CompTIA Security+ (SY0-701) Practice Test & Flashcards
Study for the SY0-701 exam with single-best-answer practice questions and flashcards across all five domains — plus the complete exam objectives and weightings.
One-time $34.99 · 30-day access · no subscription, no auto-renew
What is CompTIA Security+?
CompTIA Security+ is a vendor-neutral, entry-level cybersecurity certification that validates the core skills needed for security roles: assessing threats, securing architecture and operations, and understanding governance, risk, and compliance. The current exam is SY0-701.
It is one of the most widely recognized security certifications and is approved for many DoD 8570/8140 roles. Security+ is commonly taken after A+ and Network+, and it assumes you are already comfortable with networking fundamentals.
Security+ SY0-701 exam overview
| Exam code | SY0-701 |
|---|---|
| Questions | Up to 90 (multiple-choice + performance-based) |
| Time | 90 minutes |
| Passing score | 750 (scale 100–900) |
| Recommended experience | Network+ and ~2 years of security-focused IT work |
| Exam cost | Voucher paid to CompTIA — see official pricing (separate from CertStudio's prep price) |
Exam facts last verified: Sep 2026
CompTIA Security+ SY0-701 exam objectives (all 5 domains)
The SY0-701 objectives are grouped into five weighted domains, numbered 1.0 through 5.0. Here is the full breakdown with each domain's weighting and the topics it covers — and CertStudio's flashcards and practice questions are tagged to match.
General Security Concepts
The CIA triad, AAA, and control categories/types; zero trust (policy engine, policy enforcement point); physical security (bollards, access control vestibules); deception (honeypots, honeytokens); change management; and cryptographic solutions — PKI, symmetric vs asymmetric, hashing, digital signatures, certificates, TPM/HSM, tokenization and masking.
Threats, Vulnerabilities & Mitigations
Threat actors and motivations; attack vectors and social engineering (phishing, vishing, smishing, pretexting); vulnerabilities (zero-day, injection, buffer overflow, misconfiguration, legacy/EOL, supply chain); malware (ransomware, worm, trojan, rootkit, logic bomb); network, application, password, and cryptographic attacks; and mitigation techniques such as segmentation, hardening, patching, least privilege, and EDR.
Security Architecture
Architecture models (cloud shared responsibility, IaC, serverless, containers, OT/ICS/SCADA); enterprise infrastructure (firewalls/WAF/NGFW, IDS/IPS, jump servers, proxies, failure modes); secure communications (VPN, IPSec, TLS, SASE); data protection (classification, data states, sovereignty, DLP, encryption); and resilience and recovery (high availability, recovery sites, backups, power).
Security Operations
Secure baselines and hardening; mobile/MDM; asset management and secure disposal; vulnerability management (CVE/CVSS, scanning, penetration testing, compensating controls); monitoring (SIEM, FIM, DLP, UEBA); email security (SPF/DKIM/DMARC); identity and access management (SSO, MFA, PAM, access-control models); automation and orchestration; incident response; and digital forensics.
Security Program Management & Oversight
Governance (policies, standards, procedures, data roles); risk management (risk register, qualitative and quantitative analysis, SLE/ARO/ALE, risk strategies, BIA with RTO/RPO); third-party and vendor risk (SLA, NDA, MSA, right-to-audit); compliance and privacy (PCI DSS, GDPR, HIPAA, data inventory and retention); and audits and assessments (internal/external audits, attestation, penetration testing).
Weightings are set by CompTIA's published SY0-701 objectives. CertStudio's all-domains mock quiz samples questions in these same proportions so a practice exam mirrors the real weighting.
Sample CompTIA Security+ practice questions
Every SY0-701 practice question is a single-best-answer scenario with an explanation that also says why the runner-up answers are wrong. Here are three real examples from the bank.
An attacker alters the published prices on a company’s public product catalog. The pages are already public, so nothing secret was exposed, and the site stays online. Which part of the CIA triad was MOST directly violated?
Unauthorized modification of data is an integrity violation, which is exactly what altering published prices is. Confidentiality does not apply to already-public content, availability would be the concern only if the site went offline, and authentication is a control rather than a triad property.
To reduce spoofed emails claiming to come from its domain, a company publishes DNS records specifying which mail servers may send on its behalf, how to verify message signatures, and what to do with failures. Which trio of technologies is this?
SPF authorizes sending servers, DKIM signs messages for integrity/authenticity, and DMARC ties them together with a policy for handling failures — the standard anti-spoofing email trio. The other sets are transport encryption, federation, or cryptographic primitives, not email-domain anti-spoofing controls.
A single flood is expected to cause $200,000 in damage to a warehouse worth $1,000,000, and floods occur about once every 10 years. What is the annualized loss expectancy (ALE)?
ALE = SLE × ARO. The single loss expectancy is $200,000 (the damage per event), and the annualized rate of occurrence is 0.1 (once per 10 years), so ALE = $200,000 × 0.1 = $20,000. $200,000 is the SLE alone, and the other figures ignore the rate of occurrence.
What you get with CertStudio
Progress is tracked separately by domain, timed quizzes adapt as you improve, and a full-length 90-question mock mirrors the real SY0-701 weighting. The real exam also includes performance-based questions where you complete a simulated task — CertStudio's flashcards and quizzes build the underlying knowledge those PBQs test, but we don't simulate the lab interface itself.
Pricing
$34.99
one-time payment · 30 days of full access
No subscription, no auto-renew, and no card kept on file. One payment covers the full Security+ SY0-701 flashcard and practice-question bank.
Create your account to get startedCompTIA Security+ FAQ
What are the CompTIA Security+ SY0-701 exam objectives?
The SY0-701 objectives are grouped into five weighted domains: 1.0 General Security Concepts (12%), 2.0 Threats, Vulnerabilities & Mitigations (22%), 3.0 Security Architecture (18%), 4.0 Security Operations (28%), and 5.0 Security Program Management & Oversight (20%).
How many questions are on the Security+ SY0-701 exam?
Up to 90 questions in a 90-minute session, mixing multiple-choice with performance-based questions (PBQs) that simulate real security tasks.
What's the passing score for Security+?
750 on a scale of 100 to 900. Because CompTIA uses scaled scoring, that is not the same as answering 75% correctly — questions carry different weights and PBQs often count for more.
Are CertStudio Security+ practice questions available now?
Yes. CertStudio's Security+ SY0-701 practice questions and flashcards are live, covering all five domains with single-best-answer scenarios and explanations. Create an account to start for a one-time $34.99 — no subscription.
Do I need Network+ or A+ before Security+?
They are not required prerequisites. CompTIA recommends Network+ and around two years of security-focused IT experience first, because Security+ assumes networking fundamentals. Many people follow the A+ → Network+ → Security+ ladder.
Is Security+ hard, and how long does it take to study?
Security+ is broad and concept-heavy, spanning threats, architecture, operations, and governance, plus performance-based questions. Many candidates study for roughly 6–10 weeks with consistent practice; domain-tagged flashcards and practice questions help you focus on weak areas.
Is Security+ worth it?
Security+ is one of the most widely recognized entry-level security certifications, is DoD 8570/8140 approved for many roles, and is often required or preferred for security analyst and administrator positions. It is a strong foundation before more advanced certifications.
Ready to start studying for CompTIA Security+?
92 flashcards, 162 practice questions, all five SY0-701 domains, one-time payment.
Create your account to get startedBuilding the foundation first? Many people take Network+ before Security+. New to IT? Start with CompTIA A+.