CompTIA Security+

Security+ changed everything for me. Before I passed it, I was just someone who liked computers and thought hacking was cool. After I passed it, I had a credential that hiring managers actually recognized. It was my ticket into cybersecurity, and for a lot of people reading this, it might be yours too.

I remember sitting in my car after the exam, staring at the printout that said I passed, thinking about how different my life was going to be. That sounds dramatic, but it’s true. Security+ opened doors that had been closed to me because I didn’t have a degree or connections in the industry. If you’re self-taught, a career changer, or just trying to prove you know what you’re doing, this cert is the starting line.

What Is CompTIA Security+?

Security+ is a vendor-neutral certification that covers foundational cybersecurity concepts. It’s recognized globally and often listed as a baseline requirement in job postings for security analysts, SOC analysts, network administrators, and IT auditors. It’s also approved by the U.S. Department of Defense under the 8570/8140 directive, which means federal contractors and government agencies accept it for certain job roles.

CompTIA positions Security+ as the first security-focused certification you should earn. They recommend having Network+ or two years of IT experience first, but plenty of people start with Security+ and figure out the networking stuff along the way. I wouldn’t recommend that approach—networking fundamentals help a lot—but it’s possible if you’re motivated.

What Does the Exam Cover?

The current exam is SY0-701, released in late 2023. It covers five domains that map to real-world security work:

General Security Concepts (12%) – This covers the basics: security controls, fundamental concepts like the CIA triad, and the different types of security frameworks you’ll encounter in the field.

Threats, Vulnerabilities, and Mitigations (22%) – The largest domain. You need to understand different attack types, threat actors, vulnerability categories, and how to mitigate them. Malware, social engineering, application attacks, and network-based threats all live here.

Security Architecture (18%) – This is about designing secure systems. Network architecture, cloud models, secure infrastructure design, and concepts like zero trust. You’ll need to understand how to build things securely, not just defend them.

Security Operations (28%) – The other big domain. Monitoring, incident response, vulnerability management, alerting, and automation. This is the day-to-day work of a security operations center.

Security Program Management and Oversight (20%) – Governance, risk management, compliance, security policies, and awareness training. Less technical, but important for understanding how security fits into an organization.

The CIA Triad: Your New Best Friend

If there’s one concept you’ll see over and over in Security+, it’s the CIA triad. No, not that CIA. Confidentiality, Integrity, and Availability. These three principles are the foundation of information security, and almost every other concept in the exam ties back to them.

Confidentiality means keeping data away from people who shouldn’t see it. Encryption, access controls, and authentication all support confidentiality. Integrity means making sure data hasn’t been tampered with. Hashing, digital signatures, and checksums protect integrity. Availability means making sure systems and data are accessible when needed. Redundancy, backups, and disaster recovery support availability.

When you’re stuck on a question, think about which part of the CIA triad it’s addressing. That mental framework saved me more than once on exam day.

Who Should Get Security+?

Security+ is for anyone trying to break into cybersecurity. It doesn’t matter if you’re coming from help desk, network administration, software development, or a completely different field. If you want to work in security and you don’t have a certification yet, this is where you start.

It’s also valuable if you’re already in IT but want to specialize. A lot of system administrators, network engineers, and developers get Security+ to round out their skills and open up hybrid roles that involve security responsibilities.

If you’re going after government or defense contractor jobs, Security+ is often mandatory. The DoD 8570/8140 framework requires it for certain Information Assurance Technical (IAT) Level II positions. That’s not a suggestion—it’s a job requirement.

Exam Details

The passing score is higher than Network+, and the material is denser. Expect to study longer and take more practice exams before you’re ready.

How I Passed Security+

I studied for about two months, putting in an hour or two most days and longer sessions on weekends. Here’s the approach that worked for me.

Video courses first. Professor Messer has a free SY0-701 series on YouTube that follows the exam objectives exactly. I watched every video, took notes, and rewatched sections that didn’t click the first time. For concepts I really struggled with, I looked up other explanations on YouTube until something made sense.

I made flashcards for terms, acronyms, and port numbers. Security+ throws a lot of terminology at you—SIEM, SOAR, IDS, IPS, EDR, XDR, MDR—and you need to know what each one means and how they differ. Anki was my tool of choice. Fifteen minutes every morning, no exceptions.

Practice exams were the backbone of my prep. I used Dion Training and Jason Dion’s practice tests. I didn’t schedule my real exam until I was consistently hitting 85% or higher. When I got questions wrong, I didn’t just read the explanation—I went back to my notes and made sure I understood the underlying concept.

For hands-on learning, I set up a home lab with VirtualBox. I installed Kali Linux and played around with tools like Nmap, Wireshark, and Metasploit. Security+ doesn’t require hands-on skills to pass, but actually seeing how these tools work helped me understand the concepts better than reading about them ever could.

I also used the NIST Cybersecurity Framework documentation to understand how security concepts apply in real organizations. It’s dry reading, but it’s the same framework that shows up on the exam and in real-world security programs.

Test Day Tips

The performance-based questions come first. Don’t let them throw you off. If you don’t know one, flag it and move on. You can come back at the end. I spent too long on a firewall configuration question and had to rush through the back half of the test.

Watch out for tricky wording. CompTIA loves questions where two answers seem correct. Look for words like “BEST,” “FIRST,” “MOST,” and “LEAST.” The right answer isn’t always the one that would work—it’s the one that fits what they’re specifically asking for.

Manage your time. Ninety minutes feels like plenty until you hit question 50 and realize you’ve used an hour. I practiced with a timer so the pressure wouldn’t be a surprise.

Trust your preparation. If you’ve been scoring above 85% on practice tests, you’re ready. Don’t cram the night before. Get some sleep, eat breakfast, and walk into that testing center knowing you’ve done the work.

What Comes After Security+?

Security+ is a launching pad, not a destination. Once you have it, you’ve got options depending on where you want to go.

If you want to stay on the defensive side and move into analyst roles, CySA+ is the natural next step. It builds directly on Security+ and goes deeper into threat detection, monitoring, and incident response.

If offensive security interests you, PenTest+ or CEH are common choices. They focus on ethical hacking, vulnerability assessment, and penetration testing methodologies.

For cloud-focused roles, look at AWS Security Specialty, Azure AZ-500, or CCSP. Security+ gives you the foundation, and cloud certs let you specialize.

If you’re on the DoD/government track and want to move up, CASP+ (now called SecurityX) is the advanced CompTIA option, and CISSP is the industry standard for senior security roles.

Security+ is proof that you understand the fundamentals. Now pick a direction and keep building.

Jenna Carson

Self-taught security pro. No degree, just certs, labs, and a lot of late nights.