CompTIA Security+ (SY0-701) — the full course

This course teaches SY0-701, which can be taken until 11 June 2027. Its successor, SY0-801, launches on or around 17 November 2026; if you are booked on SY0-801, use our SY0-801 course instead.

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 730-question exam simulator; nothing is taken away from the free course to make room for it.

Prefer a book? The 550-question practice-test book is on Amazon in paperback and for Kindle, and as an ebook on Google Play.

Prefer timed practice exams on Udemy? The 550 questions from this course’s bank are there as timed practice tests: see the Udemy course (launch price until 16 Nov 2026).

Free for the first 100 learners this month: take the same Udemy practice tests free, until 20 Nov 2026 or until the places are taken.

If the tests help you, a rating on Udemy helps other learners find them.

8 lessons end with a short “try it” on a real Linux server that runs in your browser and checks each step, and the Linux sandbox gives you that machine with no task at all.

47written lessons

79hands-on labs

76hours of lab work

47audio episodes

730practice questions

Start with lesson 1 — Security controls: the four categories and the six types Exam simulator

Jump to a domain: 1. General Security Concepts · 2. Threats, Vulnerabilities, and Mitigations · 3. Security Architecture · 4. Security Operations · 5. Security Program Management and Oversight

What the exam weighs

Domain	Share of the exam	Lessons here
1. General Security Concepts	12%	6
2. Threats, Vulnerabilities, and Mitigations	22%	10
3. Security Architecture	18%	8
4. Security Operations	28%	13
5. Security Program Management and Oversight	20%	9

The curriculum

1. General Security Concepts 12% of the exam

01 Security controls: the four categories and the six types objective 1.1 part single
- Write a compensating control that an auditor would accept applied · 75 min
- Classify the controls already running on your own machine short · 30 min
02 CIA, AAA and non-repudiation, stated precisely enough to be useful objective 1.2 part single
- Produce something only you could have produced short · 30 min
03 Zero trust, and the deception technology that sits beside it objective 1.2 part single
- Shrink an implicit trust zone and measure the difference applied · 80 min
- Plant a honeyfile and prove the alert fires short · 35 min
04 Change management, which is a security control and is examined as one objective 1.3 part single
- Detect drift from a baseline you recorded yourself applied · 70 min
- Write the change record for a change you actually make short · 30 min
05 PKI, encryption and the key management that decides whether any of it works objective 1.4 part single try it
- Build a two-tier certificate chain and break it on purpose short · 40 min
06 Hashing, digital signatures, obfuscation and blockchain objective 1.4 part single try it
- Tell tokenisation, masking and encryption apart by what survives applied · 75 min
- Sign a release, distribute it, and detect a tampered copy capstone · 120 min
- Show what salting changes and what it does not short · 30 min

2. Threats, Vulnerabilities, and Mitigations 22% of the exam

01 Threat actors, sorted by what they can afford rather than by how scary they sound objective 2.1 part single
- Sort five real incidents by what the actor could afford short · 30 min
02 Motivations, shadow IT, and the threat that already has a badge objective 2.1 part single
- Build the leaver checklist by finding what you would have missed applied · 70 min
- Find the shadow IT your own DNS log already knows about short · 35 min
03 Message, voice and file-based vectors, and the social engineering behind them objective 2.2 part single
- Read the headers and decide whether the sender is real short · 35 min
04 Unsecure networks, supply chain, and the software you did not write objective 2.2 part single
- Answer 'are we affected?' from a bill of materials applied · 75 min
- Count your own attack surface, then reduce it short · 35 min
05 Application, web and operating-system vulnerabilities objective 2.3 part single
- Watch a race condition happen, then close it short · 40 min
06 Hardware, mobile, virtualisation, cloud and supply-chain vulnerabilities objective 2.3 part single
- Write the compensating control for a device that can never be patched applied · 80 min
- Find the shared responsibility line for three services short · 30 min
07 Recognising malware by the evidence it leaves objective 2.4 part single try it
- Detect a beacon by its regularity, not its content short · 40 min
08 Password and cryptographic attacks, and the controls that end them objective 2.4 part single
- Tell spraying and brute force apart in your own auth log short · 40 min
09 Network, application and physical attack indicators objective 2.4 part single
- Build a timeline from three sources that disagree about time applied · 80 min
- Name the attack from the log line short · 35 min
10 Mitigation techniques, chosen for the vulnerability in front of you objective 2.5 part single
- Match each mitigation to the vulnerability it actually closes applied · 75 min
- Take one lab VM from default install to defended, and measure every step capstone · 130 min
- Show an allow list stopping what a deny list cannot short · 40 min

3. Security Architecture 18% of the exam

01 On-premises, cloud and virtualisation, compared by where the risk lands objective 3.1 part single
- Show what a shared kernel shares short · 35 min
02 IoT, ICS/SCADA, embedded systems and infrastructure as code objective 3.1 part single
- Make the insecure configuration impossible to deploy applied · 80 min
- Break your own air gap four ways on paper short · 30 min
03 Device placement, security zones and attack surface objective 3.2 part single
- Prove a sensor is blind to the traffic you care about short · 40 min
04 Firewalls, appliances and selecting the control that fits objective 3.2 part single
- Make a firewall rule fail by putting it in the wrong place short · 35 min
05 Secure communication and access: VPN, tunnelling and remote work objective 3.2 part single
- Choose an access method against a constraint that rules things out applied · 75 min
- Watch what a tunnel hides and what it does not short · 40 min
06 Data types, classification, and the protection each class earns objective 3.3 part single
- Build the data inventory that a subject access request needs applied · 80 min
- Protect the same field in three states and find the gap short · 40 min
07 High availability, site resilience and power objective 3.4 part single
- Measure a failover instead of assuming it short · 40 min
08 Backups, testing, and continuity of operations objective 3.4 part single
- Show that a snapshot is not a backup applied · 70 min
- Run a recovery exercise against a stated RTO and RPO capstone · 140 min
- Restore from a backup and time it short · 45 min

4. Security Operations 28% of the exam

01 Secure baselines, and hardening the targets that appear on the exam objective 4.1 part single try it
- Make the baseline reapply itself applied · 75 min
- Apply a published benchmark and count what it changed short · 45 min
02 Wireless, mobile deployment, application security and sandboxing objective 4.1 part single
- Break an application with input it did not expect short · 40 min
03 Asset management, from purchase order to certificate of destruction objective 4.2 part single
- Prove data is gone, three ways, with evidence applied · 80 min
- Find the assets your inventory does not know about short · 40 min
04 Vulnerability management, end to end objective 4.3 part single
- Prioritise a finding list that the severity column gets wrong applied · 80 min
- Show a false negative appearing between two scans short · 40 min
05 Alerting and monitoring, and the tools CompTIA names objective 4.4 part single
- Forward the logs off the host before you need them applied · 75 min
- Write an alert, then tune it until it is worth reading short · 45 min
06 Modifying firewalls, IDS/IPS and the filtering layers objective 4.5 part single try it
- Block a name before the connection is made short · 40 min
07 DLP, NAC, EDR/XDR and email security objective 4.5 part single
- Catch a process tree that every binary in it is signed applied · 80 min
- Publish SPF, DKIM and DMARC and check they agree short · 45 min
08 Provisioning identity, single sign-on and federation objective 4.6 part single
- Show permission creep happening in one afternoon short · 40 min
09 Multifactor authentication, password concepts and privileged access objective 4.6 part single try it
- Remove standing privilege and measure what is left applied · 80 min
- Make a credential that expires before it can be reused short · 40 min
10 Automation and orchestration, and when not to automate objective 4.7 part single
- Build a guard rail, then try to get a bad change past it applied · 75 min
- Automate the enrichment and leave the decision alone short · 40 min
11 The incident response process, and the preparation that decides the outcome objective 4.8 part single try it
- Run a tabletop and find the decision nobody owns short · 45 min
12 Root cause analysis, threat hunting and digital forensics objective 4.8 part single
- Hunt from a hypothesis and leave a detection behind applied · 80 min
- Capture memory before you lose it short · 45 min
13 Reading log data and other sources to support an investigation objective 4.9 part single try it
- Discover what you cannot answer, and fix the collection applied · 80 min
- Investigate an incident you staged a week ago capstone · 150 min
- Build a timeline from five sources and write the finding short · 50 min

5. Security Program Management and Oversight 20% of the exam

01 Governance structures, and who is allowed to decide objective 5.1 part single
- Assign every decision in an estate to somebody who can make it short · 35 min
02 Policies, standards, procedures and guidelines, and the difference between them objective 5.1 part single
- Run a gap analysis against a standard you did not write applied · 80 min
- Split one requirement across all four document levels short · 35 min
03 Risk identification, assessment and analysis objective 5.2 part single
- Do the arithmetic until the units stop catching you out short · 30 min
04 The risk register, appetite, response strategies and business impact objective 5.2 part single
- Derive RTO and RPO from the business, then check you can meet them applied · 80 min
- Write a risk register entry somebody can actually act on short · 35 min
05 Third-party risk: assessing and selecting a vendor objective 5.3 part single
- Write a questionnaire whose answers you could check short · 35 min
06 Agreements, and monitoring a vendor after the ink dries objective 5.3 part single
- Build the vendor register and find the one nobody owns applied · 75 min
- Match the agreement to the relationship short · 30 min
07 Compliance, privacy, and the cost of getting it wrong objective 5.4 part single
- Answer an access request and a deletion request from real data applied · 80 min
- Build the obligations register you are measured against short · 35 min
08 Audits, assessments and where penetration testing fits objective 5.5 part single
- Audit your own estate and track the findings to closure applied · 80 min
- Assess the whole programme and report it to a board capstone · 150 min
- Write rules of engagement somebody could work to short · 35 min
09 Security awareness that changes behaviour rather than completion rates objective 5.6 part single
- Design a phishing campaign you could defend to HR applied · 80 min

Supplementary not examined — background reading

01 A lab you can break safely, and why your laptop is not it part single
- Prove the isolation before you trust it short · 35 min

The exam simulator

730 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

Every lesson has an audio episode, and it plays in the lesson itself — there is nothing extra to sign up for.

The episodes are also a podcast: listen on Spotify.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.