Skip to main content
Revy's Tech Journey, powered by Revtek
Exam objectives

CompTIA Security+ (SY0-701) exam objectives

RTJ is an IT certification platform that starts with CompTIA A+, Network+ and Security+.

The CompTIA Security+ (SY0-701) exam objectives list what the exam covers, in 5 domains. RTJ covers 28 objectives below, each with RTJ's short label, a plain summary, and links to a lesson, flashcards, practice questions and any hands-on lab.

Where is the official CompTIA Security+ objectives list?

CompTIA publishes the official SY0-701 objectives, in its own wording, on the official CompTIA Security+ page. That is the source to follow for what the exam covers. The objective labels on this page are RTJ's short names, and the summaries are RTJ's own. The domain names and weights below are CompTIA's, from that page.

Domains, weights and exam facts checked against CompTIA's official exam page on 2 November 2026.

This page and RTJ's practice cover SY0-701. On 2 November 2026, CompTIA's Security+ page said the next version, Security+ V8, is expected to launch on or around 17 November 2026. Check which version your exam booking is for. CompTIA's announcement.

CompTIA Security+ exam quick facts

Questions
Up to 90
Time
90 minutes
Passing score
750 on a scale of 100-900

CompTIA's figures, from the official CompTIA Security+ page.

Domain 1.0: General security concepts (12% of the exam)

1.1 Security Controls

You should be able to name the four control categories and six control types, then classify a safeguard from the facts in a scenario. A 4-by-6 matrix is a useful study aid because it keeps category separate from type. It is not a universal audit form, and an organization does not need a control in every possible cell.

1.2 Security Concepts

You should be able to name the three letters of the CIA triad, the three letters of AAA, the four factor categories that SY0-701 lists, and the building blocks of Zero Trust. You should also recognize physical controls and deception technology in scenarios. These concepts provide vocabulary used throughout CompTIA Security+.

1.3 Change Management

You should be able to read a change request (CR) and tell what is on it, what is missing, and why a missing element is a security risk. You should be able to name the eight business process elements: approval process, ownership, stakeholders, impact analysis, test results, backout plan, maintenance window, and standard operating procedure (SOP). You should also be able to name the common technical implications a change can trigger: allow/deny list updates, restricted activities, downtime, service restart, application restart, legacy application breakage, and dependency breaks. Finally, you should be able to explain why updated diagrams, updated policies, and version control are part of change management, not after-the-fact paperwork.

1.4 Cryptographic Solutions

You should be able to explain what cryptography does in plain English, distinguish symmetric from asymmetric encryption, validate a certificate path to a trust anchor, and pick the right key-storage tool for a stated job. You should also be able to define hashing, salting, and key stretching without confusing them with encryption. These concepts recur in data protection, IAM, secure communications, and incident response.

Domain 2.0: Threats, vulnerabilities, and mitigations (22% of the exam)

2.1 Threat Actors

The SY0-701 objectives name six threat actor categories, ten motivations, and three comparison attributes. You should also be able to read a short alert summary or news clip and pick the likeliest actor and motivation with one or two reasons. This is the first objective in Domain 2 and it sets the adversary frame every later objective references. SP-2.2 builds on it with threat vectors. SP-2.3 builds on both with vulnerabilities. The pattern across Domain 2 is who, why, then how.

2.2 Threat Vectors and Attack Surfaces

You should be able to name the message-based vectors (email, SMS, instant message), image-based and file-based vectors, voice-call vectors, removable media, vulnerable software (client-based vs agentless), unsupported systems and applications, unsecure networks (wireless, wired, Bluetooth), open service ports, default credentials, supply-chain vectors (managed service providers, vendors, suppliers), and the full roster of human-vector and social-engineering techniques: phishing, vishing, smishing, misinformation and disinformation, impersonation, business email compromise (BEC), pretexting, watering hole, brand impersonation, and typosquatting. You should also be able to read a short breach summary and map it to the right vector.

2.3 Types of Vulnerabilities

You should be able to read a vulnerability disclosure or a scanner finding, name the SY0-701 category it falls into, and explain what the weakness allows an attacker to do. Writing exploits is outside this objective's scope. Recognize each vulnerability family. Triage speed in a SOC (Security Operations Center) comes from the analyst who can say "that is a web vulnerability, specifically SQL injection" before the page finishes loading. This objective is the bridge between SP-2.1 threat actors (who attacks) and SP-2.4 malicious activity (what they do once they are in). Vulnerabilities are the gaps in between.

2.4 Indicators of Malicious Activity

You should be able to recognize the common malware families and the network, application, cryptographic, and password attacks by their indicators. Classify alerts, log snippets, and user reports by attack category and specific attack, then choose the next step. Drill the indicator-to-category mapping until it is reflex.

2.5 Mitigation Techniques

You should be able to read an incident or scenario, pick the mitigation that best addresses the stated problem, and explain why. You also need to recognize host-hardening steps when they appear on a workstation or server baseline. NIST CSF functions provide useful context, but one control can support outcomes in more than one function. SY0-701 was published when CSF 1.1 used five functions; current CSF 2.0 adds Govern as a sixth.

Domain 3.0: Security architecture (18% of the exam)

3.1 Architecture Models

You should be able to identify the architecture in a short scenario: cloud, on-prem, hybrid, IaC, serverless, microservices, virtualization, containerization, IoT, ICS/SCADA, or RTOS/embedded. You should also be able to explain its security implications. Focus on responsibility boundaries, segmentation, availability requirements, and patching constraints rather than memorizing vendor claims.

3.2 Applying Security Principles

You should be able to name the five infrastructure considerations: device placement, security zones, attack surface, connectivity, and failure mode.

3.3 Protecting Data

Data protection is the part of security architecture that identifies information, sensitivity, location, use, and required controls. Classify data by type, policy-defined classification, state, and protection method. A laptop record may call for storage encryption, while a help-desk view may call for masking, but those controls depend on the stated policy and threat. Cross-border location or transfer requirements raise data-sovereignty questions.

3.4 Resiliency and Recovery

You should be able to read a scenario about a disruption (a regional outage, a ransomware encryption, a hardware failure, a misconfigured deploy that takes down production) and name the resilience mechanism that fits. You also need to compare the three site types by recovery time and cost, explain why geographic dispersion and platform diversity matter, differentiate backup types and the related techniques (snapshots, replication, journaling), and describe how UPS and generators work together. Pair the resilience mechanism with RTO (Recovery Time Objective) and RPO (Recovery Point Objective).

Domain 4.0: Security operations (28% of the exam)

4.1 Security Techniques

Select the strongest primary technique and applicable platform for the security conditions. This objective is broad because Domain 4 has the largest published weighting at 28%, and 4.1 is the foundation lesson the rest of Domain 4 builds on. Learn the families and the one or two moves that go with each platform.

4.2 Asset Management

Map procurement, ownership, rogue devices, and disposal decisions to the applicable asset-management activity. You also need to compare the three NIST SP 800-88 sanitization levels, explain the difference between an asset owner and an asset custodian, justify the minimum fields on an inventory using CIS Control 1 and NIST SP 800-53 CM-8, and describe how disposal documentation (certificate of destruction) ties into data retention. Identify the asset-management piece and its downstream control.

4.3 Vulnerability Management

You should be able to read a vulnerability scanner finding, a CVE disclosure, or a CISA KEV alert and place it in the operational lifecycle. Name the identification method, confirm the finding, interpret severity and local risk, choose a response, validate the outcome, and report evidence clearly.

4.4 Security Monitoring

You should be able to explain what monitoring covers: systems, applications, and infrastructure. You should be able to name the six monitoring activities: log aggregation, alerting, scanning, reporting, archiving, and alert response. You should also be able to distinguish common tools, including SIEM, antivirus, EDR, DLP, SNMP traps, flow records, vulnerability scanners, and SCAP-capable compliance tools, and choose an alert-handling action from scenario evidence. NIST SP 800-92 (log management), NIST SP 800-137 (continuous monitoring), and NIST SP 800-94 (intrusion detection and prevention) provide public grounding for the concepts.

4.5 Enterprise Security

SP-4.5 brings together the longest list of named capabilities in SY0-701. The capabilities here span network and web controls, operating system policy, secure protocols, DNS and email controls, file and data protection, network access, endpoint detection, and behavior analytics. You will learn to read a SOC ticket, identify the enterprise capability that needs to change, and describe that change in plain English. For each capability, connect its purpose and main tuning choices to a layered defense, and focus on modifying the capability rather than naming a vendor or adding a brand-new product.

4.6 Identity and Access Management

Map stale accounts, reset bypasses, phished codes, exposed privileged passwords, and temporary partner access to the missing IAM controls. The coverage is broad and includes the full account lifecycle: provisioning, identity proofing, permission assignment, periodic attestation, and deprovisioning. It also includes five access-control models (MAC, DAC, RBAC, RuleBAC, and ABAC), time-of-day restrictions, and least privilege. Other areas are federation and SSO (LDAP, SAML, OAuth, OIDC, interoperability, and attestation of trust), multifactor authentication (biometrics, hard tokens, soft tokens, security keys, the three classic factors, and location), password best practices and passwordless authentication, and privileged access management (just-in-time access, password vaulting, and ephemeral credentials).

4.7 Automation and Orchestration

You should be able to read a SOC (Security Operations Center) workflow, identify the automated task or coordinated workflow, and explain the benefits and trade-offs in context. Automation executes predefined work with limited manual intervention. Orchestration coordinates tasks, decisions, and tools into a broader workflow. The objective tests the listed use cases, benefits, and considerations rather than programming syntax.

4.8 Incident Response

You should be able to name the seven phases of incident response: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. You should be able to differentiate short-term from long-term containment, rank tabletop exercises and simulations by realism, and define root cause analysis and threat hunting. You should also be able to name and explain six digital forensic concepts: legal hold, chain of custody, acquisition, reporting, preservation, and e-discovery. For an incident in progress, identify the current phase before choosing the next action.

4.9 Security Data Sources

You should be able to name the seven categories listed under log data: firewall, application, endpoint, OS-specific security, IDS/IPS, network, and metadata. You should also be able to name the four additional data sources: vulnerability scans, automated reports, dashboards, and packet captures. Identify the source and fields that directly address the investigation, then corroborate material findings when risk warrants.

Domain 5.0: Security program management and oversight (20% of the exam)

5.1 Security Governance

You should be able to name four common governance document types (policy, standard, procedure, guideline) and tell them apart by purpose and whether they are mandatory or advisory in the organization. You should name the four external considerations that shape security policy (regulatory, legal, industry, geographic) and give one example of each. You should describe how governance documents stay current through monitoring and revision. You should compare governance structures (boards, committees, government entities, centralized versus decentralized models). You should also distinguish data owners, controllers, processors, custodians, and stewards by the functions assigned in a scenario.

5.2 Risk Management

Risk is the bridge between security work and business work. The executives in the building do not care that the firewall rule changed. They care whether the bad thing is less likely or less expensive this quarter than it was last quarter. The risk management process is how a security program answers that question in writing, with numbers, and with a paper trail that auditors can follow. Risk management connects governance, third-party risk, compliance, audits, and awareness through the risk register.

5.3 Third-party Risk

You should be able to define third-party risk in plain English, name the five vendor assessment activities, walk a vendor selection process from due diligence through conflict-of-interest screening, distinguish all eight agreement types, and describe a vendor monitoring program that uses questionnaires and rules of engagement. Agreement-type distinctions matter because the terms look similar but have different legal weight. SOC analysts and vCIOs read these contracts in the field.

5.4 Security Compliance

You should be able to explain how a business demonstrates compliance with applicable laws, regulations, contracts, and adopted standards. NIST SP 800-53 is a control catalog, ISO/IEC 27001 is a management-system standard, and PCI DSS is an industry standard; they do not all create the same kind of obligation. The objective lists four building blocks: compliance reporting, consequences of non-compliance, compliance monitoring, and privacy.

5.5 Audits and Assessments

You should be able to define attestation, name the internal and external audit types CompTIA lists, name the seven penetration testing types, and tell the difference between passive and active reconnaissance. The objective is heavy on vocabulary. Relevant references include NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), NIST SP 800-53A (Assessing Security and Privacy Controls), and PCI DSS audit requirements.

5.6 Security Awareness

You should be able to read a scenario about a user, an email, an unusual login, or a program decision and name the security awareness practice in play. The objective covers six clusters: phishing (campaigns, recognition, response), anomalous behavior (risky, unexpected, unintentional), user guidance and training, reporting and monitoring (initial and recurring), program development, and program execution. Focus on selecting the right practice and interpreting metrics against the organization's baseline, risk, and goals.

Other CompTIA exam objectives

Questions

Are these CompTIA's official CompTIA Security+ objective titles?

No. The objective labels on this page are RTJ's short names for each objective, and the summaries are RTJ's own. The domain names and weights are CompTIA's. CompTIA publishes the official SY0-701 objectives on its own site.

Is the practice on this page free?

The lessons, flashcards and practice questions open in RTJ's study mode. Free labs need no account. The other labs are included with Academy, Lifetime, and the teacher and school plans.

Does working through every objective mean I will pass?

No. Covering the objectives is preparation, not a prediction. RTJ does not predict exam results.

Where can I get the official CompTIA Security+ exam objectives?

From CompTIA, on its official CompTIA Security+ exam page (https://www.comptia.org/en-us/certifications/security/v7/).

Keep going

Revy's Tech Journey is an independent study platform and is not endorsed by or affiliated with CompTIA. CompTIA names identify the public exam objectives each RTJ track covers.

Start free, no credit card.

A free account keeps your progress and adds one free full-length Practice Exam attempt per CompTIA exam (A+ Core 1, A+ Core 2, Network+, and Security+).

Create a free accountSee what is included