What is it?

What exactly is the CompTIA Security+?

The baseline cybersecurity certification

CompTIA Security+ is the foundational, vendor-neutral security certification covering threat assessment, cryptography, identity, architecture and incident response. It is an approved baseline for U.S. Department of Defense 8140 roles.

Before you book

Who is eligible to sit the CompTIA Security+?

Who it is for: Entry-level security analysts and administrators

The test itself

What is the format of the CompTIA Security+?

The CompTIA Security+ is administered by Pearson VUE and runs 90 minutes, contains 90 questions and requires 750 of 900 to pass.

Money & time

How much does the CompTIA Security+ cost?

For the CompTIA Security+, the exam fee is $404; the all-in cost is typically $404+; most candidates spend 2–3 months preparing.

The fine print

What are the retake and renewal rules for the CompTIA Security+?

Proctoring & delivery

Delivered by Pearson VUE with two options: an in-person proctored test center, or online proctoring via OnVUE with a live remote proctor (requires webcam, stable internet, and a private room).

Retake policy

If you do not pass, you may retake XK0-006 after a 14-day waiting period. Each attempt requires a new exam voucher; there is no limit on the number of retakes. CompTIA's standard candidate agreement governs retake rules.

Score reporting

A pass/fail result is shown on screen immediately after the exam. A detailed score report by domain is available in your Pearson VUE account and mirrored in your CompTIA CertCentral record.

Recertification

Linux+ is valid for 3 years from the certification date. Renew by earning 50 Continuing Education (CE) credits and paying the CE fee through CompTIA CertCentral, by earning a higher-level CompTIA certification, or by passing the current XK0-006 exam again.

Refunds & rescheduling

Exam vouchers are generally non-refundable but may be transferable or have a defined expiry; optional CertMaster training may be refundable within a limited window per CompTIA's terms. Review voucher terms at purchase.

What it pays

How much does this credential pay?

$124,910 median for information security analysts (BLS, May 2024)

The Bureau of Labor Statistics has no occupation literally called "Security+ holder", and no government wage series tracks a certificate, so any salary page that attributes a figure to the certification itself is quoting a job-board aggregate rather than official data. The closest official occupation to the role Security+ prepares you for is Information Security Analysts, SOC 15-1212, and we have used it deliberately: Security+ is the baseline DoD 8570 compliance credential for many security roles, and the analyst occupation is where its holders most often land. That occupation had a May 2024 median annual wage of $124,910, with the lowest 10 percent under $69,660 and the highest 10 percent over $186,420. The spread is worth reading because Security+ sits at the entry of a steep curve: a first analyst or compliance role lands toward the lower end, while the same credential paired with a few years of operations experience and a higher cert moves you decisively toward the top decile. The occupational tailwind here is the strongest of any exam covered on this site and should be stated plainly. BLS projects 29 percent growth for information security analysts from 2024 to 2034 — far faster than the average for all occupations — with about 16,000 openings a year arising from both growth and replacement. The driver is not abstract: every organisation that stores data and faces a regulatory regime now carries a security headcount, and the federal 8570 / 8140 directive that names Security+ as an approved baseline for many contractor and military roles keeps demand structurally high. What the median does not capture is geography and clearance: a cleared analyst in a high-cost region sits well above the national median, and Security+ is frequently the gate to those cleared roles. We have not quoted a job-board aggregate here because it does not isolate Security+ holders and would not be comparable to the BLS figure.

Job growth.+29% projected change 2024-34 (much faster than average), with ~16,000 openings a year; DoD 8570/8140 baseline compliance keeps structural demand high

Source: BLS Occupational Outlook Handbook — Information Security Analysts

Your schedule

How long should I study for it?

80-110 hours of focused study

The first thing to establish is which exam you are actually studying for. The current version is SY0-701, the seventh iteration of Security+, which launched on 7 November 2023. CompTIA typically retires an exam version about three years after launch, so SY0-701 is expected to be retired around late 2026; a next version (widely referred to as SY0-801) was in development as of our review, but its exact preview and general-availability dates were not finalised and should be confirmed at the CompTIA site before you commit to a study window. Do not buy material for an older version — and note that SY0-601 was retired earlier and any SY0-601 book still on sale is now superseded. The current SY0-701 domain weightings are General Security Concepts 12 percent, Threats, Vulnerabilities and Mitigations 22 percent, Security Architecture 18 percent, Security Operations 28 percent, and Security Program Management and Oversight 20 percent. Notice that Security Operations and Program Management together are 48 percent of the paper — this is an operations and governance exam more than a hacker exam, and candidates who over-index on offensive tooling misread it. The plan below runs eight weeks at roughly 10-12 hours a week and assumes you have a way to run a couple of virtual machines so the performance-based items are not your first taste of a real tool. If you have never touched a hypervisor, sort that out before Week 1; Security+ has performance-based questions that put you in front of a tool, and reading about a port scan is not the same as running one.

1. Week 110-12 hrs

   Domain 1 — General Security Concepts (12%)

   • CIA triad, non-repudiation, and the difference between confidentiality, integrity and availability in practice
   • Authentication, authorisation and accounting; the factor types and what makes a strong MFA design
   • Security frameworks and control types — prevent, detect, respond, and the difference between a control and a framework
   • Zero trust, supply-chain and the vocabulary CompTIA expects you to use precisely
2. Weeks 2-311-13 hrs/week

   Domain 2 — Threats, Vulnerabilities and Mitigations (22%)

   • Threat actors and their motivations, attack vectors, and the kill chain / MITRE ATT&CK framing
   • Common vulnerabilities — injection, XSS, overflows — at a conceptual level, and how each is mitigated
   • Malware categories and social-engineering types, and the controls that counter each
   • Vulnerability scanning versus penetration testing, and the basics of a risk assessment
3. Week 410-12 hrs

   Domain 3 — Security Architecture (18%)

   • Security architectures for networks, cloud and on-prem, and the differences between IaaS, PaaS and SaaS responsibilities
   • Key management, PKI, certificates and the trust models behind them
   • Secure application development concepts and the secure-by-design vocabulary
   • Physical security controls and the human-side controls around them
4. Weeks 5-611-13 hrs/week

   Domain 4 — Security Operations (28%)

   • Monitoring with logs, SIEM, SOAR and the difference between them
   • Incident response: the lifecycle from identification through eradication and lessons learned
   • Digital forensics basics and evidence handling
   • Vulnerability management and the hands-on tools — run an actual scan and read the output in your lab
5. Week 710-12 hrs

   Domain 5 — Security Program Management & Oversight (20%)

   • Governance, risk and compliance: policies, standards, laws and regulations
   • Third-party risk, vendor assessment and the shared-responsibility model
   • Security awareness training and the human element as a control
   • Business continuity, disaster recovery and the difference between the two plans
6. Week 810-12 hrs

   Performance-based rehearsal and timed exams

   • Timed tasks with real tools: read a PCAP, configure a firewall rule, match a control to a framework
   • Three full 90-minute practice exams weighted to the five current domains
   • Re-lab every miss rather than re-reading the explanation
   • Final pass over the operations and program-management domains, which together are 48 percent of the paper

What to buy

Which study resources are worth paying for?

The buying decision is which version, then whether to pay for CompTIA’s own bundles that add labs and a retake to the voucher. SY0-601 material is still widely listed and still ranks in search; anything you buy must say SY0-701. The voucher price is the firm reference point — about $439 at the US list in 2026, with a retake-assurance bundle around $579 — and resellers and sales move the effective price.

Prices checked 2026-08 in USD before tax; the ~$439 voucher is CompTIA’s US list and the firm reference, while Udemy and bundle prices swing with promotion. We do not rank by commission.

What you'll face

What question types will I see?

A maximum of 90 questions in 90 minutes, in English, scored on a 100-900 scale with a 750 cut. The paper mixes multiple choice — single-answer and multiple-response — with performance-based questions that put you in front of a tool or a simulated environment and ask you to complete a task. PBQs are typically presented at the start and weighted more heavily than individual multiple-choice items, but you may skip them and return, so the presented order is not the order you should work in. The five current domains are General Security Concepts (12%), Threats, Vulnerabilities and Mitigations (22%), Security Architecture (18%), Security Operations (28%) and Security Program Management and Oversight (20%). Because CompTIA equates forms, your scaled score is not a percentage of items correct and cannot be converted into one — which is why we have not quoted a pass rate. The practical implication for pacing is simple: multiple-choice items should average well under a minute so the PBQs, which can consume several minutes each, have time to breathe.

Samples are editor-written illustrations of the published blueprint, not live exam items.

Reference

What are the key facts about the CompTIA Security+?

CompTIA Security+ is a certification credential; awarded by CompTIA; the exam fee is $404; typical preparation is 2–3 months; holders typically earn $60,000 – $95,000.

In short

Is the CompTIA Security+ worth it?

• Security+ is the baseline vendor-neutral security cert.
• It is required for many DoD 8140 roles.
• It leads toward CySA+, PenTest+ and CISSP.

Worth comparing

How does the CompTIA Security+ compare with similar credentials?

• CompTIA Network+ CompTIA
• CompTIA Cybersecurity Analyst (CySA+) CompTIA

Trust

Where does this information come from?

Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.

• CompTIA Awarding body
• Official CompTIA Security+ exam page Exam page
• CompTIA certification programme Programme rules

Research confidence: high · Last reviewed 2026-08