CompTIA · Official Blueprint · Last reviewed May 2026
The official CompTIA SY0-701 exam covers 5 domains. Domain weights tell you exactly how much of the exam each topic represents — and where to invest your study time.
Security controls (technical, managerial, operational), cryptography fundamentals, PKI, authentication protocols, and core security principles.
Practice General Security Concepts questionsThreat actor types and motivations, common attack techniques (phishing, SQL injection, ransomware), vulnerability scanning, and mitigation strategies.
Practice Threats, Vulnerabilities, and Mitigations questionsNetwork segmentation, zero trust architecture, cloud security models, virtualisation security, and resilience/redundancy design.
Practice Security Architecture questionsIncident response lifecycle, digital forensics, threat hunting, SIEM/SOAR tools, log analysis, and security automation.
Practice Security Operations questionsRisk management frameworks, data governance, compliance, third-party risk management, and privacy regulations.
Practice Security Program Management and Oversight questionsThe heaviest domain on the SY0-701 is "Security Operations" at 28%. Start here and return to it regularly.
Allocate study time proportional to domain weight — a 25% domain deserves roughly 25% of your prep hours.
Never skip a low-weight domain. A 10% domain still represents 5–7 exam questions — enough to make the difference between pass and fail.
Use Courseiva domain analytics to track your accuracy per domain automatically. The system routes extra questions to your weak areas.
Courseiva tracks your accuracy per domain automatically and routes you toward your weakest areas — no manual configuration needed.
CIA Triad
Three principles sit at the foundation of every security decision ever made: Confidentiality, Integrity, and Availability.
PKI & Certificates
Every time your browser shows a padlock icon, PKI is working in the background.
Zero Trust
The old security model assumed that anything inside the corporate network could be trusted.
Incident Response
When a breach happens, the organizations that limit damage are the ones that have a plan before the attacker arrives.
Risk Management
Security spending without a framework is guesswork.
Cryptography
Cryptography is the engine behind every secure connection, every encrypted file, and every digital signature you rely on without thinking about it.