SY0-701 incident response: seven steps
Learn this order for SY0-701. SY0-801 replaces it with eight headings, so read our incident response questions with that in mind.
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Lessons learned
Security+ V7 · SY0-701
SY0-701: retirement date, exam objectives and how to practice
SY0-701 is the version of CompTIA Security+® that launched in November 2023, and you can book it in English until June 11, 2027. One honest note first: our question bank is written for SY0-801, so this page shows what SY0-701 shares with it and what you’ll need to study from SY0-701 material.
- English retires Jun 11, 2027
- JA · PT · ES · TH retire Aug 13, 2027
- 28 objectives
- 90 questions · 750 to pass
SY0-701 retirement date
When does SY0-701 retire?
On June 11, 2027 in English, and on August 13, 2027 in Japanese, Portuguese, Spanish and Thai. SY0-801 launches on or around November 17, 2026, in English only at first.
- SY0-801 launches on or around this date, in English only.
- SY0-701 retires in English.
- SY0-701 retires in Japanese, Portuguese, Spanish and Thai.
CompTIA says a voucher isn’t tied to an exam version, so one bought now works for either exam while it’s valid. Book SY0-701 well before its retirement date. Prices and voucher rules are on Security+ exam cost.
SY0-701 domains
SY0-701 domain weights
Five domains, 28 objectives. Each square below is one percent of the exam.
- 12% General Security Concepts · 4 objectives
- 22% Threats, Vulnerabilities, and Mitigations · 5
- 18% Security Architecture · 4
- 28% Security Operations · 9
- 20% Security Program Management and Oversight · 6
SY0-801 moves weight out of Domain 5 (down to 14%) and into Domains 1 and 2, and renames Domain 2 to end “and Attacks”. See SY0-801 vs SY0-701 for every change.
SY0-701 exam objectives
The 28 SY0-701 objectives, and where each lives in SY0-801
Use the last column to find practice for each SY0-701 objective in our SY0-801 domain tests. Seven objectives start with “Given a scenario”.
| SY0-701 | What it covers | In SY0-801 |
|---|---|---|
1.1 | Types of security controls | 1.1 |
1.2 | Fundamental security concepts | 1.1 |
1.3 | Change management and its effect on security | 1.2 |
1.4 | Cryptographic solutions | 1.3 |
2.1 | Threat actors and motivations | 2.2 |
2.2 | Threat vectors and attack surfaces | 2.3 and 2.4 |
2.3 | Types of vulnerabilities | 2.4 |
2.4 | Indicators of malicious activity Scenario | 2.5 |
2.5 | Mitigation techniques | 4.1 |
3.1 | Security implications of architecture models | 3.1 |
3.2 | Securing enterprise infrastructure Scenario | 3.2 |
3.3 | Protecting data | 3.3 |
3.4 | Resilience and recovery | 3.4 |
4.1 | Securing computing resources Scenario | 4.1 |
4.2 | Hardware, software and data asset management | 4.2 |
4.3 | Vulnerability management | 4.3, with threat feeds in 2.1 |
4.4 | Alerting and monitoring | 4.4 |
4.5 | Changing enterprise capabilities to improve security Scenario | 4.1 |
4.6 | Identity and access management Scenario | 4.5 |
4.7 | Automation and orchestration | 4.6 |
4.8 | Incident response | 4.7, with new headings |
4.9 | Data sources for investigations Scenario | 4.8 |
5.1 | Security governance | 5.1 |
5.2 | Risk management | 5.2 |
5.3 | Third-party risk | 5.3 |
5.4 | Security compliance | 5.4 |
5.5 | Audits and assessments | 5.5 |
5.6 | Security awareness Scenario | 5.6 |
SY0-701 vs SY0-801
What SY0-701 shares with SY0-801, and what it doesn’t
Most topics carry over. A set of SY0-701 terms aren’t named in SY0-801, and SY0-801 adds topics SY0-701 doesn’t cover.
Shared core: practice it with our SY0-801 questions
- Security controls and principles
- Change management
- Cryptography basics
- Threat actors
- Threat vectors
- Vulnerabilities
- Attack indicators
- Architecture models
- Data protection
- Resilience and recovery
- Hardening and mitigation
- Asset management
- Vulnerability management
- Alerting and monitoring
- Identity and access
- Automation and orchestration
- Investigation data sources
- Governance
- Risk management
- Third-party risk
- Compliance
- Audits and assessments
- Security awareness
SY0-701 only: study these from SY0-701 material
- TPM, HSM and secure enclaves
- Steganography
- Key stretching
- Blockchain and open public ledgers
- Birthday and collision attacks
- SQL injection and XSS as named types
- VM escape and resource reuse
- Side loading
- Zero Trust control and data planes
- Bollards, fencing and sensors
- SD-WAN, SASE and SDN
- ICS/SCADA, RTOS and embedded systems
- WPA3 and RADIUS
- Site surveys and heat maps
- COPE and CYOD
- ABAC and password vaulting
- DNS filtering, FIM and UBA
- Risk appetite types and KRIs
- About 320 acronyms
SY0-801 only: optional for SY0-701
- AI threats (objective 2.6)
- LLMs as an attack surface
- Agentic AI and guardrails
- Passkeys
- BIMI
- Quishing
- Deepfakes
- MFA bypass
- Fileless malware
- Secrets scanning
- CSPM
- Security Service Edge
- gMSA
- Canary accounts
- IPFIX
- Diamond Model
- RFP, RFI and RFQ
CompTIA says its lists of examples aren’t exhaustive, so either exam can include related topics that aren’t named. These lists come from comparing CompTIA’s two published objective documents.
SY0-701 practice
How to use our practice tests for SY0-701
We don’t offer separate SY0-701 mock tests. Our questions are written to the SY0-801 objectives, and every question shows which one it tests. Used with care, they still cover much of what SY0-701 asks.
-
Study the SY0-701 objectives
Make material written for SY0-701 your main source, including the topics SY0-801 no longer names.
-
Practice the shared core
Use our domain tests and mock tests for shared topics. The objective table above shows where to look.
-
Skip the 801-only questions
Questions tagged 2.6, or on new topics such as passkeys or BIMI, aren’t on SY0-701. Treat them as optional.
-
Read the score loosely
Our estimated score is weighted to SY0-801’s domains, not SY0-701’s, so use it as a rough guide.
Not sure which version to take? Both are open in English until June 11, 2027. See should you take SY0-701 or SY0-801, and the how hard is Security+ guide.
FAQ
SY0-701 questions, answered
When does SY0-701 retire?
SY0-701 retires on June 11, 2027 in English, and on August 13, 2027 in Japanese, Portuguese, Spanish and Thai. Plan to sit the exam well before the date for your language.
Can I still take SY0-701 after SY0-801 comes out?
Yes. SY0-801 launches on or around November 17, 2026, and SY0-701 stays available in English until June 11, 2027, so for about seven months you can book either. CompTIA says a voucher isn’t tied to an exam version.
What are the SY0-701 exam objectives?
SY0-701 has 28 objectives in five domains: General Security Concepts (12%); Threats, Vulnerabilities, and Mitigations (22%); Security Architecture (18%); Security Operations (28%); and Security Program Management and Oversight (20%). Seven of the 28 start with “Given a scenario.”
Do you have SY0-701 guide?
Not separate ones. Our question bank is written for SY0-801, and every question shows its SY0-801 objective. Much of the content overlaps with SY0-701, so our tests are useful practice for the shared topics, but study the SY0-701-only topics from material written for that version.
Should I take SY0-701 or SY0-801?
If you’ve already studied most of the SY0-701 material, finish on SY0-701 before it retires. If you’re starting now, SY0-801 is the version that will stay current longer. Both have up to 90 questions, 90 minutes and a 750 pass mark.
Is SY0-701 easier than SY0-801?
CompTIA doesn’t rate either version as easier. SY0-701 has fewer scenario objectives (seven of 28, against nine of 27) and no AI objective, but a much longer acronym list: about 320 entries against 106. Take the version that matches what you’ve studied.
Practice the shared Security+ core
Our practice bank targets SY0-801; we do not offer a separate SY0-701 mock. Use this version guide and the official objectives to choose material for your booked exam.
