CompTIA Security+ Practice Exam & Full Question Bank
Practice CompTIA Security+ (SY0-701) questions across all 5 official blueprint domains. Work untimed with instant explanations, step-by-step distractor autopsies, and primary NIST/ISO references, then retry missed questions from the Missed queue.
CompTIA Security+ Practice Questions
CompTIA Security+ (SY0-701) 5-Domain Structure
SY0-701 (maximum 90 questions) weights its 5 domains as follows; question counts reflect the split used in this bank:
General Security Concepts
Core cybersecurity principles including the CIA triad, non-repudiation, AAA framework, zero trust architecture, security control categories (managerial, operational, technical) and types (preventative, detective, corrective, compensating), change management governance, and cryptographic foundations (symmetric vs. asymmetric encryption, hashing, digital signatures, PKI certificates, key lifecycle management).
- Security Control Categories & Types
- Fundamental Concepts (CIA, Non-Repudiation, AAA, Zero Trust)
- Change Management & Secure Configuration
Threats, Vulnerabilities, and Mitigations
Comprehensive analysis of threat actor types (APTs, hacktivists, script kiddies, insider threats, state-sponsored actors), threat vectors and attack surfaces, vulnerability classifications (zero-day, misconfigurations, injection flaws, memory buffer overflows, cryptographic weaknesses), indicators of compromise (malware, ransomware, beaconing, lateral movement), and defense-in-depth mitigation strategies.
- Threat Actor Motivations & Attack Vectors
- Security Vulnerabilities (OWASP Top 10, Hardware, Supply Chain)
- Malware Classifications & Malicious Activity Indicators
Security Architecture
Enterprise security architecture models across cloud (IaaS/PaaS/SaaS), on-premises, and hybrid environments. Network segmentation and secure topology design (VLANs, DMZ, air gaps, zero trust microsegmentation), perimeter security appliances (next-gen firewalls, IDS/IPS, WAF, proxies, load balancers), data protection solutions (DLP, tokenization, masking, retention), and system resilience (high availability, fault tolerance, RAID, DR sites).
- Enterprise Architecture Models & Cloud Deployments
- Secure Network Infrastructure & Segmentation
- Data Protection Strategies (DLP, Masking, Encryption)
Security Operations
Practical execution of day-to-day security operations: systems and endpoint hardening (OS baselines, mobile MDM, IoT/embedded security), robust Identity and Access Management (IAM/PAM, MFA factors, federation via SAML/OAuth/OIDC), vulnerability scanning and CVSS vulnerability prioritization, telemetry monitoring (SIEM, SOAR, EDR/XDR, log parsing), and structured incident response procedures (preparation through lessons learned).
- System Baseline Hardening & Endpoint Security
- Identity & Access Management (IAM, MFA, Federation, PAM)
- Vulnerability Management & CVSS Prioritization
Security Program Management and Oversight
Enterprise cybersecurity governance frameworks (NIST CSF 2.0, ISO/IEC 27001, CIS Controls), regulatory compliance standards (HIPAA, PCI-DSS, GDPR, SOX), qualitative and quantitative risk analysis (SLE, ARO, ALE calculation, risk register, risk appetite, risk treatment options), third-party vendor supply chain risk management (SLAs, MOUs, SOC reports), and continuous security auditing and employee awareness training.
- Cybersecurity Governance & Compliance Frameworks
- Quantitative & Qualitative Risk Management
- Third-Party Vendor & Supply Chain Governance
Complementary CompTIA Security+ Study Resources
Comprehensive Study Guide
20 modular lessons covering security architecture, Zero Trust, cryptography, and operations.
Read Study Guide →SY0-701 Cram Cheat Sheet
High-yield tables comparing control types, crypto algorithms, port numbers, and attack signatures.
View Cheat Sheet →6-Week Mastery Study Plan
Structured study roadmap with weekly milestone exams and Pearson VUE first-5-minute dump sheet formulas.
Open Study Plan →Frequently Asked Questions: CompTIA Security+ Examination
What is the format, duration, and passing score of the CompTIA Security+ (SY0-701) exam?
The CompTIA Security+ (SY0-701) examination consists of a maximum of 90 multiple-choice and performance-based questions (PBQs) administered over 90 minutes. The passing score is 750 on a scale of 100 to 900. It is a scaled score, so it does not translate to a fixed percentage of questions correct.
How is the SY0-701 exam weighted across CompTIA's 5 blueprint domains?
The exam is proportioned strictly across 5 domains: Domain 1.0 General Security Concepts (12%, ~11 Qs); Domain 2.0 Threats, Vulnerabilities, and Mitigations (22%, ~20 Qs); Domain 3.0 Security Architecture (18%, ~16 Qs); Domain 4.0 Security Operations (28%, ~25 Qs); and Domain 5.0 Security Program Management and Oversight (20%, ~18 Qs).
Should I take SY0-701 or wait for SY0-801?
As of October 20, 2026, CompTIA says SY0-801 (V8) is expected to launch on or around November 17, 2026. SY0-701 retires June 11, 2027 in English and August 13, 2027 in Japanese, Portuguese, Spanish, and Thai. If you test before mid-November 2026, SY0-701 is the only option; if you are already preparing for SY0-701 and can test before it retires, stay on it; if you are starting fresh and will test after spring 2027, prepare for SY0-801. SY0-801 keeps the same format and reweights the domains: General Security Concepts 16%, Threats, Vulnerabilities, and Attacks 24%, Security Architecture 19%, Security Operations 27%, Security Program Management and Oversight 14%.
What are the main changes between SY0-601 and SY0-701?
SY0-701 consolidated the blueprint from 35 to 28 exam objectives and reorganized it into five domains, with more emphasis on zero trust, cloud and hybrid architectures, automation and orchestration, and governance, risk, and third-party management.
What functional control types are tested on the Security+ exam?
SY0-701 objective 1.1 lists six control types: Preventive (blocks before occurrence, e.g., IPS, door locks), Deterrent (discourages violation, e.g., warning banners), Detective (identifies during/after, e.g., SIEM, CCTV), Corrective (remediates damage, e.g., backup restore), Compensating (alternative when the primary control is unfeasible), and Directive (instructs behavior, e.g., policies and signage). It also lists four control categories: Technical, Managerial, Operational, and Physical.
What is the passing score and how is it scored?
The exam is scored on a scaled range from 100 to 900. Candidates must achieve at least 750 to pass. CompTIA does not publish a raw-percentage equivalent, and the exam may include unscored items.