CompTIA Security+ Study Plan: An 8-Week Roadmap From Baseline to Exam Day

8 min read ยท 2026-10-13

A good comptia security+ study plan follows the five official exam domains, gives the most time to the heaviest ones, and ends with timed practice. This roadmap runs 8 weeks at 8 to 10 hours a week and assumes you already know basic networking. If ports, subnets and the OSI model are new to you, add 2 to 4 weeks of networking basics first, for 10 to 12 weeks in total.

The plan is built for the SY0-701 version of the exam (Security+ V7). According to CompTIA's Security+ V7 page, read on October 13, 2026, its five domains are General Security Concepts (12%), Threats, Vulnerabilities and Mitigations (22%), Security Architecture (18%), Security Operations (28%) and Security Program Management and Oversight (20%). The exam has a maximum of 90 questions in 90 minutes, mixes multiple-choice and performance-based questions, and has a passing score of 750 on a scale of 100 to 900.

The roadmap at a glance

Goal: Pass the CompTIA Security+ exam on the first attempt. Duration: 8 weeks, about 8 to 10 hours a week

  1. Baseline and Setup (Week 1)

    Find out where you start and turn the official objectives into your study list.

    • Download the exam objectives PDF for your version from CompTIA.
    • Take one full practice test cold, with no studying, and write down your score per domain.
    • Pick one main course or study guide that follows the objectives in order, and one practice test bank with explanations.
    • Turn each objective section into one study session in your calendar.
    • Start a flashcard deck for acronyms, ports and protocols.

    Milestone: Baseline score recorded per domain and every objective section scheduled.

  2. General Concepts and Threats (Weeks 2-3)

    Cover Domains 1 and 2, the language of the whole exam.

    • Learn security control types, the CIA triad, AAA, zero trust and change management.
    • Study cryptography: hashing, encryption, PKI, digital signatures and certificates.
    • Study threat actors, threat vectors, malware, password attacks and application attacks.
    • Learn the matching mitigation for each attack: segmentation, hardening, isolation, patching.
    • End each week with a 30-question quiz on the domains you covered.

    Milestone: 75% or more on a quiz mixing Domains 1 and 2.

  3. Security Architecture (Week 4)

    Understand how secure systems and networks are designed.

    • Compare on-premises, cloud, virtualization, IoT, ICS and infrastructure as code.
    • Learn where firewalls, VPNs and secure protocols sit in an enterprise network.
    • Cover data protection: data types, classification, encryption at rest and in transit.
    • Review resilience and recovery: high availability, site considerations, backups.

    Milestone: You can draw a network from memory and explain why each control sits where it does.

  4. Security Operations (Weeks 5-6)

    Give the biggest domain two full weeks, because it carries the most weight.

    • Study identity and access management: provisioning, MFA, SSO and privileged access.
    • Learn vulnerability management, from scanning to remediation and reporting.
    • Work through incident response steps in order, plus digital forensics basics.
    • Practice reading logs and alerts from firewalls, endpoints and IDS/IPS.
    • Do at least 10 performance-based practice questions, timed.

    Milestone: 75% or more on a Domain 4 quiz and every performance-based question finished within your time limit.

  5. Program Management and Oversight (Week 7)

    Cover governance, risk and compliance, the domain technical learners often underrate.

    • Learn the difference between policies, standards, procedures and guidelines.
    • Study risk terms: register, tolerance, appetite, business impact analysis.
    • Cover third-party risk, audits, penetration testing and security awareness.
    • Take your first full timed practice test at the end of the week.

    Milestone: First full practice test done and every wrong answer logged with its objective number.

  6. Final Review and Exam Day (Week 8)

    Close the gaps and walk into the exam calm.

    • Take two more full timed practice tests, on separate days.
    • Spend most of your time on the objectives in your wrong-answer log.
    • Redo every performance-based question you got wrong until you can do it without help.
    • Book the exam only once you meet the readiness checks below.
    • The day before, review flashcards for one hour and stop.

    Milestone: Readiness checks met and the exam booked.

SY0-701 or SY0-801: Pick Your Version First

CompTIA is changing versions soon. Its site lists the new Security+ V8 (exam code SY0-801) with a launch date of November 17, 2026. The English SY0-701 exam retires on June 11, 2027. Japanese, Portuguese, Spanish and Thai retire on August 13, 2027.

Choose your version before you buy anything. The question count, time limit and passing score are the same for both versions on CompTIA's pages.

  • You plan to test before June 11, 2027: SY0-701 works. Follow this plan as written.
  • You plan to test later: prepare for SY0-801 and use its own objectives PDF. CompTIA's V8 page gives different weights: General Security Concepts 16%, Threats, Vulnerabilities and Attacks 24%, Security Architecture 19%, Security Operations 27%, Security Program Management and Oversight 14%. The same 8-week structure works, but adjust the hours to those weights.

Turn the Objectives PDF Into Your Study System

The objectives PDF is more than a topic list. Each numbered section, from 1.1 onward, becomes one session in your calendar and one line in your tracker. You tick a section off only when you have made something with it. Give each domain one concrete output, as listed below.

Give the hours to the weights. On SY0-701, Security Operations and Threats make up half of the exam, so they get the most sessions. General Security Concepts comes first anyway, because it gives you the words used everywhere else.

If a week goes badly, cut new content, never the practice questions. They are what tell you whether you are ready.

  • 1. General Security Concepts: a one-page sheet of control types and crypto methods, each with an example. Many questions turn on picking the right control type.
  • 2. Threats, Vulnerabilities and Mitigations: a table of each attack, how to spot it and its mitigation. Scenario questions ask for the fix, not just the attack name.
  • 3. Security Architecture: a labeled network diagram drawn from memory. Placement questions ask where a control belongs.
  • 4. Security Operations: incident response steps in order, plus five sample log lines you can explain. This matches the log and ordering tasks of PBQs.
  • 5. Program Management and Oversight: a glossary of governance and risk terms in your own words. These terms look alike and are easy to mix up.

How to Prepare for Performance-Based Questions

Performance-based questions, often called PBQs, ask you to do something instead of picking an answer. You might match attacks to controls, put firewall rules in order, or read a log and choose the right response. They take longer than multiple-choice questions.

Start them in Week 5, not in the last few days.

  • Practice matching: attacks to mitigations, ports to protocols, controls to categories.
  • Read real-looking logs and practice spotting the line that matters.
  • Set a time limit per PBQ so one hard question cannot eat your whole exam.
  • On exam day, a common tactic is to flag a PBQ that stalls you, answer the multiple-choice questions, then come back with the time left.

How to Know You Are Ready to Book the Exam

Readiness is a pattern in your scores, not a feeling. Your Week 1 baseline shows your starting point, your domain quizzes show progress, and your full tests in Weeks 7 and 8 show whether you can hold that level for 90 minutes. The plan targets the checks below before you book.

If you miss one check, add one week focused on that gap, then test again. Booking a date first can keep you motivated, but check the rescheduling rules of your testing provider before you pick one.

  • Two full timed practice tests in a row at 80% or more.
  • No domain below 70% on your last practice test.
  • Every objective in the PDF ticked off, with an output you could explain to someone else.
  • PBQs finished inside your time limit.

Common mistakes to avoid

  • Memorizing acronyms without context. Learn each term with one example of when you would use it.
  • Spreading time evenly across domains. Give the most hours to the heaviest domains of your exam version.
  • Leaving PBQs for the last week. Start timed PBQ practice in Week 5.
  • Collecting too many resources. One course, one question bank and the objectives PDF are enough. Add a resource only to fix one specific gap.
  • Retaking the same practice test until you remember the answers. Review why each answer is right and rotate between different tests.
  • Studying for the wrong version. Check the exam code and retirement date on the CompTIA site before you start.

Frequently asked questions

How long does it take to study for Security+?

This plan uses 8 weeks at 8 to 10 hours a week, for someone who already knows basic networking. Without that base, add 2 to 4 weeks of networking first, for 10 to 12 weeks in total. If you already work in IT, use your baseline test to find the domains you can shorten, but keep every practice test.

Should I study for SY0-701 or SY0-801?

It depends on your test date. CompTIA lists SY0-801 launching on November 17, 2026 and the English SY0-701 exam retiring on June 11, 2027. If you will test before that retirement date, either version works, so pick one and use its objectives PDF from start to finish.

Can I pass Security+ with no IT experience?

Yes, but plan for extra time at the start. CompTIA recommends Network+ and two years of experience in a security or systems administrator role, but does not require them. Spend 2 to 4 weeks on IP addresses, ports, protocols and the OSI model before Week 1 of this roadmap.

What score do I need to pass Security+?

You need 750 on a scale of 100 to 900, according to CompTIA. The score is scaled, so it does not map directly to a percentage of correct answers. That is why this plan targets 80% or more on practice tests, to give you a safety margin.

Are practice tests enough to pass Security+?

Rarely, because they show your gaps without filling them. Use them to find weak objectives, then go back to your main course for those sections. Mixing content study with regular timed practice works better than either one alone.

Generate this roadmap with AI