Back to certifications
CompTIA certification

CompTIA Security+

The globally recognized certification to launch your cybersecurity career.CompTIA Security+ is a globally recognized cybersecurity certification that helps you build and validate the practical cybersecurity skills needed to perform core security functions and pursue a career in cybersecurity. Security+ V7 is available today, while the newest version, Security+ V8, is expected to launch on or around November 17, 2026. V8 offers expanded coverage of areas such as AI-related risks, security operations, and modern environments.
CompTIA
Exam version: V7
Target roleSecurity analyst

Choose your

exam

Security+ is currently offered in two versions: V7, available today, and V8, expected to launch on or around November 17, 2026. Select a version to see its skills, details and objectives.
CompTIA Security+ is the premier global certification that establishes the essential skills required for core security functions and a career in IT security. It showcases professionals' capabilities in securing networks, applications, and devices, ensuring data integrity, confidentiality, and availability. CompTIA Security+ focuses on practical, hands-on skills to tackle real-world challenges. As the most widely recognized credential, it is invaluable for advancing in the dynamic field of cybersecurity.

Skills you'll

learn

Build skills with CompTIA learning and validate them with the Security+ V7 certification.
Identify various types of threats, attacks, and vulnerabilities, including malware, social engineering, and application attacks.
Utilize security technologies and tools, such as firewalls, intrusion detection systems, and endpoint security, to protect systems.
Design secure network architectures, implement secure systems, and apply secure protocols for architecture and design.
Manage identity and access concepts, including authentication, authorization, and accounting, to ensure secure access control.
Assess and manage risk through risk analysis, mitigation strategies, and business continuity planning.
Apply cryptography concepts, including encryption algorithms, public key infrastructure (PKI), and digital signatures, to secure data.
Implement compliance and operational security measures, including security policies, procedures, and best practices.

Exam

details

Everything you need to know before taking the Security+ V7 exam.
Exam versionV7
Exam series codeSY0-701
Launch dateNovember 7, 2023
Number of questionsMaximum of 90 questions
Types of questionsMultiple-choice and performance-based
Duration90 minutes
Passing score750 (on a scale of 100–900)
LanguagesEnglish, Japanese, Portuguese, Spanish, and Thai
Recommended experienceCompTIA Network+ and two years of experience working in a security/systems administrator job role
RetirementEnglish: June 11, 2027; Japanese, Portuguese, Spanish, and Thai: August 13, 2027
DoD 8140 approved work rolesCyber defense analyst, incident responder, vulnerability analyst, security control assessor, system administrator, network specialist, systems planner, IT project manager, information security manager, secure software assessor, and many more

Exam

objectives

The Security+ V7 (V7) exam covers the following domains, weighted by their share of the exam.
1

General security concepts

12%
  • Security controls: comparing technical, preventive, managerial, deterrent, operational, detective, physical, corrective, compensating, and directive controls.
  • Fundamental concepts: summarizing confidentiality, integrity, and availability (CIA); non-repudiation; authentication, authorization, and accounting (AAA); zero trust; and deception/disruption technology.
  • Change management: explaining business processes, technical implications, documentation, and version control.
  • Cryptographic solutions: using public key infrastructure (PKI), encryption, obfuscation, hashing, digital signatures, and blockchain.
2

Threats, vulnerabilities, and mitigations

22%
  • Threat actors and motivations: comparing nation-states, unskilled attackers, hacktivists, insider threats, organized crime, shadow IT, and motivations like data exfiltration, espionage, and financial gain.
  • Threat vectors and attack surfaces: explaining message-based, unsecure networks, social engineering, file-based, voice call, supply chain, and vulnerable software vectors.
  • Vulnerabilities: explaining application, hardware, mobile device, virtualization, operating system (OS)-based, cloud-specific, web-based, and supply chain vulnerabilities.
  • Malicious activity: analyzing malware attacks, password attacks, application attacks, physical attacks, network attacks, and cryptographic attacks.
  • Mitigation techniques: using segmentation, access control, configuration enforcement, hardening, isolation, and patching.
3

Security architecture

18%
  • Architecture models: comparing on-premises, cloud, virtualization, Internet of Things (IoT), industrial control systems (ICS), and infrastructure as code (IaC).
  • Enterprise infrastructure: applying security principles to infrastructure considerations, control selection, and secure communication/access.
  • Data protection: comparing data types, securing methods, general considerations, and classifications.
  • Resilience and recovery: explaining high availability, site considerations, testing, power, platform diversity, backups, and continuity of operations.
4

Security operations

28%
  • Computing resources: applying secure baselines, mobile solutions, hardening, wireless security, application security, sandboxing, and monitoring.
  • Asset management: explaining acquisition, disposal, assignment, and monitoring/tracking of hardware, software, and data assets.
  • Vulnerability management: identifying, analyzing, remediating, validating, and reporting vulnerabilities.
  • Alerting and monitoring: explaining monitoring tools and computing resource activities.
  • Enterprise security: modifying firewalls, IDS/IPS, DNS filtering, DLP (data loss prevention), NAC (network access control), and EDR/XDR (endpoint/extended detection and response).
  • Identity and access management: implementing provisioning, SSO (single sign-on), MFA (multifactor authentication), and privileged access tools.
  • Automation and orchestration: explaining automation use cases, scripting benefits, and considerations.
  • Incident response: implementing processes, training, testing, root cause analysis, threat hunting, and digital forensics.
  • Data sources: using log data and other sources to support investigations.
5

Security program management and oversight

20%
  • Security governance: summarizing guidelines, policies, standards, procedures, external considerations, monitoring, governance structures, and roles/responsibilities.
  • Risk management: explaining risk identification, assessment, analysis, register, tolerance, appetite, strategies, reporting, and business impact analysis (BIA).
  • Third-party risk: managing vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement.
  • Security compliance: summarizing compliance reporting, consequences of non-compliance, monitoring, and privacy.
  • Audits and assessments: explaining attestation, internal/external audits, and penetration testing.
  • Security awareness: implementing phishing training, anomalous behavior recognition, user guidance, reporting, and monitoring.
Exam information is published by CompTIA and may change. Contact us for the current exam version and available sessions.

Take CompTIA Security+ at NEXERA Institute

Our advisors help you choose the right preparation, book your exam session and get certified with confidence.
CompTIA Security+ | Nexera