Security+ SY0-701 Domains Explained in Plain English

If you’re looking up Security+ SY0-701 domains explained in plain English, you want the five buckets CompTIA actually scores — not a vague “learn cybersecurity” checklist. CompTIA Security+ (exam series code SY0-701, also called Security+ V7) is CompTIA’s early-career cybersecurity certification. Below is how the five domains are weighted, what each one covers, how the exam is built, and five original practice questions so you can see the style of thinking the test rewards.

What Security+ SY0-701 is

CompTIA Security+ is vendor-neutral: it tests security ideas across many tools, not one product line. CompTIA says it checks that you can assess enterprise security posture, secure hybrid environments (cloud, mobile, Internet of Things), work with governance and risk, and respond to security events.

The live exam today is SY0-701 (Security+ V7), launched November 7, 2023. English retires June 11, 2027. CompTIA expects Security+ V8 around November 17, 2026 — confirm which exam code your voucher and materials target.

No hard prerequisite. CompTIA recommends Network+ and about two years in a security or systems administrator role. The cert lasts three years and renews through CompTIA continuing education.

Sources: CompTIA Security+ V7 exam page, CompTIA Security+ FAQ blog, and the SY0-701 Exam Objectives PDF, all checked as of Oct 13, 2026.

Exam format at a glance

Here are the numbers CompTIA publishes for SY0-701:

• Maximum of 90 questions, a mix of multiple-choice and performance-based questions (PBQs). PBQs put you in a simulated task instead of only picking A–D.
• 90 minutes to finish. That is a tight clock if several PBQs appear early, so practice flagging and moving on.
• Passing score: 750 on a scale of 100 to 900. CompTIA does not publish a raw “get X of 90 right” map, so treat vendor practice percentages as a trend, not as CompTIA’s scaled score.
• Voucher: Buy from CompTIA (or an authorized channel) and schedule through Pearson VUE. Confirm the live store price when you buy — regional prices change.

Sources: CompTIA Security+ V7 exam page and SY0-701 Exam Objectives PDF, both checked as of Oct 13, 2026.

The five SY0-701 domains (and where your hours should go)

CompTIA’s objectives split the exam into five domains. The percentages are the share of the exam, not a promise of exact question counts:

• 1.0 General Security Concepts — 12%
• 2.0 Threats, Vulnerabilities, and Mitigations — 22%
• 3.0 Security Architecture — 18%
• 4.0 Security Operations — 28%
• 5.0 Security Program Management and Oversight — 20%

Source: SY0-701 Exam Objectives PDF and CompTIA Security+ V7 page, as of Oct 13, 2026.

Security Operations alone is more than a quarter of the exam. Add Threats and Program Management and you are past 70% of the weight. General Security Concepts is the smallest slice, but it is the vocabulary everything else leans on.

Domain 1: General Security Concepts (12%)

This is the foundation: control categories (technical, managerial, operational, physical) and control types (preventive, detective, corrective, deterrent, compensating, directive). You also need confidentiality, integrity, and availability (the CIA triad), plus non-repudiation and authentication, authorization, and accounting (AAA).

Expect zero trust, change-management basics, and crypto building blocks — public key infrastructure (PKI), hashing, salting, digital signatures, and symmetric versus asymmetric encryption. Domains 2–4 keep using these labels.

Domain 2: Threats, Vulnerabilities, and Mitigations (22%)

Match actors (nation-state, insider, organized crime, hacktivist, unskilled attacker, shadow IT) to motivations. Explain attack surfaces: phishing and other social engineering, unsecure networks, supply chain, default credentials, and vulnerable software.

Vulnerabilities include injection, cross-site scripting (XSS), buffer overflows, misconfiguration, zero-days, and issues such as VM escape. Mitigations include segmentation, least privilege, patching, hardening, and encryption. PBQs often give symptoms and ask what you do next, not just a definition.

Domain 3: Security Architecture (18%)

Architecture is how pieces fit: cloud and hybrid models, shared responsibility, infrastructure as code (IaC), IoT, and industrial control environments. You apply zoning, firewalls (including next-generation and web application firewalls), VPN access, and fail-open versus fail-closed behavior.

Data protection covers data at rest, in transit, and in use; classification; encryption and tokenization — plus hot/warm/cold sites and backups. Placement of controls matters more than brand names.

Domain 4: Security Operations (28%)

This is the heaviest domain: hardening baselines, mobile device management (MDM) models such as BYOD and COPE, wireless security (including WPA3), vulnerability management (scan, prioritize with CVSS/CVE ideas, remediate, rescan), and tools such as SIEM, DLP, EDR/XDR, and IDS/IPS.

Identity and access covers provisioning, single sign-on (SSO), multifactor authentication (MFA), and privileged access — plus incident response and using logs in an investigation. Weight your calendar here with timed “what do you do next” practice.

Domain 5: Security Program Management and Oversight (20%)

This is the business layer: policies, standards, procedures, and roles (owners, custodians, processors). Risk management covers qualitative and quantitative ideas (including SLE, ALE, and ARO) and strategies — transfer, accept, avoid, mitigate.

You also see third-party risk (SLAs, NDAs, due diligence), compliance and privacy, audits, penetration-test environment labels (known / partially known / unknown), and security awareness. Pair each formula or agreement with a one-line “when would I use this?”

How to use the domain weights on test day

• Budget study hours to the outline. Operations (28%) plus Threats (22%) plus Oversight (20%) should dominate your calendar.
• Do not ignore the 12%. Control types and CIA language show up inside heavier domains.
• Practice PBQs under time. Ninety minutes for up to 90 items leaves little slack if a simulation stalls you.
• Confirm the exam code. SY0-701 is V7; CompTIA’s next version is already on the roadmap.
• Use CompTIA’s objectives PDF as the checklist. Third-party chapter lists help only when they map back to these five domains.

Try 5 practice questions

These are original questions written for this post. They are not from any real CompTIA exam.

1. On CompTIA’s SY0-701 domain table, which domain carries the largest share of the exam?

A. General Security Concepts
B. Security Architecture
C. Security Operations
D. Security Program Management and Oversight

Answer: C. CompTIA lists Security Operations at 28%, the highest single domain weight on the SY0-701 objectives.

2. A question asks you to classify a lock on a data-center door. Under CompTIA’s control categories, which label fits best?

A. Technical
B. Managerial
C. Operational
D. Physical

Answer: D. Physical controls protect facilities and hardware directly (locks, fences, guards, cameras). Technical controls use technology such as firewalls or encryption.

3. Maya finishes SY0-701 and sees a scaled score of 750. What does that mean under CompTIA’s published scoring?

A. She got exactly 75 of 90 questions right
B. She met the passing standard on CompTIA’s 100–900 scale
C. She failed because the pass mark is 800
D. She must retake because scaled scores under 850 do not count

Answer: B. CompTIA sets the passing score at 750 on a scale of 100 to 900. It does not publish a raw correct-count that equals 750.

4. Which topic set belongs primarily in Domain 2 (Threats, Vulnerabilities, and Mitigations)?

A. Hot site versus cold site planning
B. Phishing, XSS, and segmentation as a mitigation
C. Writing an acceptable use policy
D. Configuring SSO with SAML

Answer: B. Domain 2 covers threat actors, attack surfaces, vulnerability types, malicious activity indicators, and mitigation techniques. Hot/cold sites are architecture; AUP is governance; SSO is operations/IAM.

5. Sam has 90 minutes for a maximum of 90 SY0-701 items, including performance-based questions. Which pacing approach matches the published format?

A. Spend half the clock on the first five items because PBQs always appear last
B. Treat every item as timed work and flag hard simulations to revisit
C. Skip all multiple-choice items until every PBQ is perfect
D. Assume there are always exactly 90 scored essays

Answer: B. CompTIA allows up to 90 mixed multiple-choice and performance-based items in 90 minutes. PBQ placement is not something you should bet the clock on — flag and return is safer.

The bottom line

SY0-701 is CompTIA Security+ V7: up to 90 multiple-choice and performance-based questions, 90 minutes, and a passing score of 750 on a 100–900 scale. The five domains run from General Security Concepts (12%) through Security Operations (28%). Weight your study plan to Operations, Threats, and Program Management, keep the foundational vocabulary sharp, and confirm every number on CompTIA’s site before you buy a voucher — rules and prices can change.

Exam facts checked against CompTIA’s Security+ V7 page, Security+ FAQ blog, and the official SY0-701 Exam Objectives PDF as of Oct 13, 2026. Rules can change, so always confirm with CompTIA before you test. ebooklessons.com is an independent study aid and is not affiliated with CompTIA.