A lot of people start Security+ prep by opening whatever chapter of their book looks interesting — usually malware, sometimes cryptography — and get three months in before they realize they haven't touched half the exam. Knowing how the CompTIA Security+ exam domains actually break down is what keeps that from happening to you.
The SY0-701 version has five domains. They're not weighted equally, and they don't cost the same amount of study effort per percentage point. One of them is worth almost a third of the exam and is also where the most people fail. Another is only 12% of the exam but everything else builds on it. If you treat them all the same, you'll study wrong.
Here's what's actually on the exam, where your time matters most, and plain-language explainers for the sub-topics that trip up the most candidates — cryptography, PKI, and network security.
The five domains, at a glance
| Domain | Weight |
|---|---|
| 1. General Security Concepts | 12% |
| 2. Threats, Vulnerabilities, and Mitigations | 22% |
| 3. Security Architecture | 18% |
| 4. Security Operations | 28% |
| 5. Security Program Management and Oversight | 20% |
Domain 4 jumps out. At 28%, it's more than a quarter of the exam on its own, and the content inside it — cryptography, IAM, incident response — is where most test-takers lose points. If you come away from this guide with one thing, let it be that Domain 4 deserves disproportionate study time.
Domain 1: General Security Concepts (12%)
This domain is small and it's tempting to rush through it. Don't. Almost every other domain pulls vocabulary from here. If you're shaky on the CIA triad, control types, and the zero trust model, you'll read Domain 4 questions and won't even understand what they're asking.
The content itself is straightforward: the CIA triad and its inverse (DAD), security control categories (technical, operational, managerial, physical), control types (preventive, detective, corrective, compensating), data protection fundamentals, and zero trust. None of it is individually hard.
What trips people up is control categorization. Security+ loves to ask you whether a firewall is technical/preventive or operational/detective, whether security awareness training is operational/preventive or managerial/preventive, whether an audit is detective or compensating. These aren't trick questions — they have correct answers — but you need to think about them enough times that the categorization becomes automatic. Flashcards work well for this. So does writing out 20 example controls and classifying each one two ways (category + type) until it feels obvious.
The most common way people miss these is fixating on a single word — "audit," "scan," "log" — instead of the mechanism. A clean-desk policy enforced by monthly audits is preventive machinery; a camera catching someone at 2 a.m. is detective. Read the whole mechanism, then classify.
Spend a week or two here and move on.
Domain 2: Threats, Vulnerabilities, and Mitigations (22%)
This is the domain that feels the most like "security" in the pop-culture sense. Threat actors, malware families, social engineering, password attacks, vulnerability scanning, pen testing phases. It's also where candidates tend to over-invest, because the material is interesting and easy to read.
The trap is memorizing names without understanding what each attack targets. A useful exercise: for every malware type you study, write down what it primarily attacks from the CIA triad.
- Ransomware attacks availability (and, depending on the variant, confidentiality when data is exfiltrated before encryption).
- Spyware attacks confidentiality.
- Rootkits attack integrity — the OS itself is lying to you about what's running.
- Worms attack availability through propagation and resource consumption.
- Botnets are infrastructure, not really a payload — they get used for DDoS, spam, or crypto mining.
Social engineering is the other big chunk. The exam will give you a scenario and ask which specific variant it is. Phishing is untargeted mass email. Spear phishing is targeted to a specific person or group. Whaling is spear phishing where the target is an executive. Business Email Compromise mimics a real business email thread, often to redirect a wire transfer. Pretexting is the setup — the story the attacker tells to justify the ask. These overlap in messy ways in real life, but on the exam they're distinct, and you should know them cold.
Password and network attacks: read the evidence
Password attacks show how this domain wants you to read. Brute force in the strict sense tries every combination; "common passwords from known password lists" in a scenario means dictionary attack. Rainbow tables are offline — the attacker already has stolen hashes, so there are no login attempts in the logs. Pass-the-hash reuses captured NTLM hashes across Windows systems and would show lateral movement. That's why a line like "no lateral movement observed" isn't decoration: it's eliminating attack types. Read it as a clue about what the attack isn't.
On the network side, the exam's term is now on-path attack, not man-in-the-middle — ARP poisoning and SSL stripping are the classic examples. DDoS splits three ways, and matching type to defense is a common question: volumetric floods need upstream scrubbing, protocol attacks like SYN floods are handled at the network stack and firewall, and application-layer attacks (HTTP floods, Slowloris) need a WAF and rate limiting. A WAF doesn't stop a volumetric attack; scrubbing doesn't stop an application-layer one.
One pattern I've seen a lot: people who score 90%+ on Domain 2 practice questions still miss scenario questions on the real exam because they recognize the shape — "failed logins = password attack" — and grab the first plausible answer. The exam is built to punish that. Read the whole question. Every time.
CVSS, vulnerability scanning (credentialed vs. non-credentialed), and the pen testing phases (recon, scanning, enumeration, exploitation, post-exploitation, reporting) are the other things you need down. You don't need to compute CVSS scores — just know the ranges and what they mean.
Domain 3: Security Architecture (18%)
Network segmentation, firewalls, VPNs, cloud, virtualization, containers, embedded/IoT, resilience, disaster recovery, physical security. Broad surface area. The version bump to SY0-701 moved cloud much more firmly into the center of this domain, which matters: if you're studying from an older book or video course, you may be missing cloud content that now shows up on the exam.
The single most-tested concept here is the shared responsibility model. Know who handles what at each layer:
| Model | Provider handles | You handle |
|---|---|---|
| IaaS | Physical infra, hypervisor, network | OS, middleware, runtime, apps, data, IAM |
| PaaS | Everything up through runtime | Apps, data, access controls |
| SaaS | Nearly everything | Data classification, user access, identity |
Network security on Security+: firewalls, segmentation, zero trust
Network security questions ask which control stops a specific attack in a specific scenario, and firewalls take a disproportionate share:
| Type | Operates at | What makes it different |
|---|---|---|
| Packet-filtering | Layer 3/4 | Stateless, headers only. Fast, dumb, still useful at the edge. |
| Stateful | Layer 3/4 + state | Tracks conversations; inbound traffic must match an established flow. |
| NGFW | Up to Layer 7 | Application-aware; blocks specific actions inside allowed protocols. |
| WAF | Layer 7, HTTP/S only | Sits in front of web apps; catches SQL injection, XSS, command injection. |
A stateful firewall sees HTTPS to port 443; an NGFW sees that the HTTPS is a file upload to a personal cloud drive and can block that alone. A WAF is not a "better firewall" — it only understands web traffic and won't help against a volumetric DDoS. If the question mentions SQL injection or XSS, the answer is almost always WAF.
Segmentation is the "don't put everything on one flat network" principle: VLANs for logical separation, a DMZ so a compromised public web server has no direct path to internal file shares, air gaps for industrial control and classified environments. Zero trust goes further — nothing is trusted, even inside the perimeter, and every request is verified continuously through identity-based access, microsegmentation, and device posture checks. When a scenario asks what stops an attacker on a compromised laptop from pivoting to the database server, "firewall rules based on source IP" is the trap; microsegmentation plus device compliance checks is the answer. Defense in depth is tested the same way: a WAF, a perimeter firewall, encryption, and MFA is depth, while five firewalls with identical rulesets is just redundancy.
For VPNs, know that IPSec tunnel mode encrypts the whole packet, header included (site-to-site), while transport mode encrypts only the payload (host-to-host). And know the insecure-protocol replacements — Telnet → SSH, HTTP → HTTPS, FTP → SFTP/FTPS, SNMP v1/v2c → v3 — as a pattern: the insecure versions send credentials in cleartext.
Resilience and everything else
The rest of Domain 3 is memorization-heavy but not conceptually hard. RAID levels (0 stripes, 1 mirrors, 5 stripes with parity, 10 is striped mirrors), backup types (full vs. incremental vs. differential), and recovery sites (hot/warm/cold) are all comparison questions. A one-page cheat sheet you build yourself — not one you download — will stick better than anything a study guide gives you.
Embedded systems, IoT, and SCADA/ICS are on the exam but usually get less than a handful of questions. Know them, but don't over-study them.
Domain 4: Security Operations (28%)
This is the one. More than a quarter of the exam, the most conceptually demanding content, and the section where people who pass solidly pull ahead of people who barely pass.
Security+ cryptography, explained
Cryptography is the topic most candidates say they're worried about — usually not because it's hard, but because the wall of acronyms makes it sound harder than it is. The exam doesn't care whether you can compute a hash by hand. It cares whether you know when to use which tool.
Start with the mental model: everything in cryptography does one of three jobs. Confidentiality (keep data secret) is encryption. Integrity (detect changes) is hashing. Authentication (prove who sent it, and that they can't deny it) is digital signatures. When you see an unfamiliar term, ask which job it serves.
- Symmetric encryption uses one shared key. It's fast, so it handles bulk data: disks, VPN traffic, backups. AES is the modern standard and the answer whenever a question wants a current symmetric algorithm; DES is broken and 3DES is deprecated. Its weakness is key distribution — how do two parties who've never met agree on a key?
- Asymmetric encryption solves that with a key pair: publish the public key, guard the private key. It's slow, so it's used for key exchange and signatures, not bulk data. RSA needs 2048 bits minimum; ECC gives equivalent strength at 256 bits. Diffie-Hellman is key exchange, not encryption.
- Hybrid encryption is how TLS, VPNs, and SSH actually work: an asymmetric handshake sets up a symmetric session key, then the fast cipher carries the conversation. Bulk of the session? Symmetric. Establishing the channel? Asymmetric. Why not asymmetric throughout? Too slow.
- Hashing is one-way and deterministic. SHA-256 is the workhorse; SHA-1 is deprecated and MD5 is broken — collisions can be generated on a laptop. Salting defeats rainbow tables; key stretching (bcrypt, Argon2, PBKDF2) defeats offline brute force. A hash is not encryption — you can't "decrypt" it.
- HMAC mixes a shared secret into a hash: integrity plus proof the sender knew the secret. Because the secret is shared, it does not give non-repudiation.
- Digital signatures hash the message, then encrypt the hash with the sender's private key; the receiver verifies with the public key. Sign private, verify public — the reverse of encryption. A signature provides authentication, integrity, and non-repudiation. It does not provide confidentiality; a signed message can still be read by anyone.
The shortcut that answers a surprising number of scenarios: the moment you see "non-repudiation," every symmetric-only option is dead — only one party holds a private key. Key-length rule of thumb: AES-128, RSA-2048, SHA-256, ECC-256 or higher; anything smaller in an answer choice is probably wrong.
People learn this in week 3, feel fine, and then can't recall the difference between ECDSA and ECDH two months later. Schedule a second crypto pass late in your prep, and do scenarios rather than flashcards — "which algorithm family encrypts nightly database backups?" builds an instinct that "AES is a block cipher" never will.
PKI and digital certificates
PKI answers one question: when your browser receives a public key from a website, how does it know that key belongs to that site and not to someone in the middle? A third party your browser already trusts — the Certificate Authority — vouches for it. The certificate is the vouching. Everything else is plumbing.
Roots rarely sign end-entity certificates directly, so the chain is Root CA → Intermediate CA → the site's certificate, and the browser walks back up it verifying each signature until it hits a root in its trust store. One detail that catches people: the root's certificate is self-signed, because there's no higher authority. That's the design, not a flaw.
X.509 is the format: subject, issuer, public key, serial number, validity period, extensions (where Subject Alternative Name lives), and the signature — which is the CA signing the certificate with its private key. On connection the browser builds the chain, verifies every signature, checks the validity window, matches the hostname against the subject or a SAN entry, and checks revocation. Any failure breaks the connection, and the exam loves to give you the symptom and ask for the cause.
Certificate types: DV proves domain control and is what most of the web uses; OV adds business verification; EV requires the most vetting. DV when you just need encryption, OV/EV when the organization's identity matters to the user. Wildcards cover one level of subdomain — *.example.com matches mail.example.com but not mail.eu.example.com. Self-signed certs have no chain and no trust outside whoever you tell to trust them — fine for labs, a giant warning in production.
Revocation is where the exam concentrates. A CRL is a signed list of revoked serials the browser downloads — large, cached, not real-time, but right for isolated networks with no internet. OCSP asks the CA's responder about one serial in real time, at the cost of leaking your browsing to the CA. OCSP stapling has the server fetch the response and attach it to the TLS handshake — no extra client call, no privacy leak — and is usually the answer for "modern best practice" framing.
Two things to learn once and move on: file formats (PEM is Base64 text, DER is binary, PKCS#12/PFX bundles cert plus private key plus chain, PKCS#7/P7B has no private key), and certificate pinning — accepting only a specific cert or key for a host — as the defense against a compromised CA issuing a fraudulent certificate.
Identity and Access Management
Authentication methods (something you know/have/are/do), MFA, and the protocols (Kerberos, SAML, OAuth, OIDC). The exam cares that you can distinguish them:
- SAML is enterprise SSO. XML-based. Common in corporate environments.
- OAuth is authorization ("let this app access your Google Calendar"), not authentication per se.
- OIDC sits on top of OAuth and adds authentication.
- Kerberos is internal to a network domain, ticket-based, avoids sending passwords over the wire.
Access control models — DAC, MAC, RBAC, ABAC — show up constantly. Know the decision tree: role-based when access depends on job function, attribute-based when it depends on context (time of day, device posture, location), MAC when there are formal security labels, DAC when the resource owner decides.
Incident response
Six phases, in order: preparation, detection and analysis, containment, eradication, recovery, post-incident activity. The exam will give you a scenario and ask which phase you're in. Containment and eradication trip people up — containment is stopping the bleeding (isolate the host, revoke the credential), eradication is removing the threat completely (rebuild the system, patch the vuln, close the attack vector). You contain first, then eradicate.
Monitoring and network defense
SIEM, EDR/XDR, DLP, NAC, IDS/IPS. SOAR is orchestration on top — playbooks that automate common responses.
If you memorize one distinction, make it IDS vs. IPS. An IDS sits off to the side on a SPAN port or tap; it watches, logs, and alerts, and never drops a packet. An IPS sits inline and blocks. The trap question describes an IDS detecting an attack that then succeeded and asks what went wrong — the IDS did its job; you needed an IPS. Both use signature-based detection (accurate for known threats, blind to new ones) and anomaly-based detection (catches unknowns, generates false positives).
NAC (802.1X) authenticates devices at the port level, so an unauthorized laptop plugged into a conference-room jack lands in a quarantine VLAN. For email authentication: SPF lists which IPs may send mail for your domain, DKIM signs outgoing mail so recipients can verify it arrived unmodified, and DMARC sets the policy for failures (none, quarantine, reject) and reports who's spoofing you.
Domain 4 is the one where practice-question volume matters. Do hundreds of Domain 4 questions, cryptography and PKI especially — reading about a broken trust chain doesn't train the "spot what's wrong" instinct the scenarios test.
Domain 5: Security Program Management and Oversight (20%)
Candidates underrate this domain because it's "not technical." That's exactly why it's a trap. It's worth 20% of the exam — basically tied with Domain 3 — and the questions test judgment, not recall. You can't flashcard your way through judgment.
Content is governance (policies, standards, procedures, guidelines), risk management (identification, assessment, treatment), compliance frameworks, third-party risk, data classification, and audits.
Risk treatment is high-yield. Four options: mitigate (add a control), accept (the cost of mitigation exceeds the risk), transfer (insurance, outsourcing), avoid (stop doing the risky activity). Scenario questions will describe a situation and ask which treatment fits. The right answer is often counterintuitive if you think technically — sometimes accept is correct, because spending $500K to prevent a $10K risk is bad governance.
These questions almost always hinge on one or two hard constraints buried in the scenario. A critical payment-system vulnerability at a firm that must process transactions continuously for regulatory reasons: the constraint kills avoidance, insurance doesn't prevent fraud so transfer alone fails, acceptance is negligent — leaving mitigation with compensating controls until the next maintenance window. Read for constraints, not keywords.
Compliance frameworks to know: GDPR (EU, personal data, 72-hour breach notification), HIPAA (US healthcare, PHI), PCI DSS (card data, 12 requirements, merchants and processors), SOX (public company financial controls), and ISO/IEC 27001 (international ISMS standard). You don't need to recite every clause — you need to know what each one covers and when it applies.
Data classification (public, internal, confidential, restricted) drives everything from encryption requirements to retention to who can see what. Scenarios will test whether you assign the right classification to the right data.
The study approach here is different from the technical domains: fewer flashcards, more scenario questions. Read explanations for every question you miss. The explanations are where the governance reasoning lives.
How to allocate your study time
Proportional allocation (12% of your time on Domain 1, 22% on Domain 2, etc.) is the wrong mental model. Use effort-per-point instead, where you weight by weight AND by difficulty:
- Domain 1: short, maybe 1–2 weeks. Small domain, conceptually easy, but don't skip.
- Domain 5: 2–3 weeks. Not technical but requires scenario practice.
- Domain 2: 3 weeks. Material is fun and you'll move through it quickly. Resist spending more.
- Domain 3: 3 weeks. Extra cloud focus if your materials are older.
- Domain 4: 5–7 weeks, spread out, with a second pass on cryptography late in the prep cycle.
That's roughly 15–20 weeks of real study, plus a final 1–2 weeks of full-length practice exams and targeted review of whatever the practice tests show you're weakest on. If you already work in security, compress it. If you're coming in cold, extend it.
Another pattern worth watching: people who delay taking their first full-length practice exam until they "feel ready" almost always delay the real exam too. Take a full-length practice test early — like week 3 — even if you bomb it. The purpose isn't to get a good score. The purpose is to see the shape of the thing you're preparing for.
Getting Security+ practice questions explained — properly
Most people grind questions, check their score, and confuse "got it right" with "understood it." That's usually why candidates plateau around 72%. How you review Security+ practice questions matters more than how many you do. When you miss one, work through three things: what decision (not topic) was the exam testing; which distractor did you pick and why did it feel right; and what detail in the scenario would have pointed you to the right answer if you'd read more carefully.
Forty questions in an hour with that analysis beats a hundred with none. Review some of the ones you got right, too — sometimes you picked the correct answer for the wrong reason, which is one reason practice test scores and real exam scores diverge.
Where to go from here
If you're at the start of your prep, the first useful thing you can do isn't more reading — it's finding out where your baseline is across these five domains. Most people are wrong about where they're weak. They assume it's cryptography because that's the intimidating topic, and then they sit down for a practice test and their lowest domain turns out to be Domain 5.
LearnZapp's free Security+ diagnostic covers all five SY0-701 domains in about 15 minutes and gives you a per-domain breakdown. No signup. Use it to pick where this guide's study-time recommendations apply to you.
Take a free Security+ diagnostic test
For a week-by-week version of the allocation above, see our Security+ SY0-701 study plan. If you're still deciding on a realistic timeline, how long it takes to study for Security+ breaks it down by experience level.