Security+ SY0-701 Exam Objectives Explained: All 28 in Plain English
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
The Security+ SY0-701 exam is built from 28 objectives in five domains, and every question traces back to one of them. This guide lists all 28 official objective titles with a plain-English explanation of what each one asks you to know, grouped by domain with the published weights. It is most useful as a study checklist: tick off an objective only when you can explain it without notes. The official CompTIA objectives document remains the authoritative source, and the summaries here are our own wording.
How to Use the Objectives List
CompTIA publishes the Security+ SY0-701 objectives as a free document, and the exam is written to it. Every topic on the exam traces back to one of 28 objectives grouped into five domains. The tables below list each official objective title and say, in plain English, what you need to be able to do. Use them as a checklist: tick off an objective only when you can explain it without notes. When you are ready to test yourself, try our Security+ practice questions with answers. The official document has the full bullet list under each objective, so download it from CompTIA's V7 page as your master reference.
Prefer to study the newer version? See our guide to what changed in SY0-801, which has 27 objectives and a new AI threats objective.
Domain 1: General Security Concepts (12% of the exam)
| Objective | Official title | What it means in practice |
|---|---|---|
| 1.1 | Compare and contrast various types of security controls | Classify a control by category (technical, managerial, operational, physical) and by function (preventive, deterrent, detective, corrective, compensating, directive) |
| 1.2 | Summarize fundamental security concepts | The CIA triad, non-repudiation, authentication, authorization and accounting, gap analysis, zero trust, physical security and deception technology such as honeypots and honeytokens |
| 1.3 | Explain the importance of change management processes and the impact to security | Why changes need approval, impact analysis, a backout plan, a maintenance window and documentation, and how allow lists, downtime and dependencies are affected |
| 1.4 | Explain the importance of using appropriate cryptographic solutions | PKI, key management, encryption at different levels, hashing, salting, digital signatures, key exchange, certificates, and tools such as TPMs and HSMs |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Domain 2: Threats, Vulnerabilities, and Mitigations (22% of the exam)
| Objective | Official title | What it means in practice |
|---|---|---|
| 2.1 | Compare and contrast common threat actors and motivations | Nation-states, hacktivists, organized crime, insiders, unskilled attackers and shadow IT, plus how funding, sophistication and motivation differ |
| 2.2 | Explain common threat vectors and attack surfaces | How attackers reach a target: email and messaging, files, removable devices, vulnerable or unsupported software, unsecure networks, default credentials, the supply chain and human tactics such as phishing and typosquatting |
| 2.3 | Explain various types of vulnerabilities | Application, operating system, web (SQL injection, cross-site scripting), hardware, virtualization, cloud, supply chain, cryptographic, misconfiguration, mobile and zero-day weaknesses |
| 2.4 | Given a scenario, analyze indicators of malicious activity | Recognize malware types, physical, network, application, cryptographic and password attacks from the symptoms described in a scenario |
| 2.5 | Explain the purpose of mitigation techniques used to secure the enterprise | Segmentation, access control, allow lists, isolation, patching, encryption, monitoring, least privilege, configuration enforcement, decommissioning and hardening |
Domain 3: Security Architecture (18% of the exam)
| Objective | Official title | What it means in practice |
|---|---|---|
| 3.1 | Compare and contrast security implications of different architecture models | Cloud and the shared responsibility matrix, infrastructure as code, serverless, microservices, air-gapped and segmented networks, IoT, ICS/SCADA and embedded systems |
| 3.2 | Given a scenario, apply security principles to secure enterprise infrastructure | Where to place devices and security zones, fail-open versus fail-closed, inline versus tap, jump servers, proxies, IDS and IPS, firewall types, VPNs, SD-WAN and SASE |
| 3.3 | Compare and contrast concepts and strategies to protect data | Data types and classifications, data states (at rest, in transit, in use), and methods such as encryption, hashing, masking, tokenization and segmentation |
| 3.4 | Explain the importance of resilience and recovery in security architecture | High availability, hot, warm and cold sites, platform diversity, continuity of operations, capacity planning, testing, backups and power |
Domain 4: Security Operations (28% of the exam)
| Objective | Official title | What it means in practice |
|---|---|---|
| 4.1 | Given a scenario, apply common security techniques to computing resources | Secure baselines, hardening targets, wireless and mobile security, application security, sandboxing and monitoring |
| 4.2 | Explain the security implications of proper hardware, software, and data asset management | Procurement, ownership, classification, inventory, tracking and secure disposal, including sanitization, destruction and certification |
| 4.3 | Explain various activities associated with vulnerability management | Identification (scans, application testing, threat feeds, penetration tests), analysis (false positives, CVSS, prioritization) and remediation (patching, compensating controls, validation) |
| 4.4 | Explain security alerting and monitoring concepts and tools | Log aggregation, alerting and tuning, quarantine, and tools such as SIEM, SCAP, NetFlow, antivirus, DLP and vulnerability scanners |
| 4.5 | Given a scenario, modify enterprise capabilities to enhance security | Firewall rules, IDS and IPS, web filtering, operating system security, secure protocols, DNS filtering, email security (SPF, DKIM, DMARC), NAC and EDR |
| 4.6 | Given a scenario, implement and maintain identity and access management | Provisioning, federation and single sign-on (LDAP, OAuth, SAML), access control models, multifactor authentication, password concepts and privileged access management |
| 4.7 | Explain the importance of automation and orchestration related to secure operations | Use cases such as provisioning, guard rails, ticketing and CI/CD, plus the benefits and the risks of complexity and single points of failure |
| 4.8 | Explain appropriate incident response activities | The incident response process from preparation to lessons learned, tabletop exercises, root cause analysis, threat hunting and digital forensics basics |
| 4.9 | Given a scenario, use data sources to support an investigation | Which logs, metadata, scans, dashboards and packet captures answer a given investigative question |
Domain 5: Security Program Management and Oversight (20% of the exam)
| Objective | Official title | What it means in practice |
|---|---|---|
| 5.1 | Summarize elements of effective security governance | Policies, standards, procedures, external regulatory considerations, governance structures, and the roles of data owners, controllers, processors and custodians |
| 5.2 | Explain elements of the risk management process | Risk assessment and analysis (qualitative and quantitative, SLE, ALE, ARO), the risk register, appetite and tolerance, risk strategies and business impact analysis (RTO, RPO) |
| 5.3 | Explain the processes associated with third-party risk assessment and management | Vendor assessment and selection, due diligence, right-to-audit clauses, and agreement types such as SLA, MSA, SOW, NDA and MOU |
| 5.4 | Summarize elements of effective security compliance | Compliance reporting and monitoring, consequences of non-compliance, and privacy concepts such as data subjects, retention and the right to be forgotten |
| 5.5 | Explain types and purposes of audits and assessments | Internal and external audits, attestation, and penetration testing types including known, partially known and unknown environment |
| 5.6 | Given a scenario, implement security awareness practices | Phishing campaigns, recognizing and responding to reported messages, anomalous behavior, user training topics and measuring effectiveness |
More Security+ Study Resources
Domain study guides
- Domain 1: General Security Concepts
- Domain 2: Threats, Vulnerabilities, and Mitigations
- Domain 3: Security Architecture
- Domain 4: Security Operations
- Domain 5: Program Management and Oversight
Cheat sheets
Exam logistics
How to Turn the Objectives Into a Study Plan
Read one objective at a time, write what you can recall, then check the official bullets and fill the gaps. Practice questions tied to each objective show where you are weak. Our Security+ study plan guide shows how to split your days across the five domains, and DD Academy links every flashcard and practice question to its objective so your weak objectives are easy to find. It is free to start on iPhone and the web.
The bottom line
Treat the 28 objectives as your master checklist. Weight your time by domain, learn one objective at a time, and use practice questions to confirm you can apply each one to a scenario. Always check CompTIA's V7 page for the official document and the current exam dates.
Frequently asked questions
How many objectives are on the Security+ SY0-701 exam?
SY0-701 has 28 objectives across five domains: 4 in General Security Concepts, 5 in Threats, Vulnerabilities, and Mitigations, 4 in Security Architecture, 9 in Security Operations and 6 in Security Program Management and Oversight.
What are the Security+ SY0-701 domain weights?
General Security Concepts 12%, Threats, Vulnerabilities, and Mitigations 22%, Security Architecture 18%, Security Operations 28%, and Security Program Management and Oversight 20%.
Where can I download the official Security+ objectives?
CompTIA publishes the SY0-701 exam objectives document on its Security+ V7 certification page. It lists every topic under each objective and is the source the exam is written to.
Which Security+ domain is the biggest?
Domain 4, Security Operations, is the largest at 28% of SY0-701. It covers vulnerability management, monitoring, identity and access management, automation and incident response.
Do I need to memorize every item in the objectives?
You should be able to explain each topic and apply it to a scenario, not just recite a list. Objectives that start with 'Given a scenario' expect you to choose an action in context, which is why practice questions matter.
How do the SY0-701 objectives differ from SY0-801?
SY0-801 has 27 objectives instead of 28, adds a new objective on AI threats and vulnerabilities, consolidates mitigation topics into objective 4.1 and shifts the domain weights. See our SY0-801 versus SY0-701 comparison for the full list of changes.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
