A company wants to prove that a downloaded installer has not been modified since the vendor published it. Which mechanism provides this assurance?

A cryptographic hash published by the vendor, compared against the downloaded file

Symmetric encryption of the file

Compressing the file with a password

Storing the file on a read-only share

A security analyst sees that a workstation has begun connecting to an unknown external IP address every ten minutes and sending small amounts of data. Which step of the incident response process should happen first?

Containment: isolate the workstation from the network

Eradication: reimage the workstation

Lessons learned: update the runbook

An employee receives an email that appears to come from the CEO asking them to urgently buy gift cards and send the codes. What type of attack is this?

Business email compromise (a form of phishing)

Is Security+ enough to get a job?

It gets you past the filter for many entry-level security and IT roles, especially where compliance requires it, and it is often the deciding line on a CV. It is not a substitute for hands-on skills, which is why the practice here is built around scenarios and outputs.

Do I need Network+ first?

No, but networking knowledge is assumed. If you cannot explain a subnet, a VLAN and how TLS works, spend two weeks on those before starting.

How long should I study?

Eight to twelve weeks part-time for most people with some IT background; longer without it.

How much does it cost and how long is it valid?

About US$404 at the time of writing, priced by country with discounts common, and valid for three years with continuing education.

What are performance-based questions like?

Simulations: match attacks to mitigations, configure a firewall rule, read a log and pick the compromised host. They come first on the paper and eat time; many candidates flag them and return after the multiple choice. The practice papers here are multiple choice only, so rehearse simulations separately.

All certifications

CompTIA · SY0-701 · Entry to intermediate

CompTIA Security+

The most widely required baseline security certification: threats, architecture, operations and programme management.

Free practice: 231 questions written to the official exam guide, with the diagnostic, practice papers, timed mocks, a study plan and an explanation on every answer.

Official exam page

Find out where you stand on SY0-701

20 questions drawn in the exam’s own domain weights. You get a report straight away: your score against the pass mark, where the points went, and what to study first.

Questions: 20
Time: about 20 minutes
Cost: free

Your email

Your answers save as you go, and the report stays in your record. A new email needs no code.

· your answers stay on this device and you can save the report at the end.

The course

The diagnostic shows where you stand. Then you learn the syllabus chapter by chapter, answer that chapter’s questions, and move on. When every chapter is mastered, you sit full timed mocks in the real exam’s shape.

19 chapters, about 14.5 hours in all. Each is a 45-minute study session with quick checks, then a 10-question quiz on that chapter.

General Security Concepts12% of the exam

Security controls and change management45 min
Fundamental security concepts45 min
Cryptographic solutions45 min

Threats, Vulnerabilities, and Mitigations22% of the exam

Threat actors, threat vectors and attack surfaces45 min
Types of vulnerabilities45 min
Indicators of malicious activity45 min
Mitigation techniques45 min

Security Architecture18% of the exam

Security implications of architecture models45 min
Securing enterprise infrastructure45 min
Protecting data45 min
Resilience and recovery45 min

Security Operations28% of the exam

Securing computing resources and assets45 min
Vulnerability management, alerting and monitoring45 min
Enhancing enterprise security capabilities45 min
Identity and access management45 min
Automation, incident response and investigation45 min

Security Program Management and Oversight20% of the exam

Security governance and risk management45 min
Third-party risk and security compliance45 min
Audits, assessments and security awareness45 min

About the CompTIA Security+ (SY0-701) exam

CompTIA Security+ is the most widely required baseline security certification. It appears in more security job adverts than any other credential, it satisfies the United States Department of Defense's 8570 and 8140 requirements, and it is the usual first step for anyone entering security from IT, networking, development or study.

The current version, SY0-701, is organised around five domains: general security concepts, threats, vulnerabilities and mitigations, security architecture, security operations (the largest, at 28%) and security programme management and oversight. The exam is scenario-heavy and includes performance-based questions. CompTIA expects to launch the next version, SY0-801, on or around 17 November 2026; SY0-701 stays bookable until CompTIA retires it, and the certification is the same Security+ whichever version you sit.

CompTIA recommends Network+ and two years of experience in a security or systems role; neither is required. Plan on two to three months of study.

The exam at a glance

Questions: Up to 90 questions, multiple choice and performance-based
Time: 90 minutes
Pass mark: 750 on a scale of 100 to 900
Exam fee: About US$404 (varies by country; academic and voucher discounts exist)
Valid for: 3 years, renewable through continuing education
Where you sit it: Pearson VUE test centre or online proctored
Prerequisites: None required; CompTIA recommends Network+ and two years of experience

As published in the vendor’s exam guide at the time of writing. Fees vary by country and change; the vendor’s page is the source of truth.

The fee and how to sit it in your country: Sri Lanka · India · Pakistan · Bangladesh · Nepal · Australia · New Zealand · Philippines · Indonesia · Vietnam

What is on the exam, domain by domain

General Security Concepts
The CIA triad, non-repudiation, AAA, zero trust, physical security, deception, change management and the cryptographic basics: symmetric, asymmetric, hashing, PKI, certificates.
12% of the paper
Threats, Vulnerabilities, and Mitigations
Threat actors and their motivations, attack surfaces, social engineering, malware, application and network attacks, indicators of compromise, and the mitigations for each.
22% of the paper
Security Architecture
Cloud, on-premises and hybrid models, infrastructure concepts, network appliances, secure communication, data protection strategies and resilience and recovery.
18% of the paper
Security Operations
The largest domain. Hardening, asset management, vulnerability management, monitoring and alerting, identity and access management, automation, incident response and digital forensics.
28% of the paper
Security Program Management and Oversight
Governance, policies and standards, risk management, third-party risk, compliance, audits and assessments, and security awareness.
20% of the paper

How to prepare

Print the objectives and study to them; SY0-701 added new material on zero trust, automation and modern threats, and older material will miss it.
Learn cryptography properly rather than by memorising acronyms: what hashing, symmetric and asymmetric encryption, and signatures each achieve, and which goal (confidentiality, integrity, authentication, non-repudiation) each serves.
Practise reading logs and outputs: firewall logs, a vulnerability scan, an nmap result. Performance-based questions ask you to interpret them.
Do the incident response process (preparation, detection, analysis, containment, eradication, recovery, lessons learned) until the order is automatic; questions ask for the next step.
Two timed practice papers above 85% before you book. Time pressure is the main complaint about this exam.

Sample questions

Three questions in the exam’s style, written by Square 1 against the published domains. They are ours, not the vendor's. The answer and the reasoning are under each one; the practice papers on this page draw from a bank written the same way, with an explanation on every question.

Question 1 · General Security Concepts
A company wants to prove that a downloaded installer has not been modified since the vendor published it. Which mechanism provides this assurance?
1. Symmetric encryption of the file
2. A cryptographic hash published by the vendor, compared against the downloaded file
3. Compressing the file with a password
4. Storing the file on a read-only share
Answer: B. A hash is a fixed-length fingerprint of the file; if the downloaded copy hashes to the vendor's published value, it is unmodified. This is an integrity control. Encryption protects confidentiality, and the other options do not detect tampering.
Question 2 · Security Operations
A security analyst sees that a workstation has begun connecting to an unknown external IP address every ten minutes and sending small amounts of data. Which step of the incident response process should happen first?
1. Eradication: reimage the workstation
2. Lessons learned: update the runbook
3. Containment: isolate the workstation from the network
4. Recovery: restore from backup
Answer: C. Regular beaconing to an unknown host is a classic command-and-control indicator. After detection and analysis, containment comes first, to stop further exfiltration or spread, before eradication and recovery. Lessons learned is last.
Question 3 · Threats, Vulnerabilities, and Mitigations
An employee receives an email that appears to come from the CEO asking them to urgently buy gift cards and send the codes. What type of attack is this?
1. Vishing
2. Business email compromise (a form of phishing)
3. A watering hole attack
4. A brute-force attack
Answer: B. Impersonating an executive by email to extract money is business email compromise, a targeted phishing variant. Vishing is by voice, watering hole attacks compromise a site the target visits, and brute force attacks guess credentials.

Questions people ask before they book

Is Security+ enough to get a job?: It gets you past the filter for many entry-level security and IT roles, especially where compliance requires it, and it is often the deciding line on a CV. It is not a substitute for hands-on skills, which is why the practice here is built around scenarios and outputs.
Do I need Network+ first?: No, but networking knowledge is assumed. If you cannot explain a subnet, a VLAN and how TLS works, spend two weeks on those before starting.
How long should I study?: Eight to twelve weeks part-time for most people with some IT background; longer without it.
How much does it cost and how long is it valid?: About US$404 at the time of writing, priced by country with discounts common, and valid for three years with continuing education.
What are performance-based questions like?: Simulations: match attacks to mitigations, configure a firewall rule, read a log and pick the compromised host. They come first on the paper and eat time; many candidates flag them and return after the multiple choice. The practice papers here are multiple choice only, so rehearse simulations separately.