PassProfessor’s Security+ program is part of the expanding PassProfessor catalog. We are building a practice program mapped to CompTIA’s official SY0-701 objectives. Join the notify list and we will email you when enrollment opens — then use this guide to plan your path to the exam.
This program is part of the expanding PassProfessor catalog — join the notify list and we’ll email you when enrollment opens.
The Security+ exam, in one paragraph
CompTIA Security+ is a vendor-neutral cybersecurity certification from CompTIA, earned by passing a single exam. The current version is Security+ V7, exam code SY0-701, delivered through Pearson VUE at test centers and online through OnVUE proctoring. The exam presents a maximum of 90 questions — a mix of multiple-choice and performance-based items — in 90 minutes, across five domains weighted from 12% to 28%. You pass with a score of 750 on a scale of 100–900. There is no formal prerequisite, the certification is valid for three years, and CompTIA states that a new version, Security+ V8, is expected to launch on or around November 17, 2026 — so which version you will sit matters, and this guide covers the version available today.
Who can take the Security+ exam?
Almost anyone — CompTIA keeps the front door open and lets the exam itself do the filtering.
- No formal prerequisites. CompTIA does not require a degree, a prior certification, or a minimum amount of work experience to register for SY0-701, sit it, or hold the certification.
- Recommended background. CompTIA recommends that candidates hold CompTIA Network+ and have about two years of experience in IT administration with a security focus. Treat this as an honest readiness signal, not a gate: the exam assumes you can read a network layout, recognize common ports and protocols, and reason about how systems connect. Candidates coming from help desk or general IT support usually need to build that networking base first; candidates already administering systems usually do not.
- You need an exam voucher and a Pearson VUE account. CompTIA exams are paid for by voucher and scheduled through Pearson VUE. The name on your account must match your government-issued identification.
- You agree to CompTIA’s candidate rules. Before testing, every candidate accepts the CompTIA Candidate Agreement and testing policies — including the rule that exam content may not be disclosed or reproduced. That is also why legitimate preparation never contains real exam questions.
One audience note: Security+ is an approved baseline certification under the U.S. Department of Defense 8140 workforce framework (the successor to DoD 8570). That status is a major reason the certification appears in federal and defense-contractor job requirements, and why many service members and veterans earn it before or shortly after transitioning.
The exam, piece by piece
SY0-701 is a single 90-minute sitting. There are no separately passed portions — one exam, one score. Two structural features shape how you should prepare:
- Performance-based questions (PBQs). Alongside multiple-choice items, the exam includes performance-based questions that place you in a simulated environment and ask you to carry out or analyze a task — interpreting log output, firewall or access-control rules, network diagrams, or incident evidence, for example. PBQs take longer per item than multiple-choice questions, and most candidates meet them early in the exam. Budget for them: flag-and-return is a legitimate strategy for a PBQ that is eating the clock.
- A maximum, not a promise. CompTIA publishes the question count as a maximum of 90. Your sitting may present fewer. Either way, the clock is 90 minutes, so pace against the questions in front of you, not a count you expected.
The five domains
CompTIA’s SY0-701 exam objectives divide the exam into five domains. The percentages are CompTIA’s published weights — the share of the exam each domain represents.
| Domain | Weight | What it covers |
|---|---|---|
| 1.0 General Security Concepts | 12% | Types of security controls (technical, managerial, operational, physical; preventive, detective, corrective, compensating, and related types); fundamental concepts — the CIA triad, non-repudiation, AAA, zero trust, deception technology; change management processes and their security impact; cryptographic solutions — PKI, encryption, obfuscation, hashing, digital signatures, blockchain |
| 2.0 Threats, Vulnerabilities, and Mitigations | 22% | Threat actors and motivations (nation-states, hacktivists, insider threats, organized crime, shadow IT); threat vectors and attack surfaces; vulnerability types across applications, hardware, mobile, virtualization, operating systems, cloud, web, and supply chain; indicators of malicious activity — malware, password, application, physical, network, and cryptographic attacks; mitigation techniques including segmentation, access control, configuration enforcement, hardening, isolation, and patching |
| 3.0 Security Architecture | 18% | Architecture models — on-premises, cloud, virtualization, IoT, industrial control systems, infrastructure as code; applying security principles to enterprise infrastructure, control selection, and secure communication and access; data protection — data types, classifications, and securing methods; resilience and recovery — high availability, site considerations, testing, backups, and continuity of operations |
| 4.0 Security Operations | 28% | Security techniques for computing resources — secure baselines, hardening, mobile and wireless security, application security, sandboxing, monitoring; asset management across the lifecycle; vulnerability management — identification, analysis, remediation, validation, reporting; alerting and monitoring tools; enterprise security tools — firewalls, IDS/IPS, DNS filtering, DLP, NAC, EDR/XDR; identity and access management — provisioning, SSO, MFA, privileged access; automation and orchestration; incident response processes, threat hunting, and digital forensics; using log data and other sources to support investigations |
| 5.0 Security Program Management and Oversight | 20% | Security governance — guidelines, policies, standards, procedures, governance structures, roles and responsibilities; risk management — identification, assessment, analysis, registers, tolerance and appetite, strategies, reporting, business impact analysis; third-party risk — vendor assessment, selection, agreements, monitoring; security compliance — reporting, consequences of non-compliance, monitoring, privacy; audits and assessments — attestation, internal and external audits, penetration testing; security awareness — phishing training, recognizing anomalous behavior, user guidance and reporting |
| Total | 100% |
Three facts about that table that should drive your study plan:
- Security Operations is more than a quarter of the exam (28%). It is also the most hands-on domain — tools, logs, incident response, forensics. It rewards candidates who have actually worked with the concepts, and it is where performance-based questions most naturally live.
- Domains 2 and 4 together are half the exam (50%). Threats and operations are the center of gravity. A study plan that spreads time evenly across five domains underweights the half that decides most scores.
- Domain 5 is the memorization-heavy fifth (20%). Governance, risk, compliance, and audit material is concrete and learnable from the objectives — for many candidates it is the most reliable place to pick up points late in a study plan.
The passing standard, explained
You pass SY0-701 with a score of 750 on a scale of 100–900.
That number is a scaled score, not a percentage. CompTIA converts raw results onto the 100–900 scale so that different forms of the exam — which draw different mixes of questions — all demand the same level of knowledge. Two consequences follow:
- 750 is not “83% correct,” and there is no published miss allowance. You cannot work out how many questions you may get wrong, because the conversion depends on the form you sat. Any source that promises a fixed number is guessing.
- Your result is immediate. Your score is shown on screen when you complete the exam, and a passing result triggers CompTIA’s confirmation with instructions for accessing your certification record. If you do not pass, your score report is the starting point for a retake plan — read it against the five domains above and rebuild around the weakest ones, because a second attempt with the same preparation usually produces the same result.
Fees and registration, step by step
What the exam costs. The exam is paid for with a CompTIA voucher — one voucher, one attempt; a retake requires a new voucher. CompTIA’s voucher pricing changes over time and varies by country, and authorized resellers and bundles price differently again, so this guide deliberately does not print a dollar figure that could be stale by the time you read it: check the current Security+ voucher price on CompTIA’s official store before you buy, and confirm the voucher covers the version you intend to sit (SY0-701 today).
The sequence, in order:
- Decide your version and date. As of this guide’s publication, SY0-701 (V7) is the available exam, and CompTIA expects Security+ V8 to launch on or around November 17, 2026. If your target date is after that launch, confirm on CompTIA’s website which version you will be scheduling — the V8 blueprint weights differ from the table above.
- Get a voucher. Buy the Security+ exam voucher from CompTIA or an authorized seller. Keep the voucher code safe; you redeem it during scheduling.
- Create your Pearson VUE account and schedule. CompTIA exams are scheduled through Pearson VUE. Choose your delivery method — a Pearson VUE test center, or online from home or office through OnVUE — then pick a date and time and redeem your voucher. The name on the account must match your government-issued ID exactly.
- If testing online, run the system test early. OnVUE requires a system check on the same computer and network you will test on, plus a private workspace that meets the proctoring rules. Do this days ahead, not minutes ahead — a failed system check on exam morning is a preventable loss.
- Take the exam. Arrive or check in as directed for your delivery method, present your ID, accept the candidate agreement, and test. Your score appears when you finish.
Retakes and score validity
- Retakes require a new voucher. Each attempt is paid for separately unless you bought a bundle that includes retake coverage at purchase time — retake protection generally cannot be added to a voucher you already own.
- Follow CompTIA’s current retake policy. CompTIA publishes waiting-period and attempt rules in its testing policies, and those policies are the authority — check them before scheduling a second attempt, because they change independently of the exam objectives.
- Score validity and renewal. A passing score earns the certification for three years. To keep it active, renew through CompTIA’s Continuing Education (CE) program — earning continuing education units and paying the CE fee within the cycle — or pass the current version of the exam again. An expired certification cannot be renewed; it must be re-earned.
Test day
- At a test center: arrive early, bring the government-issued identification your registration name matches, and expect personal items to be kept out of the testing room under the center’s rules.
- Online with OnVUE: check in from the same computer and network that passed your system test, in a private room that meets the workspace rules, with your photo ID ready. The proctor verifies your identity and workspace before the exam starts, and monitors the session throughout. Follow the on-screen policies exactly — online-testing violations, including interacting with anything outside the exam, can invalidate a result.
- During the exam: you have 90 minutes for everything on screen. Performance-based questions take longer than multiple-choice items; if one is consuming the clock, flag it, work the questions you know, and return with the time that remains. Treat every question as scored, because every question you see is part of the sitting as far as your time is concerned.
- After the exam: your score is shown on screen at completion. If you passed, CompTIA follows up with instructions for accessing your certification record. Keep that record — employers who require Security+ for DoD 8140 roles will ask for verification of active status.
How to study for this exam
The objectives document is the syllabus — CompTIA publishes exactly what SY0-701 covers, domain by domain, and the weights above are the exam’s actual proportions. A plan built on that structure:
- Start from the official objectives, not a table of contents. Download CompTIA’s SY0-701 exam objectives and use them as a checklist. If a topic is not on that list, it is not on your exam; if it is on the list, it is fair game regardless of whether a course emphasized it.
- Weight your time by the domains. Security Operations (28%) and Threats, Vulnerabilities, and Mitigations (22%) are half the exam between them. General Security Concepts (12%) still matters — cryptography and control types underpin the other domains — but it should not consume a quarter of your calendar.
- Learn the acronyms in context. Security+ is dense with abbreviations — SIEM, EDR/XDR, NAC, DLP, SSO, MFA, PKI, BIA. Definitions learned inside scenarios stick; definitions memorized off a list leak under time pressure. When you meet an acronym, learn what the tool or process does and what problem it answers.
- Practice the performance-based format separately. Reading logs, firewall rules, and network diagrams and deciding what they show is a skill distinct from recognizing terms. Give it its own sessions so the format costs you no time on exam day.
- Drill Domain 5 deliberately. Governance, risk management, third-party risk, compliance, and audits are concrete, bounded material. Candidates who work in operations often under-study it because it feels administrative — it is 20% of the exam, and it is winnable points.
- Practice at full length, against the clock. A maximum of 90 questions in 90 minutes is a pacing skill as much as a knowledge test. Full timed practice at the real length and weights builds both; short untimed quizzes build only one.
- Schedule when your practice says so — timed, full-length scores comfortably above the passing standard, with no domain left clearly weak — and confirm your exam version at scheduling, especially around the V8 launch window.
PassProfessor’s Security+ program is being built section-by-section on this same SY0-701 blueprint. The CompTIA Security+ Exam Prep program page shows the coverage plan — and the notify list there will email you when the program opens.
Frequently asked questions
How many questions are on the Security+ exam? A maximum of 90 questions in 90 minutes, mixing multiple-choice questions with performance-based questions that you complete in a simulated environment. Your sitting may present fewer than 90; the time limit is 90 minutes either way.
What is the passing score for Security+? 750 on a scale of 100–900. It is a scaled score, adjusted so every form of the exam demands the same knowledge — it does not correspond to a fixed percentage of correct answers.
What are the five domains of SY0-701? General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%), per CompTIA’s official SY0-701 exam objectives.
Is SY0-701 still the current Security+ exam? Yes, as of October 2026 — Security+ V7 (SY0-701) is the version available today, per CompTIA. CompTIA states that Security+ V8 is expected to launch on or around November 17, 2026. Confirm the current version on CompTIA’s website before you buy a voucher or schedule.
What is changing in Security+ V8? Per CompTIA’s V8 page, the new version expands coverage of AI-related risks, security operations, and modern environments, and its domain weights differ from SY0-701 — including a larger General Security Concepts share and a smaller Security Program Management and Oversight share. Study materials are version-specific: prepare for the version you will actually sit.
Do I need Network+ or work experience before Security+? No. CompTIA recommends Network+ and about two years of IT administration experience with a security focus, but neither is a requirement. Candidates without a networking background should expect to spend extra time on the networking fundamentals the exam assumes.
Can I take the Security+ exam online? Yes. CompTIA exams are delivered by Pearson VUE both at test centers and online from home or office through OnVUE remote proctoring, where available. Online testing requires a system check, a private workspace, photo ID, and continuous proctor monitoring.
How much does the Security+ exam cost? The exam is paid for with a CompTIA voucher — one voucher per attempt. Pricing changes over time and varies by country and by seller, so check the current price in CompTIA’s official store before purchasing rather than relying on a figure printed in any guide, including this one.
How long is Security+ valid, and how do I renew it? Three years from the date you pass. Renew through CompTIA’s Continuing Education program by earning continuing education units and paying the CE fee during the cycle, or by passing the current version of the exam again. An expired certification must be re-earned.
What happens if I fail Security+? You may test again with a new voucher, subject to CompTIA’s current retake policy in its published testing policies. Your score report from the failed attempt is your study plan: rebuild around the domains where the attempt was lost rather than repeating the same preparation.
Does Security+ satisfy DoD requirements? Security+ is an approved baseline certification under the DoD 8140 workforce framework, the successor to DoD 8570, which is why it is required in many federal and defense-contractor postings. Which work roles it satisfies are defined by the DoD qualification matrix — check the current matrix for a specific role.
Are performance-based questions really that different? Yes, in one practical way: time. A PBQ asks you to work in a simulated environment — reading evidence, configuring or interpreting a control — rather than selecting an option, so each one costs more minutes than a multiple-choice item. Candidates who have practiced the format beforehand do not spend exam time learning how the questions work.
Disclaimer
PassProfessor is an independent exam-preparation provider and is not affiliated with, sponsored by, or endorsed by CompTIA or Pearson VUE. CompTIA and Security+ are trademarks of CompTIA, Inc. This guide is general information about the Security+ exam, current as of October 2026; CompTIA’s and Pearson VUE’s official publications govern if anything here differs from them.