CompTIA · SY0-701
CompTIA Security+ validates core cybersecurity skills needed to assess enterprise security posture, implement security solutions, and monitor and respond to security incidents across hybrid environments including cloud, mobile, and IoT.
Practice Questions
700
≈ 7 practice exams
Duration
90 minutes
Passing Score
750/900
Difficulty
AssociateLast Updated
Jul 2026
This Security+ practice exam follows how SY0-701 is actually weighted. Security Operations carries 28 percent of the marks and Threats, Vulnerabilities, and Mitigations another 22 percent, so half the real exam sits in just those two domains and the question bank gives them matching depth. The rest covers Security Program Management and Oversight (20 percent), Security Architecture (18 percent), and General Security Concepts (12 percent).
On test day you face a maximum of 90 questions in 90 minutes, a mix of multiple choice and performance-based questions, and you need a scaled 750 on a 100 to 900 scale to pass. That works out to roughly a minute per question, so timed practice sessions matter as much as raw accuracy. The explanations here connect each answer back to the underlying control, attack technique, or architecture concept, which is exactly the kind of applied understanding the performance-based questions reward.
Security+ is a DoD 8140 approved baseline certification, which is why it appears as a hard requirement in so many federal and defense job listings. CompTIA recommends holding Network+ and about two years in a security or systems administrator role first, but there is no formal prerequisite. Start with the 30 free questions to benchmark yourself, then work through the full 700-question bank until your accuracy holds steady across all five domains.
CompTIA Security+ (SY0-701) is a cybersecurity certification that validates core competencies required for IT security roles and government/DoD 8570-compliant positions. The exam assesses professionals' ability to assess enterprise security posture, implement security controls, and respond to security incidents across hybrid environments including cloud, mobile, and IoT infrastructure. Security+ represents a fundamental credential demonstrating practical knowledge in cryptography, access controls, threat management, security architecture, and incident response—making it a prerequisite for advancement in cybersecurity careers.
CompTIA Security+ targets IT professionals transitioning into cybersecurity roles, including systems administrators, network administrators, IT support specialists, and helpdesk technicians. The certification aligns with DoD 8570 work roles such as cyber defense analysts, incident responders, vulnerability analysts, and security engineers. It serves candidates with 1-2 years of IT experience seeking to formalize their cybersecurity knowledge and government contractors requiring federal compliance certifications. Security+ is ideal for career changers entering cybersecurity and professionals supporting larger organizations' security operations.
CompTIA recommends CompTIA Network+ certification and a minimum of two years of hands-on experience working in a security or systems administrator role. While Network+ is strongly recommended, candidates with deep IT operations or system administration background without formal Network+ may attempt the exam. Practical experience managing security tools, responding to security incidents, or working in IT support roles significantly improves exam readiness. Familiarity with networking concepts (TCP/IP, DNS, firewalls) and basic system administration is essential.
The Security+ exam (SY0-701) contains a maximum of 90 questions combining multiple-choice and performance-based (hands-on simulation) questions. The exam duration is 90 minutes. A passing score of 750 is required on a scale of 100-900, equivalent to approximately 83% correct. The exam is delivered through Pearson VUE testing centers and online proctored environments. It is available in English, Japanese, Portuguese, Spanish, and Thai. The exam was launched November 7, 2023, and is estimated to retire in 2026 (standard three-year lifecycle). Performance-based questions test practical skills such as analyzing security scenarios, identifying vulnerabilities, and recommending mitigations.
Security+ certification leads directly to cybersecurity career advancement with immediate salary impact. Entry-level cybersecurity roles start at $50,000-$70,000 annually; professionals with 3-5 years of Security+-validated experience earn $70,000-$100,000, while senior security analysts and specialists command $90,000-$150,000+. Common Security+-eligible positions include SOC Analyst ($78,000), IT Security Specialist ($90,000), Cybersecurity Analyst ($85,000), and Systems Administrator ($80,000). Security+ is DoD 8570-compliant, opening federal contractor and government positions often requiring it as a baseline credential. The U.S. Bureau of Labor Statistics projects 28.5% growth for information security analyst roles through 2034, significantly above average occupational growth. CyberSeek data shows only 83 cybersecurity workers per 100 available cybersecurity jobs, indicating strong demand. Stacking additional certifications (CySA+, PenTest+) alongside Security+ increases salary potential by $8,000-$25,000 annually, establishing a foundation for continuous advancement into management and specialized security roles.
5 sample questions with answers and explanations. The full bank has 700 questions, enough for 7 full-length practice exams.
Preview — answers shown1. A threat intelligence analyst at Litware Inc. is profiling a threat actor that has maintained persistent access to a government contractor's network for over eighteen months, exfiltrating classified defense research without triggering any alerts. The actor uses custom-developed zero-day exploits and has demonstrated the ability to modify firmware on network devices. Which threat actor category BEST matches this profile? (Select one!)
Explanation
The behavioral profile described is consistent with a nation-state sponsored Advanced Persistent Threat actor. Key indicators include the eighteen-month dwell time demonstrating long-term, patient persistence rather than smash-and-grab tactics, the targeting of classified defense research suggesting espionage as the primary motivation, the use of custom zero-day exploits requiring substantial financial and technical resources, and the capability to modify device firmware indicating very high sophistication. Nation-states have essentially unlimited government resources and employ highly skilled teams whose primary motivations are espionage, intelligence gathering, and strategic advantage. Organized crime focuses on financial gain and typically does not invest in this level of stealth or custom tooling. Hacktivists are motivated by ideological goals and typically make their activities public. Unskilled attackers rely on pre-made tools and lack the sophistication to develop firmware exploits or maintain undetected access for extended periods.
2. Contoso's web application experienced a security breach where an attacker intercepted network traffic between a user and the server. The attacker extracted the user's session cookie from the HTTP traffic, replayed it in their own browser, and successfully accessed the user's account without needing credentials. The security team needs to identify the attack type and implement a control to prevent recurrence. What attack occurred and what HTTP security header would prevent this in the future? (Select two!)
Multiple correct answersExplanation
Session hijacking occurred when the attacker captured the session cookie during unencrypted HTTP transmission and replayed it to impersonate the legitimate user. The cookie acts as proof of authentication, so stealing it grants unauthorized access. HTTP Strict Transport Security (HSTS) prevents this attack by forcing all connections to use HTTPS/TLS encryption, ensuring cookies cannot be intercepted in plaintext during transit. CSRF involves tricking authenticated users into executing unwanted actions through malicious links, which does not match this scenario. CSP prevents XSS attacks by controlling resource loading sources. X-Frame-Options prevents clickjacking by controlling iframe embedding. Neither CSP nor X-Frame-Options address cookie theft during network transmission.
3. Fabrikam is conducting a security assessment of a web application. The testing team has been provided with complete documentation including source code, architecture diagrams, credentials, and network topology. Which penetration testing environment methodology is being used? (Select one!)
Explanation
Known environment testing (formerly called white box) provides testers with complete information including source code, credentials, architecture, and documentation, allowing thorough assessment of security controls with maximum insight. Unknown environment testing (formerly black box) provides no information, simulating external attacker perspective. Partially known environment testing (formerly gray box) provides limited information such as credentials but not full documentation. Red team exercises are adversarial simulations that focus on testing detection and response capabilities rather than comprehensive vulnerability assessment.
4. Adatum discovers malware that encrypted all database files and displays a ransom demand, but investigators find the malware disguised itself as a legitimate system update and was delivered through a compromised software vendor. Which malware types are present? (Select two!)
Multiple correct answersExplanation
Ransomware encrypts files and demands payment for decryption. A trojan disguises itself as legitimate software (the fake system update) to gain access. Worms self-replicate across networks without user interaction. Logic bombs execute payloads based on specific triggers such as time or events. Viruses attach to legitimate files and require host execution, but the disguised update scenario specifically describes trojan behavior combined with the ransomware payload.
5. A government research facility is preparing for post-quantum cryptographic threats following NIST's standardization efforts. Which FIPS standards should they implement for quantum-resistant encryption and digital signatures? (Select two!)
Multiple correct answersExplanation
FIPS 203 specifies ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) for quantum-resistant encryption, while FIPS 204 specifies ML-DSA (Module-Lattice-Based Digital Signature Algorithm) for quantum-resistant signatures. These are NIST's standardized post-quantum cryptographic algorithms finalized in August 2024. FIPS 140-3 defines security requirements for cryptographic modules but does not specify post-quantum algorithms. FIPS 186-5 covers traditional RSA and ECDSA signatures which are vulnerable to quantum attacks. FIPS 197 specifies AES, which while quantum-resistant with sufficient key length, is not a new post-quantum standard.
A maximum of 90 questions in 90 minutes, mixing multiple-choice with performance-based questions (PBQs) that simulate hands-on security scenarios.
You need 750 on a scale of 100 to 900. It is a scaled score, not a straight percentage.
CompTIA raised prices across its exam lineup around June 2026, moving the Security+ voucher from $425 to roughly $439. Check the official CompTIA store for the current price before buying.
Yes. It is valid for 3 years. To renew you need 50 continuing education units (CEUs) and a $150 fee for the cycle, or you can renew by passing a newer exam version or completing CertMaster CE.
As of mid-2026, SY0-701 is still the current and only active Security+ version, and CompTIA has not announced an official SY0-801 launch or SY0-701 retirement date. CompTIA typically retires exams about three years after launch (SY0-701 launched November 2023) with at least six months notice, so SY0-701 remains the exam to study for right now.
CompTIA does not publish an official pass rate. Most candidates find the performance-based questions the hardest part. CompTIA recommends Network+ level knowledge and about two years of security or systems administration experience before attempting it.
Yes. Security+ is a DoD 8140 approved baseline certification covering work roles like cyber defense analyst, incident responder, vulnerability analyst, and system administrator, which is why many federal and defense positions require it.
Five domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%).
CompTIA PenTest+ (PT0-003)
PT0-003 · 699 questions
CompTIA Project+ (PK0-005)
PK0-005 · 696 questions
CompTIA SecAI+ Certification (CY0-001)
CY0-001 · 600 questions
CompTIA SecurityX (CAS-005)
CAS-005 · 599 questions
CompTIA Tech+ IT Fundamentals (FC0-U71)
FC0-U71 · 599 questions
CompTIA A+ Core 1 (220-1101)
220-1101 · 700 questions
$17.99
One-time access to this exam