CompTIA · SY0-701
CompTIA Security+ validates core cybersecurity skills needed to assess enterprise security posture, implement security solutions, and monitor and respond to security incidents across hybrid environments including cloud, mobile, and IoT.
Practice Questions
700
≈ 7 practice exams
Duration
90 minutes
Passing Score
750/900
Difficulty
AssociateLast Updated
Jul 2026
This Security+ practice exam follows how SY0-701 is actually weighted. Security Operations carries 28 percent of the marks and Threats, Vulnerabilities, and Mitigations another 22 percent, so half the real exam sits in just those two domains and the question bank gives them matching depth. The rest covers Security Program Management and Oversight (20 percent), Security Architecture (18 percent), and General Security Concepts (12 percent).
On test day you face a maximum of 90 questions in 90 minutes, a mix of multiple choice and performance-based questions, and you need a scaled 750 on a 100 to 900 scale to pass. That works out to roughly a minute per question, so timed practice sessions matter as much as raw accuracy. The explanations here connect each answer back to the underlying control, attack technique, or architecture concept, which is exactly the kind of applied understanding the performance-based questions reward.
Security+ is a DoD 8140 approved baseline certification, which is why it appears as a hard requirement in so many federal and defense job listings. CompTIA recommends holding Network+ and about two years in a security or systems administrator role first, but there is no formal prerequisite. Start with the 30 free questions to benchmark yourself, then work through the full 700-question bank until your accuracy holds steady across all five domains.
CompTIA Security+ (SY0-701) is a cybersecurity certification that validates core competencies required for IT security roles and government/DoD 8570-compliant positions. The exam assesses professionals' ability to assess enterprise security posture, implement security controls, and respond to security incidents across hybrid environments including cloud, mobile, and IoT infrastructure. Security+ represents a fundamental credential demonstrating practical knowledge in cryptography, access controls, threat management, security architecture, and incident response—making it a prerequisite for advancement in cybersecurity careers.
CompTIA Security+ targets IT professionals transitioning into cybersecurity roles, including systems administrators, network administrators, IT support specialists, and helpdesk technicians. The certification aligns with DoD 8570 work roles such as cyber defense analysts, incident responders, vulnerability analysts, and security engineers. It serves candidates with 1-2 years of IT experience seeking to formalize their cybersecurity knowledge and government contractors requiring federal compliance certifications. Security+ is ideal for career changers entering cybersecurity and professionals supporting larger organizations' security operations.
CompTIA recommends CompTIA Network+ certification and a minimum of two years of hands-on experience working in a security or systems administrator role. While Network+ is strongly recommended, candidates with deep IT operations or system administration background without formal Network+ may attempt the exam. Practical experience managing security tools, responding to security incidents, or working in IT support roles significantly improves exam readiness. Familiarity with networking concepts (TCP/IP, DNS, firewalls) and basic system administration is essential.
The Security+ exam (SY0-701) contains a maximum of 90 questions combining multiple-choice and performance-based (hands-on simulation) questions. The exam duration is 90 minutes. A passing score of 750 is required on a scale of 100-900, equivalent to approximately 83% correct. The exam is delivered through Pearson VUE testing centers and online proctored environments. It is available in English, Japanese, Portuguese, Spanish, and Thai. The exam was launched November 7, 2023, and is estimated to retire in 2026 (standard three-year lifecycle). Performance-based questions test practical skills such as analyzing security scenarios, identifying vulnerabilities, and recommending mitigations.
Security+ certification leads directly to cybersecurity career advancement with immediate salary impact. Entry-level cybersecurity roles start at $50,000-$70,000 annually; professionals with 3-5 years of Security+-validated experience earn $70,000-$100,000, while senior security analysts and specialists command $90,000-$150,000+. Common Security+-eligible positions include SOC Analyst ($78,000), IT Security Specialist ($90,000), Cybersecurity Analyst ($85,000), and Systems Administrator ($80,000). Security+ is DoD 8570-compliant, opening federal contractor and government positions often requiring it as a baseline credential. The U.S. Bureau of Labor Statistics projects 28.5% growth for information security analyst roles through 2034, significantly above average occupational growth. CyberSeek data shows only 83 cybersecurity workers per 100 available cybersecurity jobs, indicating strong demand. Stacking additional certifications (CySA+, PenTest+) alongside Security+ increases salary potential by $8,000-$25,000 annually, establishing a foundation for continuous advancement into management and specialized security roles.
5 sample questions with answers and explanations. The full bank has 700 questions, enough for 7 full-length practice exams.
Preview — answers shown1. A threat intelligence report identifies different actors targeting Litware's infrastructure. A nation-state actor is MOST likely motivated by what? (Select one!)
Explanation
Nation-state actors are government-sponsored and primarily motivated by espionage, intellectual property theft, critical infrastructure disruption, and strategic or political advantage. Financial gain through ransomware is typical of organized crime groups. Social activism describes hacktivists. Recognition-seeking describes unskilled attackers.
2. Litware Inc. processes payment card data and must comply with PCI-DSS requirements. During a compliance review, the assessor asks about file integrity monitoring on the cardholder data environment servers. The security team explains their current approach: a cryptographic baseline of all critical system files is established at a known-good state, and any subsequent changes trigger an alert. Which cryptographic function makes this monitoring approach effective, and why is encryption not used instead for this purpose? (Select one!)
Explanation
File integrity monitoring relies on cryptographic hashing rather than encryption because the goal is integrity verification, not confidentiality. A hash function takes an input of any size and produces a fixed-size output called a digest. This function is one-way — the original file cannot be reconstructed from the hash — and deterministic, meaning the same file always produces the same hash. Any change to even a single bit in the file produces a completely different hash value. By storing a baseline hash of each monitored file and periodically recomputing hashes to compare against the baseline, the system can detect any unauthorized modification instantly. SHA-256 is the standard algorithm used by tools such as Tripwire and AIDE for this purpose. Symmetric encryption protects the confidentiality of data by making it unreadable without a key, but it does not inherently detect whether the encrypted content has been modified. Asymmetric encryption supports digital signatures which can verify authenticity, but file integrity monitoring at the filesystem level uses hashing for its simplicity, speed, and the impossibility of regenerating a matching hash after modification. Tokenization replaces sensitive data with surrogate values for compliance purposes and has no application in filesystem change detection.
3. Fabrikam needs to implement centralized authentication for network device administration across 200 routers and switches. The solution must provide full packet encryption and separate authentication from authorization for granular command-level control. Which protocol best meets these requirements? (Select one!)
Explanation
TACACS+ is the optimal choice for network device administration. It uses TCP port 49, encrypts the entire packet (not just passwords), and critically separates Authentication, Authorization, and Accounting (AAA) functions. This separation enables granular command-level authorization control, allowing administrators to restrict which commands users can execute on network devices. RADIUS combines authentication and authorization, uses UDP, and only encrypts passwords, making it better suited for network access (Wi-Fi, VPN) rather than device administration. LDAP and Kerberos are authentication protocols but lack the specialized AAA separation needed for network device management.
4. Fabrikam's risk management team is conducting a quantitative risk assessment for their primary database server. The server has an asset value of $200,000. Historical data shows that a flood affecting the server occurs approximately once every four years, and a flood event would cause 40% damage to the asset. What is the Annualized Loss Expectancy for this flood risk? (Select one!)
Explanation
The quantitative risk calculation proceeds in two steps. First, calculate the Single Loss Expectancy using the formula SLE equals Asset Value multiplied by Exposure Factor. SLE equals $200,000 multiplied by 0.40, which equals $80,000. Second, calculate the Annualized Loss Expectancy using the formula ALE equals SLE multiplied by Annualized Rate of Occurrence. An event occurring once every four years translates to an ARO of 0.25 (not 4, which is a common error). ALE equals $80,000 multiplied by 0.25, which equals $20,000 per year. The $80,000 figure represents the SLE, the cost of a single flood event, not the annualized expected loss. $8,000 would result from incorrectly applying the ARO. $50,000 has no mathematical basis in this calculation. Any security control costing more than $20,000 per year would not be cost-justified based purely on this risk.
5. During an incident investigation, security analysts discover that an attacker captured NTLM password hashes from LSASS memory on a compromised workstation and used those hashes to authenticate to multiple servers without cracking the passwords. What characteristic of the authentication protocol enabled this attack, and what is the primary mitigation? (Select one!)
Explanation
Pass-the-hash attacks exploit NTLM's protocol design where the password hash itself serves as the authentication credential rather than merely being used to prove knowledge of the password. An attacker who extracts NTLM hashes from memory can present them directly to authenticate to other systems without needing to crack them to obtain the plaintext password. The most effective mitigation is transitioning to Kerberos authentication, which uses tickets instead of reusable hashes and provides mutual authentication, combined with adding privileged accounts to the Protected Users group, which prevents NTLM authentication and forces Kerberos usage while also preventing credential caching in memory. Credential Guard does protect LSASS through virtualization-based security but doesn't address the fundamental protocol vulnerability that allows hashes to be reused. Password length increases make offline cracking harder but don't prevent pass-the-hash since the attack uses the hash directly without needing the plaintext. NTLM does hash credentials before transmission, so the issue is not plaintext network exposure but rather the reusability of captured hash values.
A maximum of 90 questions in 90 minutes, mixing multiple-choice with performance-based questions (PBQs) that simulate hands-on security scenarios.
You need 750 on a scale of 100 to 900. It is a scaled score, not a straight percentage.
CompTIA raised prices across its exam lineup around June 2026, moving the Security+ voucher from $425 to roughly $439. Check the official CompTIA store for the current price before buying.
Yes. It is valid for 3 years. To renew you need 50 continuing education units (CEUs) and a $150 fee for the cycle, or you can renew by passing a newer exam version or completing CertMaster CE.
As of mid-2026, SY0-701 is still the current and only active Security+ version, and CompTIA has not announced an official SY0-801 launch or SY0-701 retirement date. CompTIA typically retires exams about three years after launch (SY0-701 launched November 2023) with at least six months notice, so SY0-701 remains the exam to study for right now.
CompTIA does not publish an official pass rate. Most candidates find the performance-based questions the hardest part. CompTIA recommends Network+ level knowledge and about two years of security or systems administration experience before attempting it.
Yes. Security+ is a DoD 8140 approved baseline certification covering work roles like cyber defense analyst, incident responder, vulnerability analyst, and system administrator, which is why many federal and defense positions require it.
Five domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%).
CompTIA PenTest+ (PT0-003)
PT0-003 · 699 questions
CompTIA Project+ (PK0-005)
PK0-005 · 696 questions
CompTIA SecAI+ Certification (CY0-001)
CY0-001 · 600 questions
CompTIA SecurityX (CAS-005)
CAS-005 · 599 questions
CompTIA Tech+ IT Fundamentals (FC0-U71)
FC0-U71 · 599 questions
CompTIA A+ Core 1 (220-1101)
220-1101 · 700 questions
$17.99
One-time access to this exam