CompTIA Security+ Exam Topics Explained

Domain 3: Security Architecture

Architecture questions ask a different kind of question: not "what is this?" but "how would you build this securely?" The domain spans secure network design (segmentation, zones, firewall and proxy placement, VPNs), cloud and virtualisation models and their security trade-offs, infrastructure as code, embedded and IoT considerations, resilience and recovery (backups, redundancy, site strategies), and data protection — classifying data and securing it at rest, in transit and in use.

Typical question themes include placement decisions (where in a network diagram a sensor or firewall belongs), model selection (which cloud responsibility falls to you versus the provider), and resilience trade-offs (which backup or site strategy meets a stated recovery objective at the lowest cost). This is also fertile ground for performance-based questions, where you might arrange components in a network diagram rather than pick from four options.

Candidates from helpdesk backgrounds often find this the most abstract domain, because few juniors get to design networks. The fix is not more reading but more diagrams: sketch a small business network, then redraw it segmented, then add remote access, and narrate why each control sits where it does. If a network refresher would help before you go deep here, the CompTIA Network+ certification guide covers the underlying networking layer that Security+ quietly assumes.

Domain 4: Security Operations

Domain 4 is the largest slice of working security life: applying secure baselines and hardening systems; managing assets, patches and vulnerabilities; monitoring, logging and alerting; identity and access management in practice (provisioning, least privilege, multifactor authentication, single sign-on); automation; and incident response from detection through containment, eradication, recovery and lessons learned. Digital forensics basics — evidence handling, chain of custody — appear here too.

Question themes are procedural and sequential. Expect "what should the analyst do FIRST" and "what is the NEXT step" stems, where every option is a legitimate action and the mark depends on ordering. Incident response phases are a favourite: memorise the sequence, but also understand what distinguishes containment from eradication in a concrete case, because scenarios test the boundary, not the list.

Log-reading questions are common and worth deliberate practice. You may be shown firewall entries, authentication logs or alert output and asked what happened or what to do about it. If you have never stared at raw logs, spend time with samples until the format stops being noise. Free sample questions on the SY0-701 Security+ exam page include operations-style scenarios you can use to test whether you can read a situation, not just recite a process.

Because operations content is broad, it punishes shallow coverage. When candidates fail Security+, self-reports frequently point at scenario-heavy operational questions — the style of question is examined in depth in how hard the Security+ exam really is, which stays out of scope here.

Domain 5: Security Program Management and Oversight

The final domain zooms out from technology to the organisation. It covers security governance (policies, standards, procedures, guidelines), risk management (assessment, analysis, registers, appetite and tolerance), third-party and supply-chain risk, compliance and privacy obligations, audits and assessments, penetration-testing concepts from a programme perspective, and security awareness training.

The question style shifts noticeably: fewer packets, more paperwork. Typical themes include matching a document type to a purpose (is this a policy or a standard?), interpreting risk calculations conceptually, choosing the right response to a stated risk (accept, transfer, avoid, mitigate), and identifying what belongs in vendor agreements.

Technical candidates habitually deprioritise this domain and regret it. The vocabulary is precise and the distractors exploit sloppiness — risk appetite versus risk tolerance, audit versus assessment, policy versus procedure. The material is not hard; it is simply unfamiliar to people who have never sat in a governance meeting. A few focused evenings of flashcard work typically move accuracy here faster than in any technical domain. If the governance side of security appeals to you more than the technical side, the ISO/IEC 27002-based EXIN Information Security Foundation exam shows what a dedicated management-track qualification looks like.

How the topics turn into actual exam questions

Knowing the syllabus is half the picture; the delivery format shapes how the topics feel on the day. SY0-701 presents a maximum of 90 questions in 90 minutes — most candidates see fewer than 90, because CompTIA seeds unscored trial questions in varying numbers. Scoring is scaled from 100 to 900 with a pass mark of 750; that is a scaled score, not 83 per cent, so do not translate practice percentages directly.

Two question types carry the five domains:

1. Multiple-choice questions, single and multiple response. The multiple-response items tell you how many options to pick. Across all domains, the house style is scenario-first: a short situation, then a question asking for the best, first or most likely answer.
2. Performance-based questions (PBQs), interactive items that typically appear at the start of the exam. They ask you to do something — order steps, match attacks to mitigations, configure a simulated component — and they draw disproportionately on domains 2, 3 and 4, where doing rather than knowing can be simulated.

The tactical side — how to pace PBQs, when to flag and return, and how to drill them before the day — belongs to its own playbook, covered in the Security+ practice test strategy guide, so this article leaves it at one line: never let an early PBQ eat ten minutes you will want later.

Reading the official objectives like an examiner

The objectives PDF from comptia.org is more useful than most candidates realise, because its verbs are a difficulty map. Objectives that begin "compare and contrast" or "explain" are asking for conceptual discrimination — flashcard and comparison-table territory. Objectives that begin "given a scenario" are telling you, explicitly, that this topic will arrive wrapped in a situation and may power a PBQ — these need applied practice, not re-reading.

Work through the document once with a highlighter in two colours: one for "given a scenario" objectives, one for everything else. The scenario list becomes your hands-on practice agenda; the rest becomes your recall agenda. Also read the acronym list at the back — the exam uses acronyms freely, and losing marks because SASE or SCAP did not ring a bell is entirely avoidable.

One more examiner's habit: the bullet lists under each objective are inclusion lists, not decoration. If "24. capacity planning" appears as a sub-bullet, it can be a question. When a practice question surprises you, trace it back to its bullet — you will almost always find it sitting in plain sight.

Common mistakes when mapping the topics to revision

• Revising domains in order and running out of steam. Candidates start at Domain 1, polish it endlessly, and reach governance topics exhausted with a week left. Sequence by weakness instead: take a diagnostic early and spend your best hours on your worst domain.
• Treating domain names as fences. The exam blends domains inside single questions. Revise topics, check understanding across boundaries — can you follow one scenario from attack (Domain 2) through response (Domain 4) to reporting (Domain 5)?
• Ignoring the weightings. The official objectives state each domain's percentage; two candidates with identical knowledge can score differently because one allocated time in proportion to the weightings and the other split time evenly. Check the current figures in the PDF and let them set your ratios.
• Memorising port numbers and acronyms first. They matter, but they are the garnish. The exam's centre of gravity is judgement in scenarios; rote lists alone have never passed it.
• Studying the wrong version. Materials for the retired SY0-601 still circulate. SY0-701 restructured the syllabus into the five domains above — verify that every resource you use names SY0-701.

Turning the domain map into a study sequence

Here is a prioritisation that suits most candidates coming from a year or two of general IT: secure Domain 1 first, because everything else compounds on it; then take a diagnostic set of questions across all five domains to find your true weak spots rather than your assumed ones; then give domains 2, 3 and 4 the bulk of your remaining technical study time — with your personal weakest of the three getting the most; and hold Domain 5 for concentrated vocabulary work in the final stretch, when flashcard-friendly material benefits from freshness. Re-test after each block and let the results, not the table of contents, dictate where you go next.

How many weeks that takes depends on your starting point, and turning this sequence into a calendar is a separate job — the week-by-week Security+ study plan exists precisely for that. And when you want the full picture beyond the syllabus — cost, booking, renewal, whether the certification suits your situation — the CompTIA Security+ certification guide is the companion piece to this topic breakdown.

Whatever order you choose, keep returning to mixed-domain question sets as you go. The exam will not sort its questions by chapter, and neither should your final preparation.