CompTIA Security+ syllabus
Vendor-neutral cybersecurity certification: up to 90 multiple-choice and performance-based questions in 90 minutes, scored 100 to 900, with 750 to pass.
General Security Concepts
About 12% of the exam (11 of 90 on this practice test) · Within the 90 minutes
Domain weight 12% on the Security+ V7 page. This practice test uses 11 questions.
- Compare control types and control functions
- Confidentiality, integrity, availability, non-repudiation, AAA and zero trust
- Change-management implications
- Cryptographic solutions: PKI, encryption, hashing, signatures
Threats, Vulnerabilities, and Mitigations
About 22% of the exam (20 of 90 on this practice test) · Within the 90 minutes
Domain weight 22% on the Security+ V7 page. This practice test uses 20 questions. Items ask you to recognise an activity or choose a mitigation. They do not give attack procedures.
- Threat actors and motivations
- Threat vectors and attack surfaces
- Vulnerability types
- Indicators of malicious activity
- Mitigation techniques
Security Architecture
About 18% of the exam (16 of 90 on this practice test) · Within the 90 minutes
Domain weight 18% on the Security+ V7 page. This practice test uses 16 questions.
- Architecture models, including cloud, IoT, ICS and infrastructure as code
- Enterprise infrastructure and secure access
- Data protection
- Resilience and recovery
Security Operations
About 28% of the exam (25 of 90 on this practice test) · Within the 90 minutes
Domain weight 28% on the Security+ V7 page. This practice test uses 25 questions.
- Secure baselines and hardening
- Vulnerability management
- Monitoring, alerting and security tools
- Identity and access management
- Incident response and investigations
Security Program Management and Oversight
About 20% of the exam (18 of 90 on this practice test) · Within the 90 minutes
Domain weight 20% on the Security+ V7 page. This practice test uses 18 questions.
- Governance documents and roles
- Risk management and business impact analysis
- Third-party risk
- Compliance, privacy, audits and security awareness