Return to the Ultimate Security+ Certification Guide for the complete study, career, resume, and progression roadmap.
A Security+ study plan works best when it starts with the current official exam rather than an old course title, social post, or remembered version. As of July 29, 2026, CompTIA lists Security+ V7, exam series SY0-701, launched November 7, 2023. Its official page is the source of truth for the active exam and objectives, especially because retirement timing, delivery availability, policies, and pricing can change.
This guide explains how to organize preparation and registration without treating the credential as a shortcut to a job. Use it to build security fluency, then connect only truthful experience, projects, and learning evidence to the roles you want.
Current Security+ exam at a glance
According to CompTIA's official Security+ certification page, the current V7 exam is SY0-701. It has a maximum of 90 questions, a mix of multiple-choice and performance-based questions, 90 minutes of exam time, and a listed passing score of 750 on a 100–900 scale. Those details are not a readiness guarantee: use the current official objectives to determine what you still need to learn.
CompTIA describes recommended—not mandatory—preparation as Network+ knowledge and about two years in a security or systems-administrator role. Treat that as context for the depth of applied reasoning expected, not as an eligibility rule or a claim that experience can be replaced by a credential.
Official exam domains and weighting
The current CompTIA Security+ V7 objectives summary organizes SY0-701 into five domains:
| Official domain | Weight | What to be able to explain and apply |
|---|---|---|
| General security concepts | 12% | Controls, foundational security concepts, change management, and cryptographic solutions. |
| Threats, vulnerabilities, and mitigations | 22% | Threat actors, attack surfaces, vulnerabilities, malicious activity, and defensible mitigation choices. |
| Security architecture | 18% | Secure architectures, enterprise infrastructure, data protection, and resilience or recovery decisions. |
| Security operations | 28% | Secure computing resources, vulnerability management, monitoring, identity and access, automation, incident response, and investigation data. |
| Security program management and oversight | 20% | Governance, risk, third-party risk, compliance, assessments, and security awareness. |
Weighting helps you budget review time; it does not tell you which individual objectives you can skip. Download and work from the current official objective document before you schedule.
A domain-by-domain preparation approach
General security concepts (12%)
Build the vocabulary that supports every later decision: what a control is for, how confidentiality, integrity, and availability can conflict or reinforce one another, why change documentation matters, and when cryptographic tools solve a defined problem. Do not only memorize terms. Practice explaining the control objective, the constraint, and the tradeoff.
Threats, vulnerabilities, and mitigations (22%)
Learn to distinguish a threat actor from a vector, an exposure from a vulnerability, and a mitigation from a generic tool list. When you review a topic, ask what the attacker is trying to achieve, what weakness is in play, and which control would reduce risk without creating a larger operational problem.
Security architecture (18%)
Focus on how secure design changes across on-premises, cloud, virtualized, IoT, industrial, and infrastructure-as-code environments. Connect architecture choices to segmentation, secure access, data handling, availability, recovery, backups, and continuity. A useful lab or work note describes the decision and why it fits the environment; it should not claim production experience you do not have.
Security operations (28%)
This is the largest domain, so plan repeated review rather than a single pass. Organize your tracker around hardening, asset and vulnerability management, monitoring, identity and access, security tooling, automation, incident response, and relevant data sources. Build short explanations of how you would prioritize, validate, document, and communicate an operational decision.
Security program management and oversight (20%)
Study how governance, policy, risk, vendor relationships, compliance, audits, assessments, and awareness fit together. The goal is not to recite a framework name. It is to explain how an organization identifies risk, assigns responsibility, documents decisions, monitors controls, and responds when expectations are not met.
Register only after verifying the live details
Start from CompTIA's Security+ page and sign in to the appropriate CompTIA testing flow to buy or apply a valid voucher and choose an appointment. CompTIA directs candidates to schedule through its account and Pearson VUE flow; availability, locations, prices, vouchers, accommodations, and supported languages can vary by region and change over time.
Before you pay or schedule, confirm the exam code is SY0-701, read the applicable candidate agreement and testing policies, and check the appointment time zone. Keep your registration name identical to the name on your acceptable IDs.
Testing options: remote or test center
CompTIA offers Pearson VUE delivery options that can include a test center and online OnVUE testing where available. Choose the setting that best supports a controlled, policy-compliant session—not simply the one that seems most convenient.
Remote testing can work when you have a private room, stable connection, compatible computer, clear workspace, and can complete the required system test on the same computer and network. CompTIA says the online setup requires you to clear books and writing materials from arm's reach, remove extra monitors and computers, clear wall writing, keep your ID available, and place your phone out of reach after check-in. Review the current CompTIA online testing guidance and Pearson VUE policies before committing.
Test-center testing can be a better choice if your home environment, network, hardware, accessibility needs, or household conditions make remote testing uncertain. Arrive prepared for identity verification and center security procedures; the center may photograph you and capture your signature. Confirm the specific location's instructions and your travel plan in advance.
Identification requirements
CompTIA's current identification guidance says candidates must present two original, valid, unexpired IDs. The primary ID must be government-issued and include your name, a recent recognizable photo, and your signature. The secondary ID must include at least your name and signature, or your name and recent recognizable photo. Your first and last name must exactly match your registration.
IDs generally must be issued by the country where you test; CompTIA gives an international travel passport plus secondary ID as the path when you do not have a qualifying local primary ID. For online testing, certain secure IDs cannot be captured and are not accepted—CompTIA specifically says U.S. military-issued IDs, including a CAC, cannot be used for OnVUE verification. Request any exception through Pearson VUE well before the appointment; CompTIA says preapproval is required at least three business days ahead.
Retake policy and voucher planning
Under CompTIA's certification retake policy, there is no required wait between a first failed attempt and a second attempt. Before a third attempt or any later attempt, you must wait at least 14 calendar days from the last attempt. Once you pass and achieve the certification, you cannot retake the same exam code without CompTIA's prior consent. Each attempt requires payment; CompTIA does not provide free retests or retake discounts as a general policy.
Treat a voucher as an appointment-specific commitment, not a study deadline. Confirm its terms, expiration, and rescheduling rules before purchase. If your readiness evidence is thin, give yourself time to close objective-level gaps instead of relying on a last-minute retake plan.
What to expect on exam day
Re-read the current candidate agreement and appointment instructions before test day. For remote delivery, complete the system test ahead of time on the same computer and network and leave time for check-in. For a center appointment, arrive with the required IDs and follow the location's check-in instructions. In either setting, protect the session: follow proctor directions, use only permitted materials, and do not discuss or seek recalled exam content.
The exam can include multiple-choice and performance-based questions. Manage the 90-minute window deliberately: read what is being asked, identify the security objective and constraints, make the strongest supported choice, and flag only when a review is likely to help. The goal is applied reasoning against the official objectives, not speed-driven memorization.
Common preparation challenges
Studying an outdated version. Check every course, book, and practice resource against SY0-701 and the current official objectives. Older explanations can still help, but they should not be your map.
Treating all domains equally. Use the official weights to set review time, while still tracking every objective so a small domain does not become a blind spot.
Collecting resources instead of learning. Choose a focused stack: the official objectives, one primary explanation source, legitimate practice with explanations, and a review log.
Chasing practice scores. Record why an answer was wrong or uncertain, return to the underlying objective, and explain the corrected reasoning in your own words. Do not use leaked questions or “dumps”; they create integrity risk and weak understanding.
Skipping applied practice. Use safe labs, diagrams, change notes, or scenario walkthroughs to make abstract concepts concrete. Document learning honestly without representing simulated work as production responsibility.
Separating study from career positioning. Keep a short evidence log during preparation. It can later help you describe genuine learning, relevant IT responsibilities, or projects accurately in a resume and interview.
Use preparation to strengthen career positioning
CareerOS helps you connect certification preparation to the roles you want without overstating what the credential means. Use the free ATS scan to compare your truthful experience, projects, and security language with a real job description. Then tailor your resume around evidence—what you hardened, investigated, documented, analyzed, or learned—not a generic list of exam terms.
Next recommended article
After you have mapped the objectives and chosen a testing option, move to the Security+ Study Plan to turn that coverage into a realistic weekly plan.
Frequently asked questions
1. What is the current Security+ exam code?
As of July 29, 2026, CompTIA lists Security+ V7 as exam series SY0-701. Verify the live official Security+ page before buying a voucher or study material.
2. How many questions are on Security+ SY0-701?
CompTIA lists a maximum of 90 questions, combining multiple-choice and performance-based questions.
3. How long is the Security+ exam?
CompTIA lists a 90-minute exam duration for SY0-701.
4. What is the Security+ passing score?
CompTIA lists a passing score of 750 on a 100–900 scale for SY0-701. That score does not identify which objectives need work, so use an objective tracker and legitimate practice feedback as well.
5. What are the five SY0-701 domains?
They are General Security Concepts; Threats, Vulnerabilities, and Mitigations; Security Architecture; Security Operations; and Security Program Management and Oversight. The official weights are 12%, 22%, 18%, 28%, and 20%, respectively.
6. Can I take Security+ online?
Online delivery may be available through Pearson OnVUE in eligible locations if you meet the current technical, workspace, identity, and policy requirements. Run the required system test before scheduling and choose a test center if your environment is not dependable.
7. What identification do I need for Security+?
CompTIA says two original, valid, unexpired IDs are required, with a qualifying government-issued primary ID. The registered first and last name must exactly match the IDs. Review the current policy because online and in-person rules differ.
8. Can I use a military ID for remote Security+ testing?
No. CompTIA states that U.S. military-issued IDs, including a CAC, cannot be used for OnVUE identity verification. Check the current online ID list and choose a test center if you do not have acceptable remote-testing ID.
9. How soon can I retake Security+ after failing?
CompTIA requires no wait between the first failed attempt and the second. A third or later attempt requires at least a 14-calendar-day wait from the prior attempt. Verify current policy before scheduling.
10. What should I do after I finish this exam guide?
Turn the objectives into weekly work with the Security+ Study Plan, select aligned materials in Best Security+ Books and Study Resources, and use Security+ Practice-Test Strategy to diagnose—not memorize—your gaps.
Series navigation
- Ultimate Security+ Certification Guide
- Security+ Study Plan
- Best Security+ Books and Study Resources
- Security+ Practice-Test Strategy
Last reviewed July 29, 2026. Recheck the active version, objectives, delivery availability, identification rules, appointment instructions, voucher terms, and policies directly with CompTIA and Pearson VUE before you register or test.