The CompTIA Security+ syllabus for SY0-701 covers five domains: general security concepts, threats, vulnerabilities and mitigations, security architecture, security operations, and security program management and oversight. Security operations carries the largest weight, followed by threats and vulnerabilities. Each domain publishes detailed objective statements in CompTIA's exam guide, which the sections below reproduce alongside their official weight.
Before you open a study guide, it helps to see the whole CompTIA Security+ syllabus laid out domain by domain, with the exact objective language CompTIA uses. The exam covers five domains, and each one is weighted differently, so the objectives below tell you where to spend your time and what CompTIA expects you to be able to do inside each topic.
Each domain lists the official objective statements from the exam guide. Treat every bullet as a checklist item: if a phrase is unfamiliar, that is the topic to research next, not skip.
General security concepts (12% of the exam)
- Security controls: comparing technical, preventive, managerial, deterrent, operational, detective, physical, corrective, compensating, and directive controls
- Fundamental concepts: summarizing confidentiality, integrity, and availability (CIA); non-repudiation; authentication, authorization, and accounting (AAA); zero trust; and deception/disruption technology
- Change management: explaining business processes, technical implications, documentation, and version control
- Cryptographic solutions: using public key infrastructure (PKI), encryption, obfuscation, hashing, digital signatures, and blockchain
This domain is the foundation the other four build on. Before you memorize attack names or tool names, you need the vocabulary above: what a control type is, what CIA and AAA stand for, and how change management and cryptography fit into a security program.
Threats, vulnerabilities, and mitigations (22% of the exam)
- Threat actors and motivations: comparing nation-states, unskilled attackers, hacktivists, insider threats, organized crime, shadow IT, and motivations like data exfiltration, espionage, and financial gain
- Threat vectors and attack surfaces: explaining message-based, unsecure networks, social engineering, file-based, voice call, supply chain, and vulnerable software vectors
- Vulnerabilities: explaining application, hardware, mobile device, virtualization, operating system (OS)-based, cloud-specific, web-based, and supply chain vulnerabilities
- Malicious activity: analyzing malware attacks, password attacks, application attacks, physical attacks, network attacks, and cryptographic attacks
- Mitigation techniques: using segmentation, access control, configuration enforcement, hardening, isolation, and patching
This is the largest domain apart from security operations, so plan extra review time here. It asks you to connect a threat actor's motivation to a likely vector, then match that vector to the mitigation technique that actually closes it.
Security architecture (18% of the exam)
- Architecture models: comparing on-premises, cloud, virtualization, Internet of Things (IoT), industrial control systems (ICS), and infrastructure as code (IaC)
- Enterprise infrastructure: applying security principles to infrastructure considerations, control selection, and secure communication/access
- Data protection: comparing data types, securing methods, general considerations, and classifications
- Resilience and recovery: explaining high availability, site considerations, testing, power, platform diversity, backups, and continuity of operations
This domain shifts from individual threats to how a whole environment is designed. Expect questions that ask you to choose the right architecture model or resilience approach for a stated business constraint, not just define a term.
Security operations (28% of the exam)
- Computing resources: applying secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing, and monitoring
- Asset management: explaining acquisition, disposal, assignment, and monitoring/tracking of hardware, software, and data assets
- Vulnerability management: identifying, analyzing, remediating, validating, and reporting vulnerabilities
- Alerting and monitoring: explaining monitoring tools and computing resource activities
- Enterprise security: modifying firewalls, IDS/IPS, DNS filtering, DLP (data loss prevention), NAC (network access control), and EDR/XDR (endpoint/extended detection and response)
- Identity and access management: implementing provisioning, SSO (single sign-on), MFA (multifactor authentication), and privileged access tools
- Automation and orchestration: explaining automation use cases, scripting benefits, and considerations
- Incident response: implementing processes, training, testing, root cause analysis, threat hunting, and digital forensics
- Data sources: using log data and other sources to support investigations
Security operations is the single largest domain on the CompTIA Security+ syllabus, so a study plan that under-invests here is the most common reason candidates come up short. It blends day-to-day operational tasks like asset management with incident response and forensics, so give yourself time to work through both the routine and the reactive side.
Security program management and oversight (20% of the exam)
- Security governance: summarizing guidelines, policies, standards, procedures, external considerations, monitoring, governance structures, and roles/responsibilities
- Risk management: explaining risk identification, assessment, analysis, register, tolerance, appetite, strategies, reporting, and business impact analysis (BIA)
- Third-party risk: managing vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement
- Security compliance: summarizing compliance reporting, consequences of non-compliance, monitoring, and privacy
- Audits and assessments: explaining attestation, internal/external audits, and penetration testing
- Security awareness: implementing phishing training, anomalous behavior recognition, user guidance, reporting, and monitoring
This domain is the most management-facing of the five. If your background is hands-on technical work, plan extra time for governance, risk, and third-party vocabulary, since it is tested with the same weight as security architecture.
How to use this syllabus
Work domain by domain in weight order, starting with security operations and threats, vulnerabilities, and mitigations, since together they make up half of the exam. Pair each domain with the study plan and check your recall against the sample questions before moving to the next domain. For the format of the exam itself, including question types and scoring, see the exam format and scoring page.
Exam facts on this page come from CompTIA’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.