Full exam simulation
90 questions · 90 minutes, 0 unscored and not identified. One question per screen, flag and strike-out, a review screen and a score report per domain — no answers until you finish.
CompTIASY0-701AssociateSecurity · Core · V7Available
CompTIA Security+
Core security skills: threats and mitigations, security architecture, operations, and governance, risk and compliance.
Independent practice — not affiliated with or endorsed by CompTIA. SY0-701 is used only to identify the exam. Trademark notices
English version retires June 11, 2027; CompTIA has announced Security+ V8.
Domain weights
Share of scored content per domain. Every sitting draws questions by these weights.
- D1General Security Concepts12 %14 concepts
- D2Threats, Vulnerabilities, and Mitigations22 %25 concepts
- D3Security Architecture18 %19 concepts
- D4Security Operations28 %30 concepts
- D5Security Program Management and Oversight20 %22 concepts
Your progress
No attempts yet. Take a full sitting to get a readiness rating; results are kept in this browser. Join your class to keep them on every device.
Choose a mode
ESL +30
The full sitting with 30 extra minutes (120 min) — the accommodation non-native English speakers can request for exams in English.
Quick 20
20 questions · 20 min, same weights, all scored. A daily check.
Weak spots
20 questions aimed at your weakest domains, missed concepts and due reviews.
Practice builder
Pick domains, topics, how many questions and which pool (new, wrong, due, low confidence). Spaced repetition with confidence ratings, flashcards and a mistake book.
Open practiceDomain drill
One domain, up to 20 questions.
What's on the exam
Domain 1: General Security Concepts
12 %Security controls, CIA and AAA, zero trust, change management and cryptographic solutions.
Practice domain 1 →Domain 2: Threats, Vulnerabilities, and Mitigations
22 %Threat actors and vectors, vulnerabilities, malicious activity and mitigation techniques.
Practice domain 2 →Domain 3: Security Architecture
18 %Architecture models, enterprise infrastructure, data protection, resilience and recovery.
Practice domain 3 →Domain 4: Security Operations
28 %Hardening, asset and vulnerability management, monitoring, IAM, automation and incident response.
Practice domain 4 →Domain 5: Security Program Management and Oversight
20 %Governance, risk management, third-party risk, compliance, audits and security awareness.
Practice domain 5 →
Domain names and weights come from the official SY0-701 exam objectives (checked 2026-10-26). Always check it for the authoritative scope.
The real exam also has performance-based questions; the simulator uses multiple-choice only.
Sources · checked 2026-10-26
Sample questions
Two of this exam's original questions, with the explanation you get after every answer.
Sample 1Select one
A company publishes a security awareness policy and requires annual risk assessments. Which control category do these belong to?
- AOperational
- BManagerial
- CTechnical
- DPhysical
Show answer & explanation
Correct: B. Managerial (administrative) controls are policies, procedures, risk assessments and planning that direct how security is managed. Technical controls are implemented in systems, physical controls protect facilities, and operational controls are day-to-day activities carried out by people, such as guards or awareness training delivery.
Sample 2Select 2
Which pairings of control type and example are correct? (Select TWO.)
- ACorrective: restoring files from backup after ransomware
- BPreventive: a CCTV camera that records an intrusion
- CDeterrent: a firewall rule that blocks a port
- DDetective: an IDS that alerts on suspicious traffic
- EDirective: an antivirus quarantine
Show answer & explanation
Correct: A, D. An IDS detects and alerts, and restoring from backup corrects the impact of an incident. A recording camera is detective (a visible camera can also deter), a blocking firewall rule is preventive, and a directive control is something like a policy or sign telling people what to do.