ShahmikhCompTIA Security+ SY0-701 is a 90-minute exam with a maximum of 90 questions, a mix of multiple-choice and performance-based items, and you need 750 on a scale of 100 to 900 to pass. It is split into five domains, and Security Operations alone is 28% of it. A realistic plan for most people with some IT background is about 8 weeks, spending study time roughly in proportion to those domain weights and finishing with timed practice questions.
Key takeaways
- SY0-701 allows a maximum of 90 questions in 90 minutes, mixing multiple-choice and performance-based questions. The pass mark is 750 on a 100 to 900 scale.
- Security Operations (28%) and Threats, Vulnerabilities and Mitigations (22%) together are half of the exam.
- General Security Concepts is the smallest domain at 12%, but its ideas, like the CIA triad and access control, appear in every other domain.
- CompTIA recommends Network+ and two years of security or systems administration experience, and these are recommendations, not prerequisites.
- Study in proportion to the domain weights, and switch to timed practice questions for the last two weeks.
What is the Security+ SY0-701 exam format?
The CompTIA Security+ page lists the exam as SY0-701, with a maximum of 90 questions, 90 minutes, multiple-choice and performance-based questions, and a passing score of 750 on a scale of 100 to 900. It is offered in English, Japanese, Portuguese, Spanish and Thai.
Performance-based questions are small simulated tasks, such as configuring or analysing something, instead of picking an answer. You will need to know a topic well enough to do something with it, not just recognise the right term.
CompTIA lists Network+ plus two years of security or systems administrator experience as recommended, not required. If you are new to IT, expect to need more time on networking basics, since many security concepts build on them.
How is the exam split across the five domains?
The same CompTIA page gives these weights:
| Domain | Weight |
|---|---|
| General Security Concepts | 12% |
| Threats, Vulnerabilities and Mitigations | 22% |
| Security Architecture | 18% |
| Security Operations | 28% |
| Security Program Management and Oversight | 20% |
CompTIA's own comparison of SY0-601 and SY0-701 explains that Security Operations absorbed the old incident response domain, that General Security Concepts is a new domain, and that the exam puts more emphasis on current trends such as zero trust, automation, and hybrid cloud and on-premises environments. If you find a study book or video made for SY0-601, check it against the 701 objectives before relying on it.
What does a realistic 8-week study plan look like?
This plan is my own teaching suggestion, not a CompTIA recommendation. It assumes about 8 to 10 hours a week and some IT background. If you have none, stretch it to 10 or 12 weeks and add networking basics at the start.
| Week | Focus | Why |
|---|---|---|
| 1 | General Security Concepts | Small domain, but the vocabulary underpins everything else |
| 2 and 3 | Threats, Vulnerabilities and Mitigations | 22%, and full of terms that are easy to mix up |
| 4 | Security Architecture | 18%: network design, cloud, resilience, cryptography basics |
| 5 and 6 | Security Operations | The biggest domain at 28%: monitoring, incident response, identity and access management, automation |
| 7 | Security Program Management and Oversight | 20%: risk, governance, compliance, third parties, awareness |
| 8 | Timed practice and weak spots | Full-length practice under exam timing, then fix what you missed |
Each week, spend roughly half your time learning, a quarter on practice questions on that domain, and a quarter reviewing wrong answers from earlier weeks.
How should you study each domain?
Read the exam objectives first. CompTIA publishes them for each exam, and they are the list of what can be asked. Turn each objective into a question you can answer from memory, such as "what is the difference between X and Y, and when would I use each?"
- Learn in short blocks. One objective group per session, then close the book and write what you remember.
- Make comparison tables. Security+ loves pairs that sound alike, such as authentication and authorisation, or symmetric and asymmetric encryption.
- Do hands-on work for the operations topics. Reading logs, running a vulnerability scan on your own lab machine and setting up a basic firewall rule teach more than rereading notes.
- Review every wrong answer. Write why the right answer is right and why your answer was wrong. That second part is where the points come from.
How do you prepare for the final week and exam day?
In the last week, do two timed runs of 90 questions in 90 minutes using a reputable question bank, and treat the second run as a rehearsal. About one minute per question is the rule of thumb the format suggests. If a performance-based question looks long, mark it, answer what you can and keep moving, then come back with the time that is left.
Aim to be well above the pass mark on practice papers before you book, and check CompTIA's page for the current exam version and any retirement notice before you pay for a voucher. If you would like a plan built around your own background, my Security+ and CCNA lessons start with a short diagnostic, and you can book a free call to talk it through.
Frequently asked questions
How many questions are on the Security+ SY0-701 exam?
CompTIA lists a maximum of 90 questions, in 90 minutes. They are a mix of multiple-choice and performance-based questions, so the exact number can vary.
What score do you need to pass Security+ SY0-701?
A score of 750 on a scale of 100 to 900. CompTIA does not turn this into a simple percentage of questions, so aim well above the pass mark in practice.
Do I need Network+ before Security+?
No. CompTIA recommends Network+ and two years of experience, but they are not requirements. If you do not have a networking background, add time for IP addressing, ports and common protocols before you start the security topics.