CompTIA Security+ SY0-701 distributes its questions across five domains, and those percentages are the most reliable signal for where to invest your study hours. Security Operations alone accounts for 28% of the exam, meaning more than one in four points comes from that single domain. If you study every topic equally, you are spending time in the wrong proportions. The official domain weights let you turn a vague study plan into a budget: allocate hours proportional to exam value, then shift toward your weakest areas.
The current Security+ exam is version 7, coded SY0-701, launched on November 7, 2023, and is approaching its expected retirement in late 2026 as SY0-801 enters development. Until the retirement date is confirmed, SY0-701 remains the active exam that all new candidates take. It consists of a maximum of 90 questions delivered in 90 minutes, combining multiple-choice items with performance-based questions that simulate real technical scenarios. The passing score is 750 on a scale of 100 to 900.
How SY0-701 Domains Are Weighted
CompTIA publishes the exact percentage each domain contributes to the final score. These weights are fixed for the entire lifecycle of SY0-701 and do not change between individual test sittings. Understanding them is the foundation of an efficient study plan, because they tell you which topics generate the most questions.
| Domain | Topic Area | Exam Weight |
|---|---|---|
| 1.0 | General Security Concepts | 12% |
| 2.0 | Threats, Vulnerabilities, and Mitigations | 22% |
| 3.0 | Security Architecture | 18% |
| 4.0 | Security Operations | 28% |
| 5.0 | Security Program Management and Oversight | 20% |
Security Operations (Domain 4) carries the heaviest weight at 28 percent, covering incident response, identity and access management, vulnerability management, monitoring, and enterprise security tooling. Threats, Vulnerabilities, and Mitigations (Domain 2) follows at 22 percent. Together, Domains 2 and 4 account for exactly half the exam, which means half your study hours should protect those two areas before anything else.
Security Operations Demands the Most
Because Security Operations represents the largest single block of exam weight, it deserves disproportionate attention. The domain covers a wide operational surface: secure baselines and hardening, asset management, vulnerability identification and remediation, alerting and monitoring, firewall and IDS or IPS configuration, identity and access controls including single sign-on and multifactor authentication, automation through scripting, and the full incident response lifecycle from detection through root cause analysis and digital forensics.
Performance-based questions tend to cluster here. These items require you to manipulate simulated interfaces — configuring firewall rules, matching indicators of compromise, or ordering incident response steps — rather than simply selecting the correct letter. Because they appear at the start of the exam and consume more time per item than multiple-choice questions, weak performance in this domain compounds: you lose points on the heaviest section and lose time you need for the rest of the exam.
If you are deciding where to begin hands-on lab work, prioritize Security Operations scenarios. Practice configuring access controls, interpreting log entries, and walking through an incident response sequence. These skills translate directly to performance-based questions worth up to 28% of your score. For a structured approach to the full exam, our 2026 IT certification roadmap places Security+ in context alongside networking and cloud credentials.
Converting Weights Into Study Hours
Once you know the domain percentages, you can build a study budget. Assume a 60-hour preparation plan — a common benchmark for candidates with some IT background. Multiply each domain’s weight by 60 to get a baseline allocation, then adjust based on a diagnostic practice test.
| Domain | Weight | Baseline Hours (60-hour plan) |
|---|---|---|
| 1.0 General Security Concepts | 12% | 7 |
| 2.0 Threats, Vulnerabilities, and Mitigations | 22% | 13 |
| 3.0 Security Architecture | 18% | 11 |
| 4.0 Security Operations | 28% | 17 |
| 5.0 Security Program Management and Oversight | 20% | 12 |
These hour counts are a planning model, not a CompTIA requirement. A candidate who already works in a security operations center may need fewer hours on Domain 4 and more on governance and risk management in Domain 5. Conversely, someone transitioning from a non-IT role should front-load Domains 1 and 2 to build vocabulary before tackling operations content. The key is to treat the weights as a default, then deviate based on measured gaps rather than personal comfort.
Prioritize by Gap, Not by Comfort
The most common study mistake is spending the most time on the domain you already understand. Security professionals with hands-on firewall experience often over-study Domain 4 because it feels productive, while avoiding Domain 5 governance topics because they are dry. The result is a lopsided knowledge profile that loses points on lighter but entirely winnable sections.
Run a full-length practice exam early — before you have finished studying. The score breakdown by domain reveals where your gaps actually are. If you score 85% on Security Operations but 55% on Security Program Management, redirect hours from the stronger domain to the weaker one, even though Operations carries more exam weight. You gain more points by lifting a weak domain from failing to passing than by polishing a strong domain from good to excellent.
This gap-driven approach becomes especially important as SY0-701 approaches retirement. CompTIA typically launches a replacement exam and then retires the current version roughly six months later, giving candidates a transition window. If you are starting preparation now and expect to test before the retirement date, SY0-701 materials are mature and widely available — books, video courses, and practice exams have had years of refinement. For details on what the successor exam adds, including AI security coverage, see our SY0-801 strategy guide.
Sources
- CompTIA Security+ Official Certification Page — exam format, domain weights, passing score, and launch date
- Certification Guru — CompTIA Security+ Guide 2026 — exam format and domain study-hour allocation