Security+ Exam Objectives Explained

A domain-by-domain breakdown of the SY0-701 Security+ exam objectives — what each of the five domains actually tests and how to read the official list.

Liam Anderson5 June 2026 · 9 min read

Ask AIChatGPT Claude Gemini Copilot Perplexity Grok

Shield diagram divided into five segments representing the five CompTIA Security+ SY0-701 exam domains

The CompTIA Security+ exam (SY0-701) tests five domains: General Security Concepts; Threats, Vulnerabilities and Mitigations; Security Architecture; Security Operations; and Security Program Management and Oversight. You face a maximum of 90 questions in 90 minutes, mixing multiple-choice with performance-based questions, and you need a scaled score of 750 on a 100–900 scale to pass. This article explains what each domain actually asks of you — not just what the official objectives list says, but what the wording means in practice.

CompTIA publishes the full exam objectives document as a free download on comptia.org, and it should be the first thing you read before buying any course or book. Each domain's official weighting — the percentage of the exam it contributes — is printed in that document, so download the current SY0-701 version and check the percentages there rather than relying on second-hand summaries. As of August 2026, SY0-701 (live since November 2023) is the only current version of the exam; CompTIA lists an estimated retirement "in 2026" without a fixed date, and a successor is expected but unannounced. Study against SY0-701 objectives until CompTIA says otherwise.

How the SY0-701 objectives document is organised

The objectives document is not a syllabus in the school sense. It is a hierarchical list: five domains at the top, each broken into numbered objectives, each objective followed by a long list of example topics, technologies and acronyms. Two things trip up first-time readers.

First, the verbs matter. An objective that begins "compare and contrast" is asking you to distinguish between similar things (types of controls, categories of threat actor), while "explain" objectives test understanding of why something works, and "given a scenario" objectives are the ones most likely to surface as situational questions — including performance-based questions (PBQs), where you interact with a simulated environment rather than picking A, B, C or D.

Second, the bulleted example lists under each objective are illustrative, not exhaustive contracts. CompTIA notes that its bullet lists show examples of what could appear; you are being tested on the objective, not on memorising the bullets. Treat the bullets as a vocabulary checklist and the objective sentence as the actual skill.

With that reading method in place, here is what each domain really covers.

Domain 1: General Security Concepts

This domain is the foundation layer — the shared vocabulary the rest of the exam assumes. It covers the categories and types of security controls (technical, managerial, operational, physical; preventive, detective, corrective and so on), core principles such as confidentiality, integrity and availability, zero trust concepts, and the building blocks of cryptography.

What actually matters here:

Control classification. Expect to map a described measure ("a guard checks badges at the door") to its category and type. This is quick marks if you have drilled it and slow agony if you have not.
Cryptography fundamentals. Symmetric versus asymmetric encryption, hashing, digital signatures, certificates and public key infrastructure. SY0-701 cares less about algorithm internals and more about which tool solves which problem.
Change management and its security impact. A distinctly workplace-flavoured topic: why approval processes, backout plans and documentation exist.

If you are new to security, this domain rewards being studied first, because the other four domains reuse its terminology constantly.

Domain 2: Threats, Vulnerabilities and Mitigations

This is the "know your enemy" domain. It covers threat actors and their motivations, common attack vectors and surfaces, types of vulnerabilities, indicators of malicious activity, and the mitigation techniques that blunt each attack.

The practical skill being tested is recognition. Questions describe a symptom — odd outbound traffic, a user reporting a convincing invoice email, an application crashing on long input — and ask you to name the attack or pick the mitigation. To prepare well:

Learn attacks in pairs with their defences (phishing with user training and mail filtering, SQL injection with input validation and parameterised queries, and so on). The exam rarely asks about an attack in isolation.
Distinguish lookalike terms deliberately: virus versus worm, insider threat versus shadow IT, vulnerability versus threat versus risk. Many wrong answer options exist purely to catch blurred definitions.
Pay attention to indicators of compromise. "Given a scenario, analyse indicators of malicious activity" is classic PBQ territory — for example matching log excerpts to attack types.

Domain 3: Security Architecture

Architecture is where the exam asks how you would build things securely rather than how you would recognise an attack. It spans the security implications of different architecture models — cloud, on-premises, virtualisation, containers, industrial control systems and embedded devices — plus securing enterprise infrastructure, protecting data, and designing for resilience and recovery.

Candidates without infrastructure experience find this the most abstract domain, so anchor it in concrete comparisons:

Where should a control live? Network segmentation, firewalls, VPNs, secure protocols — expect scenario questions about placing the right control at the right point in a network diagram.
Data protection choices. Data states (at rest, in transit, in use), classification, and methods such as encryption, masking and tokenisation, matched to the situation described.
Resilience design. High availability, backups, site considerations and recovery testing — the exam likes asking which option keeps a service running or restores it fastest under the constraints given.

If terms like subnetting or hypervisors are entirely new to you, a short detour into networking fundamentals pays off; CompTIA itself recommends Network+-level knowledge and around two years in a security or systems administrator role before Security+, although there are no enforced prerequisites. Readers starting from zero should build extra time into their plan — the Security+ study schedule for beginners shows how to sequence that.

Domain 4: Security Operations

Operations is the day-job domain: applying security to computing resources, monitoring, vulnerability management, responding to incidents and using the tooling of a working security team. In practice it covers hardening baselines, mobile and wireless security, identity and access management, automation, incident response processes and using logs and other data sources to support investigations.

Three preparation notes:

Identity and access management (IAM) is heavily represented. Provisioning, federation, single sign-on, multifactor authentication, privileged access — know the difference between authentication, authorisation and accounting cold.
Incident response has an order. Preparation, detection, analysis, containment, eradication, recovery, lessons learned. Ordering questions and scenario questions ("what should the analyst do NEXT?") reward knowing the sequence, not just the stage names.
Log-reading is examinable. You may be shown firewall, authentication or web-server log lines and asked what happened. This is another natural home for PBQs, and it is a skill you build by doing, not reading.

Domain 5: Security Program Management and Oversight

The final domain covers governance, risk and compliance: security policies and standards, risk management processes, third-party risk, compliance monitoring, audits and assessments, and security awareness practices. It is the least technical domain and the one technical candidates most often under-prepare, precisely because it feels like paperwork.

Do not make that mistake. The objective wording here leans on precise definitions — risk appetite versus risk tolerance, qualitative versus quantitative risk analysis, types of agreements with vendors — and precision is easy to test with multiple choice. Learn the risk formulas and terms exactly as the objectives phrase them, and be able to walk through a risk register entry: identify the risk, assess likelihood and impact, choose a treatment (accept, transfer, avoid, mitigate).

What the objectives tell you about question format

The objectives document describes content, but reading it alongside the exam format reveals how content becomes questions. The exam allows a maximum of 90 questions in 90 minutes — note "maximum": CompTIA seeds unscored questions, so candidates often see fewer than 90. Questions are multiple-choice (single and multiple response) plus performance-based items, and scoring is scaled from 100 to 900 with 750 to pass. A scaled score is not a percentage — you cannot translate 750 into "83% correct".

PBQs typically front-load the exam and simulate tasks: configuring a rule set, matching attacks to descriptions, ordering steps. They draw disproportionately on "given a scenario" objectives, which is why this article keeps flagging them. How to pace and practise PBQs is its own topic — the Security+ practice test strategy guide covers timing and review methods, and the Security+ exam day checklist covers handling them under real exam conditions.

What is NOT on the Security+ exam

Knowing the boundaries saves study time:

Deep packet-level networking. You need protocol and port awareness, not Network+-depth subnet mathematics.
Hands-on penetration testing. You should recognise attack techniques and understand why penetration tests happen, but performing exploitation belongs to CompTIA PenTest+.
Analyst-level detection engineering. Interpreting a log line is in scope; building detection rules and running a security operations centre workflow at depth is CompTIA CySA+ territory.
Vendor-specific products. Objectives name technology categories, not particular vendors' consoles. If a course spends hours in one vendor's dashboard, that is the course's choice, not an exam requirement.

How to turn the objectives document into a study tool

A practical five-step method:

Download the official SY0-701 objectives from comptia.org and skim all five domains once without stopping. The goal is a map, not mastery.
Rate every objective on a simple scale — know it, half-know it, no idea. Newcomers usually find Domain 1 and Domain 5 most learnable from scratch and Domain 3 most dependent on prior IT exposure.
Note the weighting percentages printed in the document and let them set your effort allocation: a heavily weighted domain with lots of "no idea" ratings is your priority; a lightly weighted domain you half-know can wait.
Convert bullets into questions. For each example topic, ask "what is it, what problem does it solve, what is it commonly confused with?" If you can answer all three, move on.
Re-rate after practice testing. Practice questions organised by domain show which self-ratings were optimistic. ExamPractice offers free sample CompTIA Security+ SY0-701 practice questions, with fuller sets and a timed simulation mode for subscribers — use per-domain results to send yourself back to specific objectives rather than re-reading everything.

Frequently asked questions

Are the SY0-701 objectives different from SY0-601?

Yes. SY0-701 reorganised the exam into the five domains described above; SY0-601 retired on 31 July 2024. Study materials written for SY0-601 will cover much overlapping ground but will not match the current domain structure, so check that anything you buy states SY0-701 on the cover.

Do I need to memorise every acronym in the objectives list?

You should be able to expand and place every acronym, because answer options frequently use them unexpanded. The objectives document includes an acronym list at the back — turn it into flashcards early so decoding acronyms never costs you exam time.

Should I wait for the next version of Security+ instead of studying SY0-701?

No. As of August 2026 CompTIA lists SY0-701 as the current exam with no officially announced successor or fixed retirement date. Certification remains valid for three years from your pass date regardless of which exam version you sat, so passing the live version now loses you nothing.

How much does the exam cost?

US retail is $439 as listed by CompTIA's authorized resellers in June 2026, with lower prices (roughly $365–394) through authorized voucher resellers; fees vary by country, so confirm current pricing on comptia.org before booking.

Where the objectives fit in your bigger plan

The objectives document tells you what to learn; it deliberately says nothing about how or in what order. Once you have mapped the five domains against your own starting knowledge, your next moves are sequencing that material into weeks — covered in the beginner-friendly Security+ study schedule — and validating progress with domain-scored practice, covered in the practice test strategy guide. For the wider context of format, cost and whether Security+ suits your career stage, the full CompTIA Security+ certification guide is the place to start. Read the objectives first, though — twenty minutes with the official document will make every other resource you touch easier to judge.

Exam facts in this guide were checked against official certification-provider pages on 30 August 2026. Fees, exam codes and policies change — confirm on the provider’s own site before you book.