CompTIA Security+ (SY0-701) Overview — Format, What’s Tested & How to Prepare
Everything to know before CompTIA Security+ (SY0-701): exam format and pacing, who it’s for, skills measured by domain, deep readiness checklist, a 3–5 week study plan, and exam-day tactics.
Exam snapshot
- Certification: CompTIA Security+ — SY0-701
- Audience: Early-career security analysts/engineers, IT pros moving into security, career-switchers, students
- Experience target: ~1 year of hands-on IT/networking/security fundamentals
- Format: Multiple-choice (single/multiple) + PBQs (performance-based questions)
- Timing / count: Varies by form; keep a buffer to review flagged items
Study funnel: Read this Overview → work the Syllabus objective-by-objective → keep the Cheatsheet open for last-mile recall → validate with Practice.
What SY0-701 measures (by domain)
1) Threats, Attacks & Vulnerabilities
- Social engineering, credential attacks, malware/ransomware, web/app exploits (XSS/SQLi/CSRF/SSRF), wireless & network attacks, supply chain, cloud misconfig; threat intel & attacker TTPs.
2) Architecture & Design
- Secure network/cloud patterns, segmentation & microsegmentation, zero trust principles (verify explicitly, least privilege, assume breach), resiliency/BCP, secure data lifecycle.
3) Implementation
- Identity & access (MFA, federation/SSO, RBAC/ABAC, 802.1X/NAC), endpoint/network/cloud controls (EDR, NGFW, WAF, VPN, CASB/CSPM), crypto & PKI (TLS, certs), email/web/DNS protections, automation.
4) Operations & Incident Response
- Monitoring & telemetry (SIEM/UEBA/SOAR), triage, evidence handling, containment → eradication → recovery, forensics fundamentals, continuity planning.
5) Governance, Risk & Compliance (GRC)
- Policies/standards/procedures, frameworks (NIST/ISO/CIS), risk treatments (accept/avoid/transfer/mitigate), privacy concepts, audits.
Readiness checklist (be honest)
- I can explain zero trust and pick least-privilege, segmented designs in scenarios.
- I can choose between SAML / OAuth 2.0 / OIDC and justify the choice.
- I know PKI/TLS basics (chains, OCSP/CRL, common cert types) and crypto contrasts (hash/HMAC/AES/RSA/ECDHE).
- I can map attacks → controls (WAF for SQLi/XSS, NAC/802.1X, NGFW rules, EDR response).
- I understand IR phases, order of volatility, and evidence handling.
- I can differentiate vulnerability scanning vs penetration testing and when to use each.
- I recognize core tools (Nmap, Wireshark, Nessus, Burp/ZAP, SIEM/UEBA, SOAR) and their purpose.
If you checked fewer than 6, slow down and spend two extra days on Cheatsheet sections + small labs.
Compact 3–5 week study plan
Week 1 — Threats & Foundations
- Social engineering, common network/web attacks, wireless risks
- Daily: 20–25 mixed questions (threats + controls)
Week 2 — Architecture & Zero Trust
- Segmentation/microsegmentation, secure network/cloud patterns, data lifecycle
- Lab: design a small zero-trust flow (IdP → PDP/PEP → resource)
Week 3 — IAM, Crypto & Implementation
- SAML/OAuth/OIDC, RBAC/ABAC, 802.1X/NAC, TLS/PKI, endpoint/network controls
- Lab: build an allow-list firewall policy; review cert chains
Week 4 — Operations, IR & Forensics
- SIEM triage, alert → containment → eradication → recovery, chain of custody
- Full mock #1; convert misses into 2-bullet rules; re-drill weak objectives
Week 5 (optional) — Polish
- Full mock #2; targeted drills on IAM/crypto/IR/GRC; short labs (packet read, log triage)
High-yield workflows to memorize
Zero Trust quick logic
Verify explicitly → least privilege (RBAC/ABAC) → segment (microsegmentation) → continuous telemetry & policy enforcement.
IR sequence
Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.
Evidence: preserve order of volatility; maintain chain of custody.
Crypto picks
Integrity: SHA-256 / HMAC • Transport: TLS 1.3 (ECDHE + AEAD) • At rest: AES-GCM • Signatures/KE: RSA/ECC/ECDH.
Scanning vs pentesting
Scan = identify breadth (CVSS, authenticated when possible).
Pen test = authorized exploitation to prove impact (scope/ROE).
PBQ expectations & practice ideas
- Design PBQ: choose controls for a given architecture (segment, IAM, WAF/NGFW, VPN).
- Log/pcap PBQ: identify attack stage and pick the next action.
- IR PBQ: order steps correctly; separate containment from eradication.
- Crypto/IAM PBQ: select proper cert type or auth flow for a use case.
Small lab: 2–3 VMs + a test web app/container; capture traffic, raise mock alerts, practice triage decisions.
Exam-day tactics
- First pass fast (~60–70s/item); flag PBQs & long stems for the end.
- Read long scenarios, then the final question to target your reading.
- Prefer preventive, auditable, least-privilege answers with realistic ops.
- Keep a 5–10 minute buffer to revisit flagged items and PBQs.