Security+ study guide · 2026

The 5 Security+ domains, explained

5 domains and 28 official domains. Security Operations carries the most weight at 28%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
Max 90
Time
90 minutes
Passing score
750 / 900
Outline
SY0-701, objectives version 5.0, launched 7 November 2023 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 12%
  2. 2 22%
  3. 3 18%
  4. 4 28%
  5. 5 20%
  1. 1 General Security Concepts
  2. 2 Threats, Vulnerabilities, and Mitigations
  3. 3 Security Architecture
  4. 4 Security Operations
  5. 5 Security Program Management and Oversight

All 5 domains

28 official domains 100–140 hrs suggested study

  1. Domain 01 12%

    General Security Concepts

    This domain lays the conceptual foundation for the whole exam. It covers the types of security controls, fundamental security concepts including the CIA triad and zero trust, the importance of change management, and the appropriate use of cryptographic solutions.

    Inside this domain

    • Compare and contrast various types of security controls
    • Summarize fundamental security concepts
    • Explain the importance of change management processes and the impact to security
    • Explain the importance of using appropriate cryptographic solutions

    Watch for Category is function

    Domains
    4
    Questions est.
    ~11
    Study time est.
    10–15 hrs
  2. Domain 02 22%

    Threats, Vulnerabilities, and Mitigations

    This is the second-heaviest domain, the know-your-enemy block. It covers threat actors and motivations, threat vectors and attack surfaces, types of vulnerabilities, analyzing indicators of malicious activity, and mitigation techniques.

    Inside this domain

    • Compare and contrast common threat actors and motivations
    • Explain common threat vectors and attack surfaces
    • Explain various types of vulnerabilities
    • Analyze indicators of malicious activity
    • and 1 more domains

    Watch for Phishing is spear phishing

    Domains
    5
    Questions est.
    ~20
    Study time est.
    20–30 hrs
  3. Domain 03 18%

    Security Architecture

    This domain covers designing secure systems. It covers the security implications of architecture models, applying security principles to enterprise infrastructure, protecting data, and the importance of resilience and recovery.

    Inside this domain

    • Compare and contrast security implications of different architecture models
    • Apply security principles to secure enterprise infrastructure
    • Compare and contrast concepts and strategies to protect data
    • Explain the importance of resilience and recovery in security architecture

    Watch for Encrypt data for analysis

    Domains
    4
    Questions est.
    ~16
    Study time est.
    20–25 hrs
  4. Domain 04 28%

    Security Operations

    This is the exam's heaviest domain. It covers hardening resources, asset management, vulnerability management, security monitoring and alerting, identity and access management, automation, incident response, and using data sources in investigations.

    Inside this domain

    • Apply common security techniques to computing resources
    • Explain the security implications of proper hardware, software, and data asset management
    • Explain various activities associated with vulnerability management
    • Explain security alerting and monitoring concepts and tools
    • and 5 more domains

    Watch for Recover before eradicate

    Domains
    9
    Questions est.
    ~25
    Study time est.
    30–40 hrs
  5. Domain 05 20%

    Security Program Management and Oversight

    This domain covers governing and managing a security program. It covers security governance, the risk management process, third-party risk, compliance, audits and assessments, and security awareness practices.

    Inside this domain

    • Summarize elements of effective security governance
    • Explain elements of the risk management process
    • Explain the processes associated with third-party risk assessment and management
    • Summarize elements of effective security compliance
    • and 2 more domains

    Watch for Accept a severe risk

    Domains
    6
    Questions est.
    ~18
    Study time est.
    20–30 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 100–140 hrs of study.

  1. 4 Security Operations 28% · 30–40 hrs
  2. 2 Threats, Vulnerabilities, and Mitigations 22% · 20–30 hrs
  3. 5 Security Program Management and Oversight 20% · 20–30 hrs
  4. 3 Security Architecture 18% · 20–25 hrs
  5. 1 General Security Concepts 12% · 10–15 hrs

Try one

Practice questionDomain 4: Security Operations

During an incident, the response team has contained the affected systems and confirmed the malware and the attacker's tools are still present on them. According to the incident response process, what should happen BEFORE the systems are restored to production?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Category is function

    Clue The question asks what the control does versus where it lives.

  • Domain 2

    Phishing is spear phishing

    Clue The attack targets a specific individual with personalized detail.

  • Domain 3

    Encrypt data for analysis

    Clue Data must stay usable while hiding real sensitive values.

  • Domain 4

    Recover before eradicate

    Clue The attacker's tools are still present on the systems.

  • Domain 5

    Accept a severe risk

    Clue The potential loss is large and insurance is affordable.

Other Networking certifications

Study guides for exams that overlap with Security+.

Practise what you read

Security+ domains: common questions

How many domains are in the Security+ exam?

Security+ has 5 domains with 28 official domains between them: General Security Concepts, Threats, Vulnerabilities, and Mitigations, Security Architecture, Security Operations and Security Program Management and Oversight.

Which Security+ domain carries the most weight?

Security Operations is the heaviest at 28%, followed by Threats, Vulnerabilities, and Mitigations (22%). The lightest is General Security Concepts (12%). Weights come from CompTIA's official outline.

What is the Security+ exam format?

Questions: Max 90. Time allowed: 90 minutes. Passing score: 750 / 900.

How long should I study for Security+?

Our planning estimate is 100–140 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Security Operations, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SY0-701, objectives version 5.0, launched 7 November 2023 (current), published by CompTIA. It was last reviewed in October 2026.

Domain names, weights and domains come from CompTIA's official outline (SY0-701, objectives version 5.0, launched 7 November 2023 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.