn how Security+ frames segmentation, secure access, communication paths, and control selection for enterprise infrastructure.
  • Protect and Classify Data for Security+ (SY0-701)
    Understand data types, classification, lifecycle handling, and protection methods such as encryption, tokenization, masking, and DLP for Security+.
  • Design Resilience and Recovery for Security+ (SY0-701)
    Understand high availability, backup strategy, site models, testing, power protection, and continuity decisions for Security+.
• Study Security Operations for Security+ (SY0-701)
  Work through baselines, asset handling, vulnerability workflows, monitoring, IAM operations, automation, and incident response for the largest Security+ domain.
  • Apply Secure Baselines and Hardening for Security+ (SY0-701)
    Understand secure baselines, host and mobile hardening, wireless protection, application security, sandboxing, and operational monitoring for Security+.
  • Manage Assets for Security+ (SY0-701)
    Understand hardware, software, and data asset acquisition, assignment, disposal, tagging, monitoring, and ownership for Security+.
  • Run Vulnerability Management for Security+ (SY0-701)
    Understand how Security+ treats identification, analysis, prioritization, remediation, validation, and reporting in vulnerability management.
  • Use Alerting, Monitoring, and Telemetry for Security+ (SY0-701)
    Understand logs, metrics, alerts, SIEM, UEBA, and monitoring workflows for Security+ operational scenarios.
  • Operate Enterprise Security Controls for Security+ (SY0-701)
    Learn how Security+ frames firewall changes, IDS/IPS, DNS filtering, DLP, NAC, and EDR/XDR tuning in operations scenarios.
  • Run Identity and Access Operations for Security+ (SY0-701)
    Understand provisioning, SSO, MFA, privileged access, and operational IAM decisions for Security+.
  • Use Automation and Orchestration for Security+ (SY0-701)
    Learn when Security+ expects automation, scripting, and orchestration to reduce error and speed repeatable security operations safely.
  • Run Incident Response and Forensics for Security+ (SY0-701)
    Understand incident phases, training, testing, root cause analysis, threat hunting, and evidence handling for Security+.
  • Use Data Sources in Investigations for Security+ (SY0-701)
    Learn which log, network, identity, and endpoint data sources support Security+ investigations and why source quality matters.
• Study Security Program Management and Oversight for Security+ (SY0-701)
  Cover governance, risk, third-party oversight, compliance, audits, and awareness training for the Security+ program-management domain.
  • Explain Security Governance for Security+ (SY0-701)
    Understand policies, standards, procedures, roles, governance structures, and oversight responsibilities for Security+.
  • Manage Risk for Security+ (SY0-701)
    Understand risk identification, registers, appetite, tolerance, treatment, and business impact analysis for Security+.
  • Manage Third-Party Risk for Security+ (SY0-701)
    Understand vendor assessment, selection, agreements, monitoring, and rules of engagement for the third-party-risk objectives on Security+.
  • Handle Security Compliance and Privacy for Security+ (SY0-701)
    Understand compliance reporting, non-compliance consequences, monitoring, privacy, and regulated-data obligations for Security+.
  • Understand Audits and Assessments for Security+ (SY0-701)
    Learn how Security+ distinguishes internal and external audits, attestation, assessments, and penetration testing.
  • Run Security Awareness and Training for Security+ (SY0-701)
    Understand phishing training, user guidance, anomaly reporting, and awareness-program design for Security+.
• CompTIA Security+ (SY0-701) Cheat Sheet
  High-yield SY0-701 review sheet for control selection, zero trust, attack patterns, architecture choices, operations workflows, and GRC anchors.
• CompTIA Security+ (SY0-701) Glossary
  Security+ glossary for high-confusion SY0-701 terms across IAM, crypto, resilience, incident response, risk, and control categories.
• CompTIA Security+ (SY0-701) FAQ
  Current SY0-701 Security+ FAQ covering exam format, PBQs, study strategy, zero trust, IAM, crypto, incident response, and GRC.