CompTIA Security+ (SY0-701) Study Guide — Pass on Your First Try in 2026
A no-fluff Security+ study plan: the SY0-701 domain weights, the 12 acronyms that crush most failures, performance-based question strategy, and a 6-week schedule that works for full-time learners.
The Security+ exam is the rite of passage for most cybersecurity careers. It's the entry-level cert that hiring managers actually filter on, the one DoD 8570 lists as approved for IAT Level II, and the one that opens the door to SOC analyst, junior pentester, and GRC roles. It's also the cert that more candidates fail than they admit — usually because they studied the wrong parts of the right material.
This guide is the version I wish I'd had. It walks through the SY0-701 domains by exam weight, names the traps, and gives you a six-week schedule you can actually keep.
How the SY0-701 exam is scored
The current Security+ exam — SY0-701, released late 2023 and the only version delivered today — gives you up to 90 questions in 90 minutes. You'll see a mix of multiple choice and performance-based questions (PBQs) that drop you into a simulated console, drag-and-drop, or fill-in-the-blank. The passing score is 750 / 900, which is a scaled score, not a percentage. Don't try to back-calculate "how many can I miss" — the scaling shifts. Aim for 85%+ on practice tests if you want comfortable headroom on test day.
The five domains are weighted like this:
| Domain | Weight |
|---|---|
| 1. General Security Concepts | 12% |
| 2. Threats, Vulnerabilities & Mitigations | 22% |
| 3. Security Architecture | 18% |
| 4. Security Operations | 28% |
| 5. Security Program Management & Oversight | 20% |
Domain 4 (Security Operations) is the heaviest — and it's also where the PBQs cluster. If you only have time to over-study one domain, make it this one.
The single biggest mistake candidates make
They memorize port numbers and acronyms, then walk in and discover the exam is testing scenarios. CompTIA isn't asking "what is HMAC?" It's asking "your application transmits sensitive HR data and you need to prove the message hasn't been tampered with — which control fits?" The answer requires the same fact, but the question requires you to recognize when to pull the lever.
Practice questions train scenario recognition. Flashcards train recall. You need both, in that order: facts first, then drill scenarios until the right answer feels obvious.
The 12 acronym families that will save you
If you only had a weekend, you'd grind these:
- CIA / DAD — confidentiality/integrity/availability and their inverse triad. Every control maps to one.
- AAA — authentication, authorization, accounting. Know which protocol does which (RADIUS, TACACS+, Kerberos).
- PKI chain — root CA, intermediate, certificate, CRL, OCSP, OCSP stapling. Know what fails when each is missing.
- Cipher modes — ECB (broken for blocks), CBC, GCM (the modern default). When you see "authenticated encryption," GCM is the answer.
- Hashing vs encryption vs encoding — irreversible vs reversible-with-key vs reversible-without-key. Base64 is encoding, not security.
- Symmetric vs asymmetric — AES vs RSA/ECC. Why we use both: bulk speed + key exchange.
- MFA factors — something you know / have / are / do / somewhere you are. Two of the same factor = single-factor.
- IAM models — DAC, MAC, RBAC, ABAC. ABAC is the one with attribute policies.
- Network segmentation — VLAN, microsegmentation, screened subnet (the term that replaced "DMZ").
- Wireless — WPA2 vs WPA3 (SAE/Dragonfly handshake), captive portals, EAP-TLS vs PEAP.
- IR lifecycle — preparation, identification, containment, eradication, recovery, lessons learned. Memorize order.
- Risk math — SLE = AV × EF, ALE = SLE × ARO. They will give you the formula in a question and expect you to plug numbers.
If you can explain each of those in a sentence to a non-technical friend, you've passed half the exam already.
How to actually beat performance-based questions
PBQs scare people more than they should. A few rules:
- They count more per question but partial credit exists. Don't leave one blank trying to "come back."
- Read every prompt twice. PBQs frequently say "drag the most appropriate" — the wrong distractor is plausible, just not best.
- Skip and flag if you're stuck. They appear at the start. If a PBQ eats 12 minutes you've lost the easy multiple-choice ones at the end. Pelican-strategy: flag, move on, return.
- Common scenarios: firewall rule ordering, log analysis (find the IoC), command output identification (
netstat,nmap,tcpdump), drag-the-control-to-the-vulnerability.
A 6-week schedule that works
This assumes ~10 hours a week. Cut to 3 weeks if you have IT background, stretch to 10 if you don't.
Week 1 — Domain 1 + Domain 2 fundamentals
Read Messer or Dion's video for Domain 1. Build flashcards as you go — Anki, paper, doesn't matter, just external. End the week with 30 practice questions on Domain 1. Review every wrong answer; rewrite the question in your own words.
Week 2 — Domain 2 deep dive
Threats and vulnerabilities is dense. Spend the week on attack types (MITM, on-path, replay, downgrade, side-channel), malware families, social engineering, and OWASP-style web app threats. Practice questions every other day.
Week 3 — Domain 3 architecture
Cloud models (IaaS/PaaS/SaaS), zero trust, embedded systems (IoT, ICS, SCADA), cryptographic suites. This is where flashcards earn their keep.
Week 4 — Domain 4 operations (the big one)
Logs, SIEM, IR, digital forensics, vulnerability management. Spend extra time here — half your real exam will live here. Do PBQ-style drills daily.
Week 5 — Domain 5 governance + full-length practice
Risk management, compliance frameworks (NIST, ISO 27001, GDPR, HIPAA, PCI DSS), policies, vendor risk. Take a full-length 90-question practice exam at the end of the week. Score below 80%? Don't book the test yet.
Week 6 — Mixed review + test simulation
Two full-length practice exams under timed conditions. Review every wrong answer, no exceptions. Schedule the real exam for the end of the week. Don't cram the day before — your brain consolidates while you sleep.
What to do in the last 48 hours
- Do not learn new material. Anything you don't know now, you won't learn in 48 hours.
- Review your wrong-answer notebook (you should have one).
- Skim the acronym list above three times.
- Sleep eight hours the night before. The score difference between rested and tired is bigger than any cram session.
- Eat protein, not sugar, on test morning. Glucose spikes cost you focus around question 50.
After you pass — the next move
Security+ alone is a doorway, not a destination. The career-shaping next step depends on where you want to go:
- SOC analyst track → CompTIA CySA+ builds directly on Sec+ and is the second-most-valuable cert for blue team roles.
- Pentester track → CompTIA PenTest+ or eventually OSCP.
- Cloud track → AWS Security Specialty or ISC2 CCSP.
- GRC / management track → ISC2 CISSP (after 5 years of experience) or ISACA CISM.
Frequently asked questions
How hard is Security+ compared to the CompTIA Network+?
About one and a half times harder. Network+ is concrete (subnetting, cabling, OSI layers); Security+ is conceptual and scenario-driven. If you struggled with Network+, give yourself an extra two weeks.
Can I pass Security+ without IT experience?
Yes, but it'll take 8–12 weeks of dedicated study instead of 4–6. The exam assumes you're comfortable with networks. If subnet mask, default gateway, or TCP three-way handshake aren't reflexive to you yet, do Network+ first.
How much does the Security+ exam cost in 2026?
The voucher is around $425 USD direct from CompTIA, often less ($300–$370) through academic partners or bundled with study materials. Re-takes start at $245 if you fail.
How long is Security+ valid for?
Three years from the day you pass. You can renew via continuing education units (CEUs), by passing a higher-level CompTIA cert (CySA+, PenTest+, CASP+/SecurityX), or by re-taking the latest version.
Is Security+ worth it in 2026?
Yes, more than ever. The DoD 8140 directive replaced 8570 and Security+ is on the approved list for most baseline IAT roles. It's the cheapest cert that unlocks government contractor work, and the easiest to add to a resume that's missing security signal.
Ready to start drilling? Run a free 30-question trial on CompTIA Security+ right now — no credit card, no email-trap. Just questions written by people who've taken the exam.