Security+ SY0-701 Exam: Questions, Format, Passing Score, Cost and Difficulty
Everything about the Security+ SY0-701 exam in one place: 90 questions in 90 minutes, how the 750 scaled score works, the five weighted domains, PBQs, the $439 voucher and retake rules, difficulty by background, whether
The CompTIA Security+ SY0-701 exam is a maximum of 90 questions in 90 minutes, mixing multiple-choice and performance-based questions (PBQs), and you pass at 750 on a 100-to-900 scale, per CompTIA. The US voucher is $439 as of mid-2026, and most people with some IT background need four to eight weeks of study.
That is the short answer. The rest of this page covers what the quick answers skip: why you might see only 75 questions, why 750 is not "83 percent," which of the five domains carries the most marks, what a PBQ actually looks like, what the exam really costs once retakes are counted, and whether the cert is worth it for you. It also includes three real practice questions from the PrepClubs Security+ bank, worked through.
Last updated: September 25, 2026.
Quick takeaways
- SY0-701 is a maximum of 90 questions in 90 minutes, passing at 750 on a 100-to-900 scaled score, per CompTIA. You may see fewer than 90.
- There are five weighted domains. Security Operations alone is 28 percent of the exam, and the top two domains together are half of it.
- PBQs are interactive tasks (firewall rules, log analysis, ordering steps). Expect a handful, usually at the start, and they eat time.
- The US voucher rose from $425 to $439 in mid-2026. One voucher buys one attempt, so a retake is a second full voucher.
- Security+ V8 (SY0-801) launches on or around November 17, 2026. SY0-701 in English stays available until June 11, 2027, per CompTIA.
- Difficulty depends on your background: four to six weeks with IT experience, three to six months for a true career switcher.
- PrepClubs is independent prep material and is not affiliated with or endorsed by CompTIA.
The SY0-701 format at a glance
Here is what CompTIA publishes for the current exam, plus the cost and renewal facts you need to plan.
| Attribute | Security+ SY0-701 |
|---|---|
| Maximum questions | 90 |
| Time limit | 90 minutes |
| Question types | Multiple-choice and performance-based (PBQs) |
| Passing score | 750 on a scale of 100 to 900 (scaled) |
| Domains | 5, weighted from 12% to 28% |
| Recommended experience | CompTIA Network+ and two years in a security or systems administrator role (not required) |
| US voucher price | $439 (up from $425 in mid-2026) |
| Renewal | Every 3 years: 50 CEUs plus a $150 CE fee |
| English retirement date | June 11, 2027 |
Format facts come from CompTIA's SY0-701 page. Prices change and vary by country, so confirm the live figure in the CompTIA store before you buy.
SY0-701 or wait for V8 (SY0-801)?
CompTIA has announced Security+ V8 for on or around November 17, 2026, with expanded coverage of areas such as AI-related risks, security operations, and modern environments. SY0-701 launched on November 7, 2023 and retires on June 11, 2027 in English (August 13, 2027 for the Japanese, Portuguese, Spanish and Thai editions).
The practical rule: if you are already studying SY0-701 and can sit before mid-2027, take SY0-701. Its objectives are stable, and practice material written for it is mature. Both versions earn the same Security+ certification. Switch to V8 only if you are starting from zero and your test date lands well into 2027, and wait for CompTIA's published V8 objectives before trusting any V8 prep.
How many questions, and why you might see fewer than 90
Candidates often finish with 75, 80, or 82 questions and worry they got a broken exam. They did not. The "maximum of 90" wording is deliberate: CompTIA can include unscored trial items and vary the count, and not every delivery serves the full 90. The number you see tells you nothing about how you are doing, so do not try to read your performance from it.
Prepare for the full 90 in 90 minutes. If you build the stamina and pacing for the maximum, a shorter exam is only ever a bonus.
How the 750 passing score really works
Most explanations see 750 out of 900 and translate it to "about 83 percent." That is not how it works.
The 100-to-900 range is a scaled score. CompTIA converts your raw performance onto that scale using a model that accounts for the difficulty of the items you saw. Two candidates with the same number of correct answers can get different scaled scores if they saw items of different difficulty. CompTIA does not publish per-item weighting or a question-by-question key, so there is no honest way to say "you need exactly 60 of 90."
How many questions can you miss?
There is no fixed number, and any page that gives you a precise one is guessing. Harder items effectively count for more, so missing five easy questions is not the same as missing five hard ones. Stop counting misses and think in margin instead: on full-length practice tests scored as a straight percentage, treat a repeatable 85 percent or higher as your green light before you book. That margin survives the scaling and a few unlucky items on the day.
The five SY0-701 domains and their weights
CompTIA assigns each domain a fixed share of the exam. This table is the single most useful planning tool you have, because it tells you where your study hours belong.
| SY0-701 domain | Exam weight | What it actually tests |
|---|---|---|
| 1.0 General Security Concepts | 12% | Control types, CIA triad, authentication and authorization, zero trust, cryptography and PKI basics |
| 2.0 Threats, Vulnerabilities, and Mitigations | 22% | Threat actors, attack vectors (phishing, malware, social engineering), indicators of compromise, mitigations |
| 3.0 Security Architecture | 18% | Cloud, on-premises, hybrid, IoT and ICS/SCADA models, data protection, backups and resilience |
| 4.0 Security Operations | 28% | Hardening, vulnerability management, SIEM and log monitoring, IAM in practice, incident response, forensics |
| 5.0 Security Program Management and Oversight | 20% | Governance, risk management and the risk register, third-party risk, compliance, audits, awareness |
Two things jump out. Security Operations is more than double the smallest domain. And Security Operations plus Threats, Vulnerabilities, and Mitigations add up to half the exam. Most people do the opposite of what the weights say: they pour early effort into domain 1.0 because every course opens with it, then reach test day underprepared on the two heaviest domains.
Technical candidates also lose easy marks in domain 5.0. It is 20 percent of the exam and it is about policy, risk math and business judgment, not configuration.
SY0-601 versus SY0-701
If a guide lists "Attacks, Threats, and Vulnerabilities" as domain 1, it describes the retired SY0-601 exam. Close it.
| SY0-601 (retired) domains | SY0-701 (current) domains |
|---|---|
| Attacks, Threats, and Vulnerabilities | General Security Concepts |
| Architecture and Design | Threats, Vulnerabilities, and Mitigations |
| Implementation | Security Architecture |
| Operations and Incident Response | Security Operations |
| Governance, Risk, and Compliance | Security Program Management and Oversight |
You may also see CompTIA call the current exam "Security+ V7." That is the same exam as SY0-701, not a separate code.
Performance-based questions: what they look like and how to pace them
PBQs put you inside a simulated task instead of asking you to recognize an answer. On Security+ they come in a few recurring shapes:
- Configuration: set firewall rules, secure a wireless access point, set file-share permissions.
- Drag-and-drop matching: match attacks to mitigations, or place controls on a network diagram.
- Ordering: put incident-response phases or hardening steps in sequence.
- Analysis: read a log excerpt or small topology and find the misconfiguration or indicator of compromise.
There is no fixed, published count. Based on CompTIA's format description and consistent candidate reports, expect roughly 3 to 6 PBQs, usually at the start. They draw mostly from the hands-on domains: Security Operations, Security Architecture, and Threats, Vulnerabilities, and Mitigations.
A worked PBQ example (original, not a live item)
A small office has one firewall between the internet and the LAN. You must enable only the rules that follow least privilege while keeping a public web server reachable.
| Rule | Verdict |
|---|---|
| A: Allow inbound TCP 443 to the web server | Enable. Public HTTPS to the web server is required. |
| B: Allow inbound TCP 3389 to all internal hosts | Deny. Exposing RDP to the whole internet is a serious risk. |
| C: Allow outbound TCP 443 from the LAN | Enable. Internal hosts need HTTPS out to browse and update. |
| D: Allow inbound ANY to ANY | Deny. An any-any allow defeats the firewall entirely. |
Enable A and C, deny B and D. The exam is not testing whether you know what a firewall is. It is testing whether you open only what a real service needs, under time pressure.
The time-management play
- Do not grind the first PBQ to completion. That is how people burn 20 minutes before answering a single multiple-choice item.
- Skim every PBQ. Finish the ones you can do in two or three minutes and flag the rest.
- Clear the multiple-choice questions. They are faster and bank you time.
- Return to the flagged PBQs knowing exactly how much clock you have left.
You can only run this play if you have met the format before. Meeting your first PBQ live, with the clock running, is the worst time to learn how the interface behaves.
How hard is Security+?
Security+ sits at the early-intermediate level: harder than A+ and Network+, easier than CISSP. It is an application exam. You get scenarios (the best control, the first response, the most likely attack) far more than definitions, which is why people who "know the material" from flashcards still fail. CompTIA does not publish an official pass rate, so treat any exact pass-rate figure you see as an estimate.
The biggest predictor of difficulty is what you walk in with. Here is our honest read by background.
| Your background | Rough difficulty (1 to 10) | Realistic study time |
|---|---|---|
| A+ and Network+ holder | 5 to 6 | 4 to 6 weeks |
| 2+ years in IT, no security certs | 6 | 6 to 8 weeks |
| Some IT exposure (help desk, self-taught) | 7 | 2 to 4 months |
| True career switcher, no IT job yet | 8 | 3 to 6 months |
The exam assumes networking and systems basics it does not teach. If you do not yet know what a subnet, a port, or a DNS record is, your first weeks go to networking before security, which is why the switcher timeline runs in months. People with zero IT background do pass every year. Budget the hours honestly and over-practice the two hardest parts: the PBQs and Domain 4, Security Operations, which is both the heaviest domain and the most scenario-dense.
The fastest way to learn where you personally stand is to measure it. PrepClubs' 25-question timed Security+ diagnostic scores you across all five domains, so in about 25 minutes you know whether you are weeks or months out.
What the Security+ exam really costs
| Item | US cost |
|---|---|
| SY0-701 voucher, one attempt | $439 (up from $425 in mid-2026) |
| Retake | Another full voucher |
| Voucher plus retake bundle | Sold by CompTIA, cheaper than two separate vouchers |
| Renewal every 3 years | 50 CEUs plus a $150 CE fee |
The voucher is the one hard number, and it buys exactly one attempt. Per CompTIA's retake policy, there is no waiting period between your first and second attempt, but you must wait at least 14 calendar days before a third or any later attempt. Each attempt needs its own voucher, so failing once takes you from $439 to $878. The cheapest way to control exam cost is not a discount code. It is not failing.
Legitimate ways to pay less:
- Academic vouchers. Students and people affiliated with an academic institution can buy discounted vouchers through CompTIA's academic store. This is the biggest and most under-used saving.
- A retake bundle. If there is any real chance you need a second attempt, a voucher-plus-retake bundle bought up front costs less than two vouchers.
- Employer tuition assistance. Under IRS Section 127, employers can provide up to $5,250 per year in tax-free educational assistance. Many will cover a Security+ voucher if you ask.
- Training bundles. CompTIA sometimes bundles a voucher with its own training or a retake at a lower combined price.
Avoid third-party sites selling vouchers far below CompTIA's price. Some are legitimate resellers, but many are region-locked or invalid, and a voucher that will not redeem is not a saving. Renewal fees are set on CompTIA's CE fees page, and the Security+ renewal guide covers how to earn the CEUs without retaking the exam.
Is Security+ worth it?
For most people breaking into cybersecurity or moving up from help desk, yes, with one honest caveat: the cert opens doors, it does not walk you through them.
Security+ maps to roles like SOC analyst (Tier 1), security analyst, cybersecurity analyst, junior security engineer, and entry GRC or compliance roles. A large share of postings for those jobs list it as required or strongly preferred, because it is the credential hiring managers recognize as proof of the fundamentals.
The one place it is non-negotiable: Security+ is approved under DoD directive 8140.03-M, the successor to the old 8570 framework. Many roles supporting the Department of Defense require an approved certification, and Security+ is one of the most common ways to meet it. If you target federal or defense-contractor work, it is close to mandatory.
On pay, read the number correctly. The US Bureau of Labor Statistics reports a median annual wage of $129,180 for information security analysts in May 2025, and projects employment in the occupation to grow 21 percent from 2025 to 2035. That median spans experienced professionals. It is not day-one pay for someone who just passed Security+. The cert speeds up the early rungs (help desk or junior IT, then SOC or security analyst), and higher pay comes with experience and further certs. CompTIA itself does not attach a salary to the cert.
| Your situation | Verdict |
|---|---|
| Breaking into security or stepping up from IT | Worth it. This is the target audience. |
| Targeting federal or DoD work | Worth it, often required. |
| Already a senior security professional | Skip. Look at CISSP or a specialist cert. |
| Aiming purely at penetration testing or red team | Consider OSCP or CEH instead. |
The cert alone rarely gets you hired. Pair it with a home lab, projects, or existing IT experience.
Three real practice questions, worked
These come verbatim from the PrepClubs Security+ bank, which is written to the SY0-701 objectives. Try each one before reading the answer.
Question 1: firewall rule order (PBQ-style, Threats, Vulnerabilities, and Mitigations)
From PrepClubs Security+ Practice Test 1, question 31.
A firewall processes rules top to bottom and stops at the first match. A host at 192.0.2.50 attempts an outbound connection to 203.0.113.80 on TCP/22 (SSH). Given the ruleset, which rule determines the outcome and what is it?
10 ALLOW 192.0.2.0/24 203.0.113.0/24 TCP/443
20 DENY 192.0.2.50/32 203.0.113.0/24 TCP/22
30 ALLOW 192.0.2.0/24 ANY ANY
40 DENY ANY ANY ANY
- A. Rule 40, connection denied
- B. Rule 10, connection allowed
- C. Rule 30, connection allowed
- D. Rule 20, connection denied
Answer: D. Rule 10 requires TCP/443, so the SSH attempt does not match it. Rule 20 matches on all three fields (source 192.0.2.50, a destination inside 203.0.113.0/24, and TCP/22), so the connection is denied there and no later rule is consulted. Rule 30 would have allowed it, but evaluation already stopped. Placing a specific deny above a broad allow is the standard way to carve an exception out of a permissive policy.
Question 2: order of volatility (PBQ-style, Security Operations)
From PrepClubs Security+ Practice Test 2, question 71.
A responder must collect digital evidence from a live, powered-on server in the order that preserves the most fragile data first, following the order of volatility. Arrange these sources correctly.
(1) Data on the local hard disk
(2) CPU registers and cache
(3) Archived backups on off-site tape
(4) Contents of RAM and running process state
- A. 1, 2, 4, 3
- B. 4, 2, 1, 3
- C. 2, 4, 1, 3
- D. 2, 1, 4, 3
Answer: C. CPU registers and cache are overwritten continuously, RAM and running process state survive only until the machine is powered down or altered, the local disk persists across a reboot, and off-site tape is the most durable of all. Imaging the disk first (A or D) lets the most fragile data vanish, and RAM is less volatile than registers and cache, so it cannot come first (B).
Question 3: annualized loss expectancy (PBQ-style, Security Program Management and Oversight)
From PrepClubs Security+ Practice Test 1, question 76.
A risk analyst is quantifying the exposure of a customer database to a flood event. Asset value (AV) = 500,000 USD. Exposure factor (EF) = 40 percent. A qualifying flood is expected once every 20 years. What is the annualized loss expectancy (ALE)?
- A. 200,000 USD
- B. 40,000 USD
- C. 25,000 USD
- D. 10,000 USD
Answer: D. SLE = AV x EF = 500,000 x 0.40 = 200,000. Once every 20 years gives an ARO of 1/20 = 0.05. ALE = SLE x ARO = 200,000 x 0.05 = 10,000 USD per year. A stops at the single loss expectancy, B uses an ARO of 0.2 (once in five years), and C skips the exposure factor.
Notice that none of these can be answered from a memorized definition. That is the exam in miniature.
FAQ
How many questions are on the Security+ exam?
A maximum of 90, in 90 minutes, per CompTIA. You may see fewer than 90 in a given delivery, because 90 is the ceiling and unscored items can vary the count. A shorter exam says nothing about your score.
What is the passing score for Security+?
750 on a scale of 100 to 900. It is a scaled score that accounts for item difficulty, not a raw percentage, so there is no published number of questions you must get right. Aim for a repeatable 85 percent or higher on full-length practice tests.
How many PBQs are on Security+?
CompTIA does not publish a fixed number. Expect roughly 3 to 6, usually at the start of the exam. You can flag them, clear the multiple-choice questions, and come back within the 90 minutes.
How much does the Security+ exam cost?
The US voucher is $439 as of mid-2026, up from $425. It covers one attempt, so a retake means buying another voucher. Renewal every three years needs 50 CEUs and a $150 CE fee. Check the CompTIA store for your country's current price.
Is there a waiting period to retake Security+?
No waiting period between your first and second attempt. From the third attempt onward, you must wait at least 14 calendar days after your last attempt, per CompTIA's retake policy.
Should I take SY0-701 or wait for SY0-801?
If you can sit before mid-2027 and are already studying, take SY0-701. It retires in English on June 11, 2027, and V8 launches on or around November 17, 2026. Both lead to the same Security+ certification.
Is Security+ hard for beginners?
For someone with no IT background, yes, roughly an 8 out of 10, because you learn networking fundamentals and security at the same time. Budget three to six months. With IT experience it is a focused four-to-six-week effort.
Is Security+ worth it in 2026?
For people entering cybersecurity or stepping up from IT, yes. It is the recognized entry-level baseline and is approved under DoD 8140.03-M for many federal roles. Already-senior professionals should look at CISSP instead.
Related on PrepClubs
- Security+ practice test and study plan: how to use a full-length bank as a diagnostic, plus a 30-day domain-weighted plan.
- Security+ renewal and CEUs: keeping SY0-701 active without retaking it.
- CompTIA certifications list: where Security+ sits next to A+, Network+ and the rest.
- CompTIA Network+ practice test: the cert CompTIA recommends before Security+.
- CISSP exam format: the management-level cert many Security+ holders target next.
Practice the real format, not just the facts
Knowing it is 90 questions and 750 to pass is the easy part. Building the pacing to clear 90 items in 90 minutes, PBQs and all, is what gets you certified, and it only comes from full-length practice under the clock. PrepClubs' Security+ track starts with a 25-question timed diagnostic that shows your weak domains, then opens 10 full-length, 90-minute practice tests (900 original SY0-701 questions, including 98 PBQ-style scenario items), each with a written rationale for every option. It is backed by our Money-back Guarantee, and current plans are on the pricing page.
Practice at prepclubs.com/tests/security-plus.
Practise for this exam
CompTIA Security+ (SY0-701) practice tests
Full-length timed forms across every exam domain at the official weighting, with a clear rationale for every answer. Start with the 25-question diagnostic to see which domains need the most work.
