CompTIA Security+ (SY0-701): The Complete 2026 Guide

CompTIA Security+ is a vendor-neutral certification that proves you know core security concepts and can apply them on the job: spotting attacks, hardening systems, running incident response and understanding governance and risk. It isn't tied to one product, which is exactly why employers like it.

CompTIA pitches it at people working toward roles like security analyst, security engineer and systems administrator. It's also a staple for defense-sector jobs, because it maps to many U.S. Department of Defense cyber work roles (more on that below).

No formal prerequisites exist. CompTIA recommends Network+ and about two years of experience in a security or systems administration role. Plenty of people pass with less, but if subnets, ports and DNS still feel shaky, fix that first. Security+ assumes you already speak networking.

Ninety questions in 90 minutes works out to about a minute per question. That's not much when a performance-based item can eat five or ten minutes. Pacing is a real skill on this exam, and it's why our practice test runs at the same one-minute-per-question pace.

The five domains and their weights

Notice where the weight sits. Security Operations alone is 28%, and together with Threats it's half the exam. If your study time is limited, that's where it goes.

PBQs are small simulations. Instead of picking A–D, you might complete a firewall rule table, match attacks to mitigations, drag controls into categories or read a log excerpt and draw conclusions. They reward people who've actually configured things, not just memorized acronyms.

Three rules for handling them:

• Don't let one PBQ wreck your clock. If one stalls you, flag it, move on and come back once the multiple-choice questions are banked.
• Read the constraints twice. PBQs hide the answer in the scenario: “only the management subnet,” “standard port,” “everything else blocked.”
• Answer every part. A partly finished simulation is still better than a blank one.

Our free practice exam opens with four PBQ-style items: an attack-to-mitigation matrix, a firewall rule table, a log-analysis question and a multi-select grid. They're a good dry run for the format.

Your result is a scaled score from 100 to 900, and 750 passes. CompTIA doesn't publish how many questions you need to get right to reach 750, and anyone who quotes you a precise percentage is guessing. Scaling accounts for differences between exam forms, so the same raw score won't always map to the same scaled score.

What that means for you: don't aim to “just pass” your practice tests. Aim for comfortable, consistent scores across every domain, because a blind spot in a 28% domain can sink an otherwise good attempt.

You buy an exam voucher, then schedule the exam with CompTIA's testing partner, Pearson VUE, at a test center or online with a remote proctor. Voucher prices vary by country and change over time, so check the current price in CompTIA's store before you budget. Look for official bundles that pair a voucher with a retake or training if you want a safety net, and be wary of gray-market vouchers from unofficial sellers.

Employers, the military and training programs often pay for Security+. Ask before you buy.

Security+ is one of the most common ways people meet U.S. Department of Defense cyber workforce qualification requirements. The DoD's 8140 framework replaced the older 8570 baseline. CompTIA lists DoD work roles that Security+ supports, including cyber defense analyst, incident responder, vulnerability analyst, security control assessor, system administrator, network specialist and information security manager.

The exact requirement depends on your work role and proficiency level, so confirm it with your security manager or contracting officer. Don't assume one cert covers everything.

Security+ runs on a three-year continuing education cycle. CompTIA offers several ways to renew:

• Complete a CompTIA CertMaster CE course for Security+, which CompTIA calls the fastest route.
• Pass the latest version of the exam. Once V8 is out, passing it renews you.
• Earn a qualifying higher-level CompTIA certification.
• Earn and submit CEUs from approved activities and pay the CE fee. CompTIA lists the Security+ CE fee at $150 for the three-year period.

Your cycle runs from your certification date, not the calendar year. Put the expiration date on your calendar the day you pass.

Security+ questions are rarely about obscure trivia. More often, two answers are both real terms, and only one fits the scenario. These pairs come up constantly:

When two answers both look right, go back to the stem and find the constraint: “must remain usable,” “without changing code,” “future subdomains.” The constraint is almost always what separates them.

• Bank the multiple choice first if the PBQs stall you. Flag the simulation, answer the quick questions, then return with the time you've saved.
• Watch the clock at the halfway mark. At about one minute per question, you want roughly half the exam done by the 45-minute mark.
• Read for the qualifier. “BEST,” “FIRST” and “MOST likely” mean several answers are true and one fits better. Pick the one that directly solves the stated problem.
• Don't leave blanks. An unanswered question can't earn credit.
• Online testing? Run the system check well before exam day and clear your desk. Proctored online exams are strict about your environment.

CompTIA says the next version, Security+ V8, is expected to launch on or around November 17, 2026, and it describes V8 as offering “expanded coverage of areas such as AI-related risks, security operations, and modern environments.” V8 is widely expected to carry the exam code SY0-801.

SY0-701 doesn't disappear on launch day. The English version retires June 11, 2027, and the Japanese, Portuguese, Spanish and Thai versions retire August 13, 2027. That's a roughly seven-month overlap in English when you can choose either exam.

If you already have Network+-level knowledge, plan on roughly 6–10 weeks of steady study. If networking basics are new, add a month or two, and consider Network+ material first. Here's a plan that works:

1. Week 1: baseline. Download the official SY0-701 exam objectives and take a timed practice test cold. Your domain breakdown tells you where the hours go.
2. Weeks 2–6: cover the objectives. Work through one primary study guide (see our book picks) domain by domain, and tick off each objective bullet as you go. Weight your time toward Security Operations and Threats.
3. Throughout: build, don't just read. Set up a firewall rule in a home lab, read real auth logs, generate a certificate signing request. PBQs punish people who've never touched the stuff.
4. Weeks 7–8: timed practice. Take full practice exams at one minute per question, review every miss, and write down why the tempting wrong answer was wrong.
5. Final week: fix weak spots. Drill your two weakest domains, review acronyms, and stop cramming the night before.

• CompTIA Security+ V7 (SY0-701) page: official exam details, and where to get the exam objectives. Treat the objectives as your master checklist.
• CompTIA Security+ overview: the current V7/V8 status straight from the source.
• CompTIA continuing education: renewal paths once you're certified.

Then put it together: our free Security+ practice test gives you 45 original questions at real pace with PBQ-style items, and our best Security+ prep books page compares the major study guides.