The CompTIA Security+ SY0-701 exam is organized into five domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%). Those percentages, which match the published domain weights, tell you where the exam points come from and where your study hours should go. This guide walks through each domain, what it actually asks you to do, and how to turn the weights into a realistic plan.
TL;DR
- SY0-701 has five domains. Security Operations is the largest at 28%, and General Security Concepts is the smallest at 12%.
- Domains 2 and 4 together account for half of the exam, so threats, vulnerabilities, monitoring, and incident response deserve the most time.
- The domains mirror real job functions, not trivia. Expect scenario questions that ask what you would do, not only what a term means.
- Study by weight, then adjust for your own background: network admins can usually move faster through Domain 3, while career changers need more time on Domain 1.
- Hands-on lab practice is the most reliable way to make the objectives stick.
Table of Contents
- Why the domains matter more than the objective list
- The five domains at a glance
- Domain 1: General Security Concepts (12%)
- Domain 2: Threats, Vulnerabilities, and Mitigations (22%)
- Domain 3: Security Architecture (18%)
- Domain 4: Security Operations (28%)
- Domain 5: Security Program Management and Oversight (20%)
- Turning the weights into a study plan
- What to know about the exam itself
- Our perspective: learn the domains as a job, not a checklist
- Prepare for SY0-701 with Total Cyber Academy
- FAQ
- Sources
Why the domains matter more than the objective list
CompTIA publishes a detailed objectives document for every exam version. It is long, and many first-time candidates read it as a vocabulary list. A better approach is to treat each domain as a job function and ask what a junior security professional would be expected to do in that area.
There is good reason to read it that way. The NIST Cybersecurity Framework organizes risk management into five functions: Identify, Protect, Detect, Respond, and Recover, and NIST guidance on data integrity builds its recommendations around them. The Security+ domains are not a copy of that framework, but you will see the same logic: understand the environment, defend it, watch it, and recover when something goes wrong. Keeping that mental model makes the exam content easier to organize.
The five domains at a glance
| Domain | Name | Exam weight | Core question it answers |
|---|---|---|---|
| 1 | General Security Concepts | 12% | What are the building blocks of security? |
| 2 | Threats, Vulnerabilities, and Mitigations | 22% | What can go wrong, and how do we reduce the risk? |
| 3 | Security Architecture | 18% | How do we design systems that are hard to attack? |
| 4 | Security Operations | 28% | How do we run security day to day? |
| 5 | Security Program Management and Oversight | 20% | How do we govern risk, compliance, and people? |
The weights above are drawn from a SY0-701 reference sheet. Confirm them against the current objectives document on CompTIA’s own site before you commit to a schedule, because CompTIA can revise exam details.
Domain 1: General Security Concepts (12%)
This is the foundation, and it is the smallest domain. It still matters, because every other domain assumes you know this vocabulary.
Expect to work with:
- Security controls. Technical, managerial, operational, and physical controls, and whether each one is preventive, detective, corrective, deterrent, compensating, or directive.
- Core principles. The CIA triad, authentication, authorization, and accounting, non-repudiation, and zero trust concepts.
- Change management. Why approvals, testing, and rollback plans are security topics and not only IT process.
- Cryptography basics. Symmetric versus asymmetric encryption, hashing, digital signatures, certificates, and public key infrastructure.
The CIA triad is the anchor. According to NIST, confidentiality means preserving authorized restrictions on access and disclosure, integrity means guarding against improper modification or destruction, and availability means ensuring timely and reliable access. When a scenario question describes an incident, the quickest first step is often to ask which of the three was affected.
How to study it: do not memorize in isolation. Pair each concept with an example. A hash proves integrity, a certificate supports authentication, and a backup supports availability. If you can say that sentence for each term, you are ready.
Domain 2: Threats, Vulnerabilities, and Mitigations (22%)
This domain covers the adversary side. You need to recognize an attack from a short description and pick the right defense.
Key areas include:
- Threat actors and motivations. Nation-state groups, organized crime, insiders, hacktivists, and unskilled attackers, and what each typically wants.
- Attack surfaces and vectors. Email, removable media, unsecured wireless, supply chain, and human-based vectors such as phishing and pretexting.
- Malware and application attacks. Ransomware, trojans, injection, buffer overflow, and privilege escalation.
- Network attacks. Denial of service, on-path attacks, DNS attacks, and credential attacks like brute force and password spraying.
- Mitigation techniques. Segmentation, patching, least privilege, hardening, and monitoring.
Ransomware is a good example of why this domain is practical. NIST’s practice guide on detecting and responding to ransomware and other destructive events ties the threat directly to integrity and availability and to the controls organizations use to detect and recover from it. A Security+ question on the same topic will usually give you symptoms and ask for the best next action or the control that would have prevented it.
How to study it: build a two-column list of attack on one side and the control that stops it on the other. Then practice reading a scenario and naming both.
Domain 3: Security Architecture (18%)
Where Domain 2 asks what can go wrong, Domain 3 asks how you build things so less goes wrong. It is the domain that rewards people who already know networking and cloud basics.
Expect questions on:
- Architecture models. Cloud, on-premises, hybrid, virtualization, containers, serverless, and the shared responsibility model.
- Network infrastructure. Segmentation, firewalls, proxies, VPNs, intrusion detection and prevention, and secure protocols.
- Data protection. Data classification, encryption at rest, in transit, and in use, and data loss prevention.
- Resilience and recovery. High availability, redundancy, backups, site strategies, and testing recovery plans.
If networking is new to you, this domain will feel heavy. Many candidates build that base first with Network+ or at least a solid grounding in IP addressing, ports, and routing. Our certification roadmap shows how those pieces fit together, and our guide to cloud security skills for beginners helps with the cloud portion.
How to study it: draw diagrams. Sketch a small company network with a DMZ, a segmented internal zone, and a cloud service, then mark where each control sits. Redrawing it from memory is excellent exam preparation.
Domain 4: Security Operations (28%)
This is the heaviest domain and the one closest to a first job in a security operations center or help desk with security duties. It is also where performance-based questions tend to appear, because operations work is procedural.
Core topics:
- Secure baselines and hardening. Configuring devices, mobile solutions, and wireless settings against a standard.
- Asset and vulnerability management. Inventory, scanning, prioritizing findings, penetration testing concepts, and remediation.
- Monitoring and alerting. Log aggregation, SIEM, alert tuning, and endpoint and network monitoring.
- Identity and access management. Single sign-on, multifactor authentication, privileged access, and provisioning.
- Automation and orchestration. Where scripts and playbooks reduce errors and response time.
- Incident response. Preparation, detection, analysis, containment, eradication, recovery, and lessons learned, plus basic digital forensics.
Because this domain is nearly a third of the exam, a weak area here is expensive. Someone who knows every acronym in Domains 1 and 5 but cannot walk through an incident response sequence will struggle.
How to study it: do it, do not just read it. Read a log, run a vulnerability scan against a lab machine, configure a firewall rule, and write down your response steps for a phishing report. Our overview of hands-on cybersecurity training explains what good lab work looks like, and the threat detection labs roadmap shows a four-week structure for SOC-style practice.
Domain 5: Security Program Management and Oversight (20%)
This domain is the governance and business side of security. Candidates from technical backgrounds often underestimate it, and it is worth a fifth of the exam.
You will need to understand:
- Governance. Policies, standards, procedures, and the roles of boards, committees, and data owners.
- Risk management. Risk identification, assessment, analysis, tolerance, and responses such as accept, transfer, mitigate, and avoid. Expect basic quantitative terms like annualized loss expectancy.
- Third-party risk. Vendor assessment, service-level agreements, and contracts.
- Compliance and audits. Regulatory and privacy concepts, internal and external audits, and attestation.
- Security awareness. Phishing simulations, training programs, and how to measure whether they work.
This is also the domain that connects most directly to national priorities. The U.S. Government Accountability Office describes urgent cybersecurity challenges such as federal oversight, securing federal systems, and protecting critical infrastructure and privacy, all of which depend on well-run security programs staffed by trained people. Veterans with experience in command structures, compliance, and risk-based decisions often find this domain more natural than they expect.
How to study it: learn the risk formulas once and practice a few calculations. Then read policy scenarios and ask who is responsible, what is the risk, and which response fits the organization’s tolerance.
Turning the weights into a study plan
The weights suggest a baseline split of your total study time. Adjust it for your background.
| Domain | Baseline share of time | Adjust up if you… |
|---|---|---|
| 1. General Security Concepts | 12% | are new to IT or cryptography |
| 2. Threats, Vulnerabilities, and Mitigations | 22% | have never worked with attack techniques |
| 3. Security Architecture | 18% | lack networking or cloud experience |
| 4. Security Operations | 28% | have not used SIEM, scanners, or incident procedures |
| 5. Program Management and Oversight | 20% | come from a purely technical role |
A practical sequence looks like this:
- Take a diagnostic first. A baseline practice exam shows which domains are weak before you spend hours on ones you already know. Our Security+ practice exam is built for that.
- Work Domain 1, then 2. The vocabulary and the threat landscape come before everything else.
- Move to Domains 3 and 4 with labs. Architecture and operations are easier to remember when you have configured something.
- Finish with Domain 5. Governance questions are often about careful reading and applying a framework.
- Retest by domain. Track your score for each one, not just the overall number, and return to whichever is lowest.
What to know about the exam itself
According to a 2026 overview from Coursera, the SY0-701 exam costs $425 in the US, includes 90 questions that mix multiple-choice and performance-based items, and requires a score of 750 on a scale of 900. Voucher prices and formats can change, so verify them with CompTIA before you register. Our guide to prerequisites for cybersecurity training covers what to have in place before you start.
Security+ is also a common entry point for people wanting to know which cybersecurity specialization to choose, since its five domains expose you to a bit of everything: defense, operations, architecture, and governance.
Our perspective: learn the domains as a job, not a checklist
We teach Security+ to career changers, veterans, and IT professionals, and the same mistake shows up repeatedly: students memorize the domain names and the acronyms, pass practice questions that test recall, and then freeze when a scenario asks them to choose between two plausible actions.
The domains are most useful as a map of the work. Domain 4 is the daily work of watching, triaging, and responding. Domain 2 is knowing what you are looking at. Domain 3 is knowing why the environment is built the way it is. Domain 5 is knowing why the business cares. When students see them as one connected workflow, the exam gets easier and the first interview does too.
That is why we emphasize practical skill development over exam-only preparation, with live tutoring sessions and mentorship from active cybersecurity professionals alongside the course content. Passing the exam is a milestone. Being able to explain, in an interview, what you would do when an alert fires is the goal.
— Alden
Prepare for SY0-701 with Total Cyber Academy
If you want structured preparation, we offer the CompTIA Security+ SY0-701 course in two formats: an on-demand course at $2,499.99 for learners who prefer to set their own pace, and a live, instructor-led course at $2,999.99. Both are one-time payments. If you are planning a longer path into the field, our career programs build on certification with role-based training, and our veteran-focused support is part of how we serve those transitioning into cybersecurity.
FAQ
How many domains are on the Security+ SY0-701 exam?
There are five: General Security Concepts, Threats, Vulnerabilities, and Mitigations, Security Architecture, Security Operations, and Security Program Management and Oversight. Their published weights are 12%, 22%, 18%, 28%, and 20%, which add up to 100%.
Which Security+ domain is the hardest?
It depends on your background. Candidates without networking experience usually find Security Architecture hardest, while technical candidates often struggle with the governance and risk material in Domain 5. Security Operations is the biggest, so a weak spot there costs the most.
Are the Security+ domains the same as the CISSP domains?
No. The CISSP is organized around eight domains and targets experienced practitioners and managers, while Security+ has five domains and is aimed at foundational skills. The names overlap in places, such as risk management and architecture, but the depth and structure differ.
Do I need to study the domains in order?
Not strictly, but starting with Domain 1 helps because it introduces the vocabulary used everywhere else. After that, order matters less than making sure you give the most time to Domains 4 and 2, which together make up half the exam.
Sources
- Security+ SY0-701 reference sheet with domain weights
- NIST SP 1800-26: Detecting and Responding to Ransomware and Other Destructive Events
- NIST SP 1800-25 Executive Summary
- GAO-24-107231, High-Risk Series: Urgent Action Needed to Address Critical Cybersecurity Challenges
- Coursera: What Is the CompTIA Security+ Certification?
