The Security+ exam is 90 questions, 90 minutes, and $392. Here's what actually shows up — not a rehash of the entire objectives PDF, but the domains and topics that carry real weight on test day.

Exam Structure

SY0-701 is split into five domains, each weighted differently in the actual scoring:

Security Operations is the single biggest domain on the exam at 28% — if you're allocating study time proportionally to test weight and you're skimming the incident response and monitoring material, you're studying backwards.

SY0-701 replaced SY0-601 in late 2023, and the update leaned harder into cloud security, automation and orchestration, and zero trust concepts — areas that reflect what security teams actually deal with day to day now, versus the more network-perimeter-focused version of the exam from a few years ago. If you're studying from older material, double-check it's mapped to 701, not 601, or you'll spend time on deprecated objectives.

Domain 2 Deep Dive — Threats (22%)

Malware types you need cold: ransomware (encrypts data for extortion), rootkits (hide deep in the OS to maintain persistent access), keyloggers (capture keystrokes to steal credentials), and RATs — Remote Access Trojans (give an attacker ongoing remote control of a compromised machine).

Attack vectors show up constantly in scenario-based questions: phishing (email-based social engineering), vishing (voice/phone-based), smishing (SMS-based), watering hole attacks (compromising a site the target is known to visit), and supply chain attacks (compromising a trusted vendor or software dependency to reach the real target indirectly).

Vulnerability types to know by definition: a zero-day is a vulnerability with no available patch, a CVE (Common Vulnerabilities and Exposures) is the standardized identifier assigned to a known vulnerability, and CVSS (Common Vulnerability Scoring System) is the numeric scale used to rate how severe a given vulnerability is.

Expect scenario questions that describe an attack in plain language and ask you to identify which category it falls into — the exam rarely just asks "what is phishing." It's more likely to describe an employee receiving a call from someone claiming to be IT support, requesting a password reset, and ask you to identify that as vishing. Practice recognizing the pattern, not just the definition.

Domain 4 Deep Dive — Security Operations (28%)

The incident response lifecycle is tested repeatedly and in multiple forms — memorize the phases in order: Prepare → Identify → Contain → Eradicate → Recover → Lessons Learned. Questions often describe a scenario and ask which phase you're currently in, so understanding what each phase actually involves matters more than rote memorization of the list.

Log analysis and SIEM (Security Information and Event Management) tools aggregate and correlate log data across an environment to detect suspicious patterns that wouldn't be visible from any single log source alone. EDR (Endpoint Detection and Response) extends this concept to individual devices, monitoring endpoint behavior in real time and enabling rapid isolation of compromised machines. Threat hunting is the proactive counterpart to all of this — actively searching for signs of compromise instead of waiting for an alert to fire.

Also expect coverage of automation and orchestration concepts within this domain — SOAR (Security Orchestration, Automation, and Response) platforms that trigger automated playbooks in response to detected events, reducing the manual workload on analysts during high-volume alert periods. You don't need to configure one for the exam, but you do need to know what problem it solves and why it matters at scale.

Cryptography You Must Know

Symmetric encryption (AES) uses the same key to encrypt and decrypt — fast, efficient, but requires securely sharing that key beforehand. Asymmetric encryption (RSA, ECC) uses a public/private key pair, solving the key distribution problem at the cost of speed.

Hashing — SHA-256 is the current standard for integrity verification; MD5 is deprecated and should never appear as the "correct" choice on the exam when a stronger option is available. PKI (Public Key Infrastructure) ties public keys to verified identities through certificates issued by a trusted Certificate Authority. Understand the basic flow of a TLS handshake — negotiation, certificate exchange, key exchange, and the establishment of a session key. Perfect forward secrecy ensures that even if a long-term private key is later compromised, past session keys can't be derived from it retroactively.

A common trap on this section is confusing encryption with hashing — encryption is reversible (you can decrypt it back to plaintext with the right key), hashing is one-way by design (you should never be able to reverse a hash back into the original input). If a question describes storing passwords, the correct answer involves hashing, not encryption.

Identity and Access Management

Multi-factor authentication is built on three factor categories: something you know (password), something you have (hardware token, phone), and something you are (biometrics). True MFA combines factors from at least two different categories — two passwords is not MFA.

SSO (Single Sign-On) lets a user authenticate once and access multiple systems, typically implemented through protocols like SAML (common in enterprise environments) or OAuth (common for third-party application authorization). Zero trust architecture assumes no user or device is trusted by default, even inside the network perimeter, and verifies every request continuously. Least privilege means granting only the minimum access necessary to perform a role, and PAM (Privileged Access Management) specifically controls and monitors accounts with elevated administrative access.

Know the difference between authentication and authorization — authentication verifies who you are, authorization determines what you're allowed to do once verified. The exam likes to test this distinction directly, often by describing a scenario where a legitimately authenticated user accesses something they shouldn't have permission to reach, which is an authorization failure, not an authentication one.

Study Resources That Actually Work

Professor Messer's free YouTube series is the single most recommended free resource in the Security+ community, and for good reason — it maps directly to the exam objectives. Jason Dion's practice exams on Udemy are widely regarded as closer to real exam difficulty than most competitors. Darril Gibson's Security+ book is a solid dense-but-readable reference for filling in gaps. If you want a more hands-on operations angle, TryHackMe's SOC path reinforces the Security Operations domain with practical labs instead of just theory.

Exam day tips: Watch the performance-based questions (PBQs) at the start of the exam — they're worth the same as multiple choice questions but take far longer, so don't let them eat your entire clock. Flag anything you're unsure about and come back at the end rather than getting stuck early.