SY0-701 CompTIA Security+ Certification Exam (2026) Exam Topics and Questions

This topic sits at the foundation of everything CompTIA tests. It covers the vocabulary and frameworks you use to describe controls, cryptographic tools, and change processes. You lose marks when you confuse control categories or misapply a cryptographic mechanism to a scenario where it does not fit.

– Control categories and their purpose

Security controls are classified by type and by function, and the exam expects you to apply both dimensions. Technical controls enforce rules through systems; managerial controls set policy. Preventive controls stop an event before it happens, detective controls flag it during or after, and corrective controls repair the damage. Compensating controls fill gaps when a primary control cannot be deployed. Directive controls guide behavior through instruction. Physical controls protect facilities. Operational controls govern day-to-day procedures. Deterrent controls discourage an attacker from attempting the action at all. The examinable skill is matching a given control to the correct label in context, not reciting definitions.

– Core principles and access frameworks

Confidentiality, integrity, and availability form the CIA triad, and the exam tests trade-offs between them. Non-repudiation proves an action occurred and who performed it, typically through digital signatures. Authentication confirms identity, authorization grants permission, and accounting logs the activity; together they form AAA. Zero trust assumes breach and enforces least privilege at every boundary. Deception technology plants fake assets to detect and slow attackers, while disruption technology actively interferes with malicious tools. The exam rewards you for recognizing which principle a scenario violates and which framework applies to the remediation.

– Change management and cryptographic solutions

Change management reduces risk by documenting what changed, why, and how to reverse it. Business processes define approval workflows, technical implications cover dependencies and rollback steps, and version control tracks iterations. Cryptographic solutions protect data in transit and at rest. Public key infrastructure issues and manages certificates. Encryption renders data unreadable without a key. Obfuscation hides meaning without true encryption. Hashing produces a fixed-length digest for integrity checks. Digital signatures combine hashing and asymmetric encryption to prove origin and detect tampering. Blockchain creates an immutable ledger through chained hashes. The exam tests selection: which mechanism solves the problem described.

How General Security Concepts is tested

At twelve percent, this topic appears in roughly one question per ten. Items present a scenario and ask you to classify a control, select the appropriate cryptographic tool, or identify which principle is at stake. You lose marks when you treat all preventive controls as technical, or when you choose encryption where hashing is required. The exam rewards precision in vocabulary. A question might describe a guard at a gate and ask which two labels apply; picking 'physical' and 'deterrent' is rewarded, while 'technical' or 'corrective' is not. Another item might present a certificate authority and ask what role it plays in PKI, or describe a change freeze and ask which documentation step was skipped. The traps are plausible-sounding answers that use related but incorrect terms.

With more than one question in five drawn from this topic, you face the exam's heaviest section. It spans threat actors, attack vectors, vulnerability types, malicious techniques, and the mitigations that counter them. The domain is broad and the item count is high, so incomplete coverage here costs you more than anywhere else.

– Threat actors and their motivations

Nation-states pursue espionage and disruption with significant resources. Unskilled attackers rely on pre-built tools and public exploits. Hacktivists target organizations for ideological reasons. Insider threats abuse legitimate access for personal gain, revenge, or coercion. Organized crime seeks financial profit through ransomware, fraud, and data theft. Shadow IT introduces risk when users deploy unauthorized services to bypass controls. Motivations include data exfiltration, espionage, service disruption, financial gain, and blackmail. The exam tests your ability to infer actor type from a scenario's clues: budget, sophistication, target selection, and objective.

– Attack vectors and vulnerable surfaces

Message-based vectors include phishing, spam, and malicious attachments. Unsecure networks expose traffic to interception and man-in-the-middle attacks. Social engineering manipulates people into divulging credentials or bypassing procedure. File-based vectors deliver malware through documents, executables, and scripts. Voice calls enable vishing and pretexting. Supply chain attacks compromise software or hardware before it reaches the target. Vulnerable software contains flaws that attackers exploit remotely or locally. Each vector has a signature: message-based attacks rely on user action, network attacks exploit weak encryption or authentication, and supply chain attacks insert malicious code upstream.

– Vulnerabilities across platforms and layers

Application vulnerabilities include injection flaws, broken authentication, and insecure deserialization. Hardware vulnerabilities arise from firmware flaws, side-channel attacks, and physical tampering. Mobile devices face jailbreaking, insecure storage, and malicious apps. Virtualization introduces risks from hypervisor exploits, VM escape, and resource contention. Operating system vulnerabilities stem from unpatched flaws, privilege escalation, and misconfigurations. Cloud-specific issues include misconfigured storage, weak identity controls, and shared responsibility gaps. Web-based vulnerabilities cover cross-site scripting, SQL injection, and insecure APIs. Supply chain vulnerabilities compromise components before deployment. The exam rewards you for identifying the layer where a described flaw resides.

– Malicious activity and mitigation techniques

Malware attacks include ransomware, trojans, worms, and rootkits. Password attacks use brute force, dictionary lists, credential stuffing, and rainbow tables. Application attacks exploit injection, buffer overflows, and session hijacking. Physical attacks involve theft, tampering, and shoulder surfing. Network attacks include denial of service, ARP poisoning, and DNS spoofing. Cryptographic attacks target weak algorithms, poor key management, and implementation flaws. Mitigation techniques reduce exposure and contain damage. Segmentation isolates critical assets. Access control enforces least privilege. Configuration enforcement prevents drift. Hardening removes unnecessary services. Isolation limits lateral movement. Patching closes known vulnerabilities. The exam tests your ability to match a described attack to the mitigation that would have prevented or contained it.

How Threats, Vulnerabilities, and Mitigations is tested

Twenty-two percent means roughly one question in every four or five. Items describe an incident, an attack signature, or a vulnerable configuration, then ask you to name the threat actor, identify the vector, classify the vulnerability, or select the most effective mitigation. You lose marks when you confuse an attack vector with the vulnerability it exploits, or when you recommend a mitigation that addresses a different threat. The exam rewards specificity: choosing 'supply chain' over 'network-based' when the scenario describes compromised firmware, or selecting 'segmentation' over 'patching' when the goal is containment rather than remediation. The traps are answers that sound plausible but do not match the scenario's details.

Architecture decisions ripple through every layer of the environment, and this topic tests your ability to apply security principles to infrastructure models, data protection, and resilience. At eighteen percent, it carries nearly one question in five. You lose marks when you treat cloud and on-premises controls as interchangeable, or when you recommend a backup strategy that does not match the recovery objective.

– Architecture models and infrastructure principles

On-premises infrastructure gives you full control but demands capital investment and maintenance. Cloud models shift responsibility to a provider, introducing shared security concerns and configuration risks. Virtualization consolidates workloads but requires hypervisor security and resource isolation. Internet of Things devices expand the attack surface with constrained hardware and weak authentication. Industrial control systems operate in safety-critical environments where availability outweighs confidentiality. Infrastructure as code automates deployment but introduces version control and credential management risks. Enterprise infrastructure applies security principles to design: defense in depth, least privilege, separation of duties, and secure defaults. Control selection balances risk, cost, and operational impact. Secure communication and access require encryption, strong authentication, and boundary enforcement.

– Data protection and classification

Data types include regulated data, intellectual property, personal information, and financial records. Securing methods span encryption at rest and in transit, tokenization, masking, and access controls. General considerations cover data lifecycle, retention, and disposal. Classifications define sensitivity levels and handling requirements: public, internal, confidential, and restricted. The exam tests your ability to match a data type to the appropriate protection method and classification level. You lose marks when you apply the same control to all data types, or when you choose a method that does not satisfy regulatory requirements described in the scenario.

– Resilience and recovery

High availability uses redundancy, load balancing, and failover to minimize downtime. Site considerations include hot, warm, and cold sites, each with different recovery times and costs. Testing validates that recovery procedures work under realistic conditions. Power protection uses UPS, generators, and dual feeds to sustain operations during outages. Platform diversity reduces the risk that a single vulnerability affects all systems. Backups require frequency, retention, and offsite storage decisions. Continuity of operations planning ensures critical functions survive a disruption. The exam rewards you for selecting the resilience measure that fits the recovery objective and budget constraint described in the scenario.

How Security Architecture is tested

Eighteen percent translates to roughly one question per five or six. Items present an infrastructure design, a data protection requirement, or a recovery scenario, then ask you to select the architecture model, data classification, or resilience measure that fits. You lose marks when you recommend a hot site for a function with a lenient recovery time objective, or when you choose masking instead of encryption for data that must remain reversible. The exam rewards alignment between requirement and solution. A question might describe a cloud deployment and ask which control remains the customer's responsibility, or present a data breach and ask which classification was violated. The traps are answers that address a different requirement or ignore a stated constraint.

Security Operations is the exam's heaviest topic at twenty-eight percent, which means more than one question in four comes from this domain. It covers daily tasks: hardening systems, managing assets, remediating vulnerabilities, monitoring alerts, configuring enterprise tools, managing identities, automating workflows, responding to incidents, and analyzing data sources. The breadth is wide and the item count is high, so gaps here are expensive.

– Securing and hardening computing resources

Secure baselines define the minimum configuration for a system before it enters production. Mobile solutions require device encryption, remote wipe, containerization, and mobile device management. Hardening removes unnecessary services, disables default accounts, enforces strong authentication, and applies patches. Wireless security uses WPA3, disables WPS, hides SSIDs where appropriate, and isolates guest networks. Application security covers input validation, secure coding practices, and runtime protection. Sandboxing isolates untrusted code to limit damage from exploitation. Monitoring tracks resource usage, access patterns, and anomalies. The exam tests your ability to select the hardening step that addresses the risk described in the scenario.

– Asset management and vulnerability handling

Asset management tracks hardware, software, and data from acquisition through disposal. Acquisition includes vendor evaluation and secure onboarding. Disposal covers sanitization, destruction, and certificate revocation. Assignment links assets to owners and business functions. Monitoring and tracking maintain an accurate inventory and detect unauthorized changes. Vulnerability management is a continuous cycle: identify vulnerabilities through scanning and threat intelligence, analyze severity and exploitability, remediate by patching or applying compensating controls, validate that the fix worked, and report progress to stakeholders. The exam rewards you for recognizing which phase a described activity belongs to and what happens when a step is skipped.

– Monitoring, enterprise tools, and identity controls

Alerting and monitoring use SIEM, log aggregation, and behavior analytics to detect anomalies. Monitoring tools track computing resource activities: logins, file access, network connections, and process execution. Enterprise security tools require configuration and tuning. Firewalls enforce rules at network boundaries. IDS detects malicious traffic; IPS blocks it. DNS filtering prevents access to malicious domains. Data loss prevention identifies and blocks sensitive data leaving the network. Network access control enforces device compliance before granting access. EDR and XDR provide endpoint visibility and automated response. Identity and access management includes provisioning new accounts, deprovisioning leavers, implementing single sign-on to reduce password fatigue, enforcing multifactor authentication, and managing privileged access with vaulting and session recording.

– Automation, incident response, and data sources

Automation and orchestration reduce manual effort and improve consistency. Use cases include repetitive tasks, threat response, and configuration enforcement. Scripting benefits include speed, accuracy, and auditability. Considerations cover error handling, credential management, and change control. Incident response follows a process: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Training ensures responders know their roles. Testing validates the plan through tabletop exercises and simulations. Root cause analysis identifies how the incident occurred and what control failed. Threat hunting proactively searches for indicators of compromise. Digital forensics preserves evidence for investigation and legal action. Data sources include system logs, application logs, security logs, network traffic captures, and threat intelligence feeds. The exam tests your ability to match a data source to the investigation question it answers.

How Security Operations is tested

At twenty-eight percent, this topic dominates the exam. Items describe an operational task and ask you to select the tool, technique, or process step that applies. You lose marks when you confuse IDS and IPS, or when you recommend automation without considering the error-handling requirement stated in the scenario. The exam rewards operational judgment: knowing when to isolate a compromised system versus when to monitor it for threat intelligence, or choosing the log source that contains the evidence needed to answer an investigation question. A question might present a vulnerability scan result and ask what happens next in the cycle, or describe an incident and ask which response phase is underway. The traps are answers that belong to a different phase or tool category.

The final topic shifts from technical operations to governance, risk, compliance, and awareness. At twenty percent, it accounts for one question in five. You face scenarios that ask you to apply a policy hierarchy, select a risk treatment, evaluate a vendor, interpret a compliance obligation, or design a training campaign. Candidates often underestimate this section because it feels less technical, but the exam tests judgment calls that have no single mechanical answer.

– Governance structures and policy hierarchy

Security governance establishes the framework for decision-making. Guidelines offer recommendations. Policies set mandatory rules. Standards specify technical requirements. Procedures provide step-by-step instructions. The hierarchy matters: policies override guidelines, standards implement policies, and procedures operationalize standards. External considerations include laws, regulations, and contractual obligations. Monitoring ensures compliance with the framework. Governance structures define committees, reporting lines, and escalation paths. Roles and responsibilities assign accountability: security officers set strategy, administrators implement controls, and users follow policy. The exam tests your ability to place a described document or activity at the correct level in the hierarchy.

– Risk management and third-party oversight

Risk management begins with identification: discovering threats and vulnerabilities. Assessment evaluates likelihood and impact. Analysis prioritizes risks using qualitative or quantitative methods. The risk register documents findings, ownership, and treatment decisions. Tolerance is the acceptable level of risk; appetite is the amount an organization is willing to take in pursuit of objectives. Strategies include avoidance, mitigation, transference, and acceptance. Reporting communicates risk status to stakeholders. Business impact analysis quantifies the cost of disruption to guide recovery priorities. Third-party risk management covers vendor assessment before engagement, selection criteria, agreements that define security expectations, ongoing monitoring, questionnaires to verify controls, and rules of engagement for penetration tests or incident response.

– Compliance, audits, and security awareness

Security compliance involves reporting to regulators, auditors, and management. Consequences of non-compliance include fines, sanctions, reputational damage, and loss of authorization to operate. Monitoring tracks adherence to requirements. Privacy obligations govern personal data collection, use, retention, and disclosure. Audits and assessments verify controls. Attestation provides formal assurance that controls are in place. Internal audits are conducted by the organization; external audits by independent parties. Penetration testing simulates attacks to find exploitable weaknesses. Security awareness training reduces human risk. Phishing training teaches users to recognize malicious messages. Anomalous behavior recognition helps users spot indicators of compromise. User guidance clarifies expectations. Reporting mechanisms encourage users to flag suspicious activity. Monitoring measures training effectiveness and identifies users who need additional support.

How Security Program Management and Oversightt is tested

Twenty percent means roughly one question per five. Items present a governance decision, a risk scenario, a vendor relationship, a compliance obligation, or a training challenge, then ask you to select the appropriate action or classification. You lose marks when you confuse risk tolerance with risk appetite, or when you recommend a risk strategy that contradicts the organization's stated objective. The exam rewards contextual judgment. A question might describe a new regulation and ask which document type should be updated first, or present a vendor with weak controls and ask whether to avoid, mitigate, transfer, or accept the risk. Another might describe a phishing campaign and ask which awareness measure would have prevented the most clicks. The traps are answers that sound reasonable in isolation but do not fit the scenario's constraints or objectives.