Study guide · Exam overview
The format, passing score, and five published domains of CompTIA Security+ SY0-701, plus the distinctions worth learning before you book.
Exam version notice: This overview follows CompTIA Security+ exam objectives version 6.0 for SY0-701, reviewed in October 2026. CompTIA calls that version Security+ V7. The exam allows a maximum of 90 questions in 90 minutes, and CompTIA publishes a passing score of 750 on a scale of 100 to 900. CompTIA has said Security+ V8 is expected on or around November 17, 2026. Items tagged Extra are useful context the SY0-701 objective list does not name. Confirm the exam code, fee, and objectives with CompTIA before you register.
CompTIA Security+ is the vendor-neutral certification for people who assess a security posture, monitor hybrid environments, and respond to incidents. SY0-701 checks whether you can name a control, tell attacks apart, place a security device, operate identity and monitoring tools, and explain governance and risk. It is not a senior architect exam, and it does not ask you to configure a specific vendor's console from memory.
Figures below come from the SY0-701 objectives version 6.0 and CompTIA's Security+ pages reviewed in October 2026.
| Specification | SY0-701 (Security+ V7) |
|---|---|
| Level | Foundational security. No prior certification is required. CompTIA recommends two years of IT administration with a security focus. |
| Length of test | 90 minutes. |
| Question types | Multiple choice and performance-based questions. The stem says how many answers to choose. |
| Number of questions | Maximum of 90. |
| Passing score | 750 on a scale of 100 to 900. CompTIA does not publish the raw-score conversion. |
| Objectives | Version 6.0. Five domains. Example lists in the objectives are not exhaustive. |
| Exam price | Confirm the current voucher price with CompTIA. Regional pricing changes. |
| Validity | Three years from the pass date. Confirm renewal options with CompTIA. |
| Later version | Security+ V8 is expected on or around November 17, 2026. V7 remains the SY0-701 exam described here. |
CompTIA publishes these weights. The 200 practice questions use the same share.
Controls, the CIA triad, zero trust, change management, and cryptography.
Who attacks, how they get in, and what you do about it.
Where controls sit, and how the environment survives a failure.
The largest domain. Day-to-day security work.
Governance, risk math, vendors, compliance, and awareness.
Learn the unmarked rows first. The same map is in the core notes and flashcards.
| Pair | How to separate them |
|---|---|
| Preventive and detective | Preventive stops the action. Detective finds it. Corrective repairs it. Deterrent discourages it. |
| Policy Engine and PEP | The engine decides. The Policy Enforcement Point allows or blocks the request. |
| Hash and encryption | A hash is one-way. Encryption is reversible with the right key. |
| Smishing and vishing | Smishing is a text. Vishing is a voice call. |
| Worm and virus | A worm spreads on its own. A virus needs a host. |
| CVE and CVSS | CVE names the flaw. CVSS scores it. |
| SPF, DKIM, and DMARC | SPF lists senders. DKIM signs the message. DMARC says what to do when they fail. |
| SAML and OAuth | SAML carries a sign-in assertion. OAuth issues an authorization token. |
| RTO and RPO | RTO is downtime. RPO is how much data you can lose. |
| OpenID Connect Extra | Often used with OAuth for sign-in. The SY0-701 bullets name OAuth and SAML, not OpenID Connect. |
Most items are multiple choice. Some ask you to choose two or three answers, and the stem says so. Performance-based items ask you to match a term to a job or put a process in order. Read FIRST, NEXT, and BEST as ordering words: the right control at the wrong time is still wrong.
CompTIA says the example lists in the objectives are not exhaustive. A question can use a technology that fits an objective even when the PDF did not print that product name. Do not expect vendor console screenshots.
A practical sequence if attacks, logs, and risk formulas still blur together.
Say whether a control is technical, managerial, operational, or physical, and whether it prevents, detects, corrects, deters, compensates, or directs. Then place CIA and zero trust on one sentence each.
Text, voice, lookalike domain, trusted website, self-spreading malware, and a query that changed. Say the mitigation that stops that path.
Inline versus tap. Fail open versus fail closed. Hot, warm, and cold. RTO versus RPO. A screened subnet versus the internal database network.
SAML, OAuth, and the access models. Then say the incident order out loud: prepare, detect, analyze, contain, eradicate, recover, and learn.
SLE is asset value times exposure factor. ALE is SLE times the annualized rate. Then pick avoid, mitigate, transfer, or accept, and name the agreement that fits the vendor.
Use the four flashcard decks until you can answer before the card flips. Then take original questions and return to any domain under 75 percent. Use 90 minutes as the pace of the live exam. Treat the 100 to 900 estimate as a personal trend, not a prediction.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 750 passing score, five domain weights, and a study plan.
Reference notes for controls, threats, architecture, operations, and program management.
40 recall cards in four decks, plus memory notes for attacks, identity, and risk math.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
CompTIA allows a maximum of 90 questions and 90 minutes. Questions are multiple choice and performance-based. Confirm the current details with CompTIA before you book.
CompTIA publishes a passing score of 750 on a scale of 100 to 900 for SY0-701. This site converts a practice percentage linearly onto that scale and labels the result unofficial, because CompTIA does not publish the real conversion.
This page follows exam objectives version 6.0 for SY0-701, which CompTIA calls Security+ V7. CompTIA has said Security+ V8 is expected on or around November 17, 2026. Confirm which exam code you will sit before you study or buy a voucher.
Yes. CompTIA certifications are valid for three years from the date you pass. Renewal options change, so confirm the current policy with CompTIA.
No prior certification is required. CompTIA recommends at least two years of experience in IT administration with a security focus, plus hands-on experience with technical information security.
No. The practice questions on this site are original. They are not CompTIA exam items, and a practice score does not predict a result.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Calculate trigonometric functions, logarithms, powers, roots, factorials, and advanced expressions.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
NodnWebTools provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and Security+ are trademarks of CompTIA, Inc. NodnWebTools is not affiliated with, endorsed by, or sponsored by CompTIA.
Nodn