Security+ Study Guide: Domains Mapped to Labs
The current CompTIA Security+ exam (SY0-701) has five domains, and Security Operations is the largest at 28%. It allows a maximum of 90 questions in 90 minutes, with a pass mark of 750 on a 100 to 900 scale. A new version, SY0-801, is listed for launch on 17 November 2026 with rebalanced domains (CompTIA, checked 3 November 2026).
This guide explains each domain in our own words, maps it to labs on PlayCISO, and gives a six-week plan. It does not copy CompTIA's objectives; download the official ones for the exact list.
Updated 3 November 2026
Domains, versions and labs
Weightings are CompTIA's published percentages for each version. The plain-words column is our summary, not CompTIA's wording.
| Domain | SY0-701 | SY0-801 | In plain words | Practise with |
|---|---|---|---|---|
| General Security Concepts | 12% | 16% | Core ideas: confidentiality, integrity, availability, access control, cryptography basics. | Hashing Lab, MFA Bypass Lab |
| Threats, Vulnerabilities and Mitigations (701) / Attacks (801) | 22% | 24% | Threat actors, attack types, vulnerabilities and how to reduce them. | Email Authentication Lab, KEV Checker |
| Security Architecture | 18% | 19% | Designing secure networks, cloud and data protection. | Firewall Lab, Security Group Auditor |
| Security Operations | 28% | 27% | Monitoring, incident response, vulnerability management, identity and access, automation. | SOC Log Triage Trainer, IR Playbook Lab |
| Security Program Management and Oversight | 20% | 14% | Governance, risk, third parties, compliance, awareness. | Risk Register, NIST CSF tool |
A six-week plan
- Week 1. Download the official objectives for the version you will sit. Learn the core concepts and cryptography basics.
- Week 2. Threats and vulnerabilities: attack types, malware families, social engineering.
- Week 3. Architecture: networks, segmentation, cloud, data protection.
- Weeks 4 and 5. Operations, the biggest domain: logs, incident response, identity, vulnerability scanning.
- Week 6. Program management, then timed practice exams and a review of every miss.
Most people need longer than six weeks; scale the plan to your hours using the roadmap. Pick the version before you start: if you book after the new version launches, study SY0-801 objectives.
After Security+
Common next steps for SOC work are CySA+ or Microsoft SC-200; for the full list see cybersecurity certifications. PlayCISO is not affiliated with CompTIA and its labs do not replace the exam.
Frequently asked questions
What is on the CompTIA Security+ exam?
The current exam, SY0-701, has five domains: General Security Concepts (12%), Threats, Vulnerabilities and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%). It has a maximum of 90 questions, mixing multiple-choice and performance-based, in 90 minutes, with a passing score of 750 on a scale of 100 to 900 (CompTIA, checked 3 November 2026).
When does Security+ SY0-801 launch?
CompTIA lists SY0-801 with a launch date of 17 November 2026, with the same format limits (maximum 90 questions, 90 minutes, 750 on 100 to 900). Its domains are General Security Concepts (16%), Threats, Vulnerabilities and Attacks (24%), Security Architecture (19%), Security Operations (27%), and Security Program Management and Oversight (14%). Check CompTIA for how long SY0-701 stays available.
How long should I study for Security+?
Our planning estimate is about 80 hours for someone at the right starting level, roughly four to five months at five hours a week. It is an estimate, not a CompTIA figure.
How much does Security+ cost?
Our roadmap lists about US$425–439 voucher (CompTIA does not publish it on the cert page; V7 current; V8 expected ~17 Nov 2026) (October 2026). CompTIA does not publish the voucher price on the certification page, so check at checkout.
What does CompTIA recommend before Security+?
CompTIA lists Network+ and two years of experience in a security or systems administrator role as recommended for SY0-701. These are recommendations, not entry requirements.
Which Security+ domain is the biggest?
Security Operations is the largest in both versions (28% on SY0-701, 27% on SY0-801). Spend proportionally more time there: monitoring, incident response, identity and access, and vulnerability management.
Are performance-based questions hard?
They ask you to do a task, such as configure a rule or interpret a log, instead of picking an answer. Hands-on practice is the best preparation, which is why the table maps each domain to a lab.