Most Security+ advice stops right where it gets useful. "Make a study plan." "Space out your reps." "Focus on your weak areas." Sure. But what does week three actually look like?
Here's an 8-week Security+ SY0-701 study plan that tells you what to do on specific days, when to take your first full-length practice exam, and when you should stop studying new material and start rehearsing. It's built for someone with roughly 10–15 hours a week. Compress or stretch it if your life says otherwise — there's a section near the end for that.
One thing before you start: take a diagnostic before you study anything. Not after week one. Before Monday. You need a real baseline, not a score colored by whatever you crammed the night before.
How this plan is built
First, the exam itself: 90 minutes, up to 90 questions, a mix of multiple-choice and performance-based questions (PBQs). Passing is 750 on a 900-point scale, which works out to roughly 83%.
The weights on SY0-701 aren't even. Domain 4 (Security Operations) is 28% of the exam. Domain 1 (General Security Concepts) is 12%. Domain 4 plus Domain 2 (Threats, Vulnerabilities, and Mitigations, 22%) is half the exam on its own. So the plan leans harder on Domain 4 than a symmetric "one domain per week" schedule would. That's deliberate — you should be spending disproportionate time on the domains that actually drive your score. Candidates who overindex on Security Architecture because it's interesting and underinvest in Security Operations because it feels broad and administrative fail more often than they should.
The rough shape:
- Weeks 1–2: Foundations. Domain 1 and Domain 5. Conceptual material, most of it about why security exists before you touch how.
- Weeks 3–4: Threats, attacks, and the start of architecture. Domain 2 and a runway into Domain 3.
- Week 5: Finish Domain 3. First full-length practice exam on Saturday.
- Weeks 6–7: Domain 4 — the biggest domain and the one most people underestimate.
- Week 8: No new material. Just practice exams, review, and booking the real thing.
A note on flashcards: start them in week one and never stop. 10–15 minutes a day. Security+ has a ridiculous number of acronyms, and trying to learn them in week seven is a terrible idea.
Security+ study resources for 2026: pick two, not six
Most people looking for Security+ study resources in 2026 don't have too few. They have too many — a bookmarked Reddit thread with 40 links, and three weeks lost ping-ponging between Messer, a textbook, two practice apps, and a Discord server. People who use three or four resources in parallel almost always underperform people who use two deeply. If you find yourself adding a resource because you feel behind, it's usually a sign you're avoiding practice questions, not that you need more material.
Here's the short list. SY0-701 is the current version, so check the date on anything you pick up — older SY0-601 material shares maybe 70–75% of the content, and the part that changed is exactly what gets tested.
One textbook. The Wiley CompTIA Security+ Study Guide (Chapple and Seidl) is the systematic, reference-style one that maps cleanly to the objectives. Darril Gibson's Get Certified Get Ahead reads more like someone explaining things to you, with more exam strategy, and has an audiobook for commutes. Pick one — flip through the cryptography chapter in each and go with whichever voice you can stand for 500 pages. Reading both leaves nothing for practice questions.
Professor Messer's free SY0-701 video series is the best-mapped-to-objectives video resource for this exam, full stop. His monthly live study groups (recorded, organized by topic) hammer on governance, risk, and the fiddly parts of cryptography — different content from the main series, and most people never find them. One warning: videos feel like progress without being progress. Drill questions while you work through the series, not as a separate phase afterward. Jason Dion's Udemy course is the paid alternative people actually finish; wait for a sale.
A question bank with real explanations. A bank with 2,000 questions and three-line explanations is worse than 500 that break down why each distractor is wrong — that's where most of the learning happens. LearnZapp's Security+ bank has 1,543 Wiley-sourced questions with per-domain tracking and spaced repetition, plus 320 short study articles and 364 flashcards built in; the "articles" in the weekly targets below refer to those. Pocket Prep is decent for phone drilling; Kaplan and ExamCompass have free questions with thin explanations, fine as a warmup.
Flashcards for terminology, not concepts. SAML, SCAP, SIEM, SOAR, TLS, TPM, OCSP — when six of those appear in one question you don't have time to think. Nobody has ever passed by flashcarding "what is risk appetite." Anki has maintained SY0-701 community decks; vet Quizlet decks before trusting them.
Skip: brain dumps (they violate CompTIA's NDA, they're wrong often enough that you'll memorize bad answers, and getting caught can cost you the cert); hands-on labs like TryHackMe as exam prep (great for your career, but the exam is knowledge-based and labs won't move your score); and CertMaster at full price unless your employer is paying.
Week 1: Baseline + Domain 1
Take the diagnostic Monday morning before you've studied anything. Yes, you'll score badly. That's the point — you're trying to see which domains are actually your weak spots, not the ones you think are your weak spots. People are usually wrong about this. I've seen network engineers bomb Domain 3 because they confused "how networks work" with "how Security+ tests networks."
Then dig into Domain 1 for the rest of the week. The CIA triad, control categories (preventive, detective, corrective, deterrent), gap analysis, risk basics, intro-level crypto. Aim for roughly 10–12 articles per weekday, then use the weekend to do 150–200 practice questions and review whatever felt shaky.
One thing that trips people up here: the exam tests control categories and control types as separate concepts, and they're easy to conflate. If you can't explain the difference between a "technical preventive" and a "managerial corrective" control by Friday, slow down before you move on. This stuff compounds — Domain 1 is the vocabulary you'll be applying all exam.
By Sunday you should be able to explain the CIA triad to a non-technical friend and not just recite the words.
Week 2: Domain 5 while Domain 1 settles
Domain 5 is governance, risk, and compliance. It's also the domain most technical people underestimate and lose the most points on.
I studied with a guy who had 8 years of pentest experience and kept getting Domain 5 questions wrong because he was answering as an attacker, not as a security program manager. The exam wants you to think about policy, process, and documentation before you reach for a tool. If a question asks what to do when a new vendor wants access to customer data, "run a vulnerability scan" is the technical answer. It's also wrong. The Security+ answer is closer to "check the third-party risk management process."
Pairing Domain 5 with Domain 1 back-to-back is intentional. Both are conceptual. Both reward reasoning over recall. Your brain is still cementing Domain 1 while you're learning Domain 5, and the overlap between risk management in D1 and D5 reinforces both.
Daily cadence: ~9–11 articles on weekdays, 100–150 mixed D1/D5 questions across the weekend, flashcards every day. If you're ending the week unable to articulate the difference between governance and risk management, spend an extra day on it before moving to Week 3. You'll see this distinction tested in multiple ways.
Week 3: Domain 2, part one — the attacker side
Now we switch modes. Domain 2 is threats, vulnerabilities, and mitigations — 22% of the exam. We're splitting it across two weeks because it's a lot of material and because the attacker/defender sides deserve separate focus.
This week, study the attacker side. Threat actors (nation-state, organized crime, insider, hacktivist), malware types, social engineering techniques, password attacks, vulnerability assessment fundamentals. Target 7–8 articles per weekday. Do 100–125 practice questions over the weekend, all scoped to Domain 2.
A micro-observation from watching people study this domain: most candidates can list the malware types from memory by Wednesday but can't tell you why ransomware is categorically different from a worm in terms of business impact. The exam cares about the second thing. If your studying is producing a mental flashcard deck, that's fine — but your mental model should be richer than "match word to definition."
Week 4: Finish Domain 2, start Domain 3
Monday through Thursday finish Domain 2 — the defender side. Vulnerability management processes, the difference between scanning and penetration testing, patch management, incident response basics. Friday through Sunday, pivot to Domain 3 (Security Architecture) and get through the intro material: network design principles, segmentation, DMZs, cloud architecture fundamentals.
By now you should have done roughly 450–600 practice questions, on the way to 1,500+ across the whole plan — that sounds like a lot, but spread over eight weeks it's 30–40 a day, about an hour of focused work. Candidates who stop at 300–400 questions fail more than they pass; candidates who clear 1,500 almost always pass. Your accuracy on Domain 1 questions should be noticeably higher than it was in Week 1. If it isn't, something is wrong with how you're studying — probably you're doing questions without reviewing the ones you got wrong, which is the most common self-sabotage pattern I see.
Quick check before Week 5: can you walk someone through the difference between a vulnerability scan, a penetration test, and a bug bounty program? If not, revisit Monday's material before pushing forward.
Week 5: Finish Domain 3 + your first real practice exam
Study the rest of Domain 3 Monday through Friday. Cloud security, virtualization and containers, IoT, resilience, recovery strategies, business continuity. The cloud material is heavier than it looks — don't rush it.
Saturday afternoon, take your first full-length practice exam. Untimed, closed notes, 100–120 questions covering Domains 1, 2, 3, and 5. This is the most important event in the whole plan so far, so block real time for it. No phone.
Here's how to read your score:
- Under 70%: Stop. Don't move to Domain 4 yet. Go back and find the domain dragging you down and spend 2–3 extra days on it.
- 70–79%: You're on pace. Domain 4 is next and it's big, so you'll need that margin.
- 80%+: You're ahead of schedule. Keep the pace, don't coast.
Sunday is review day, and this is where most of the value of a practice exam actually lives — the test itself is maybe 20% of it. Go through every single question, including the ones you got right. For each one you should be able to explain why the correct answer is correct and why each wrong answer is wrong. Questions you got right but weren't sure about go in the review pile with the ones you missed — those are the ones you'll miss under exam-day pressure. If a pattern shows up (three misses in governance, say), go back to the source material for that section before moving on. Budget 90–150 minutes of review for a 90-minute exam. It feels excessive. It isn't.
People who skip reviewing the questions they got right tend to miss exam-day questions that are worded slightly differently from what they practiced. They weren't learning the concept — they were recognizing the question. Security+ reworks phrasing constantly, and pure pattern-matching doesn't transfer.
Another pattern I've noticed: people who avoid full-length practice exams usually delay booking the real test. It's not about readiness — it's avoidance. If you find yourself pushing this Saturday exam to "next week when I feel more prepared," that's the signal to do it anyway.
Weeks 6–7: Domain 4 (where most points live)
Domain 4 is 28% of the exam. More than a quarter of your score rides on this material. It's also dense with terminology — IAM, authentication factors, authorization models, cryptography, PKI, network security tools, incident response, monitoring, SOAR. Two full weeks isn't overkill. It's barely enough.
Week 6: IAM and cryptography
Identity and access management, MFA, SSO, federation, authorization models (RBAC, ABAC, MAC, DAC), cryptography fundamentals, encryption standards, hashing, digital signatures, certificates.
10 articles a day on weekdays. 125–150 practice questions on the weekend. Bump flashcards up to 20 minutes a day — the terminology density here is punishing.
The thing to internalize: authentication and authorization are different, and the exam tests whether you actually know the difference. "Proving who you are" vs. "deciding what you can do." I've watched people lose 5–8 points on this alone because they were treating them as synonyms.
Week 7: PKI, network tools, incident response + second practice exam
Finish Domain 4. PKI end-to-end (this is the trickiest cryptography topic on the exam for most candidates), firewalls, IDS/IPS, proxies, incident detection and response, logging and monitoring, SIEM, SOAR.
Same cadence — 11 articles a day on weekdays, but on Saturday stop studying new material. Saturday morning, review your roughest Domain 4 material. Saturday afternoon, take your second full-length practice exam.
You should be hitting 75%+ by now. If you're between 70 and 75 and the exam is still a week away, you have enough time — but barely. If you're below 70 after Week 7, consider pushing the real exam out by a week or two. Passing a rescheduled exam is better than failing an on-time one.
Week 8: Stop learning. Start rehearsing.
No new material this week. None. The temptation to open a new topic will be strong — resist it. The Security+ exam isn't rewarding last-minute knowledge acquisition. It's rewarding the recall and application of things you already know under pressure.
Here's how I'd structure this week:
- Monday: Full-length practice exam (your third).
- Tuesday: Review Monday's results. Spend 2–3 hours deep on the weakest domain.
- Wednesday: Short domain-specific practice test on that weakest area. Then a second test on the second-weakest.
- Thursday: Full-length practice exam (your fourth).
- Friday: Review. If you're at 80%+ on Thursday's exam, book the real one for early next week.
- Saturday: Light work. One short exam on your worst topic. Flashcards.
- Sunday: Flashcards and rest. Absolutely no new content.
When do you book the real exam? The honest answer: when you hit 80% on a full-length practice exam and the score feels consistent, not lucky. A single 80% that followed a 72% and a 74% doesn't count. Two or three in the 80s in a row does.
Every candidate I've seen fail a Security+ attempt they thought they'd pass had the same pattern: one good practice score in the final week, which they treated as proof. Two good scores is proof. One is noise.
Compressing or stretching the timeline
Compressed (5–6 weeks, 20–30 hrs/week): Combine Domains 1 and 5 into one intensive week. Collapse Domain 2 into one week. Move Domain 3 and the first practice exam together. Domain 4 becomes one heavy week instead of two. Final review + exam in Week 6. This only works if you already have real security experience. If you don't, don't try it — you'll retain the surface and the exam will punish you.
Extended (10–12 weeks, 7–10 hrs/week): Insert a review week after every two content weeks. Move the first practice exam to Week 7, the second to Week 11, exam in Week 12. This is usually the better plan if you're working full time. Retention is higher and the study habit is easier to maintain. Don't stretch much past 12 weeks, though — momentum becomes the problem, and people who try to spread prep across 16 weeks usually drop off around week 9 and never come back. The plan people say they'll follow and the plan they actually follow are rarely the same — pick the one you'll actually do.
Whichever timeline you choose, leave a one-week buffer between "plan ends" and "exam day." Your final practice exams will reveal gaps. You need time to close them.
What "ready" feels like per domain
Ignore the scores for a second. Here's what each domain should feel like when you've actually got it:
- Domain 1 — You can explain the CIA triad to a non-technical relative and give real examples of each control type without looking anything up.
- Domain 2 — You can describe three attack vectors and the mitigation for each. You can explain why social engineering is effective, not just that it is.
- Domain 3 — You can sketch a segmented network on a whiteboard and defend your design choices. You can name two real trade-offs between cloud and on-prem.
- Domain 4 — You can walk through an authentication flow, explain what PKI actually does in plain English, and list the first five steps of an incident response.
- Domain 5 — You can articulate why governance matters before controls. You can describe three compliance frameworks without Googling.
If you can't do something in that list after its week, go back. Moving forward with shaky foundations is how people end up at 73% in Week 8 wondering what went wrong.
Why 80% is the target
People argue about the practice-exam threshold. 75%? 85%? There's no perfect number, but 80% is where the probability curve gets comfortable. It means you've got enough margin for exam-day nerves and the two or three questions that are just strangely worded.
Scoring 80% means you're getting 80 of 100 right and you can roughly explain why — not that you guessed 80 correctly. If you're hitting the number but couldn't defend your answers to a peer, the number is lying to you. Go back and review.
And if you're averaging 72–75% and thinking "the real exam is probably easier than the practice tests, I'll squeak by" — no. It isn't. If anything it feels harder because of the pressure of the room. People who book while scoring in the 70s are the biggest single category of first-attempt failures, and every one of them thought they'd rise to the occasion. If you're stuck in the mid-70s, it's almost always one domain pulling the average down. Find it, fix it, rescore.
How to pass Security+ the first time: what actually goes wrong
If you want to know how to pass Security+ first time, it's easier to describe the failures. Every first-attempt failure I've watched falls into one of a few buckets:
- Memorized answers instead of understanding concepts. If your review is "the answer is B" with no "and here's why A, C, and D aren't," the exam will rephrase the concept and you won't recognize it.
- Ignored Domain 5 because it felt boring. Governance is 20% of the exam. Technical candidates deprioritize it because it's not "real" security, and it costs the exam more often than any single technical gap.
- Not enough volume. 300–400 practice questions feels like a lot because each one with a proper review takes real time. It's still not enough coverage.
- Scheduled too soon. Inconsistent scores in the 70s, booked anyway. See above.
- No buffer. The plan ended the week of the exam, with no room to fix what the final practice tests revealed.
On exam day itself, there's not much surprising. Arrive 15–20 minutes early. Answer the multiple-choice questions first and flag the PBQs for the end — PBQs take 3–5 minutes each, multiple-choice about a minute, so bank the cheap points first. Read carefully: NOT, BEST, FIRST, and MOST LIKELY change everything. Eliminate the obviously wrong answers before choosing between the remaining two. If you've done the prep honestly — 1,500+ questions with real reviews, consistent 80%+ scores, a buffer week — exam day is mostly about staying calm. The work is already done.
A few things I'd tell anyone starting today
Read the articles first, then the practice questions, then use flashcards to lock in terms. Doing it in the reverse order wastes time because you don't yet know what you're looking for.
Don't skip hand-written notes. There's real evidence that writing forces deeper processing than reading, and Week 8 becomes much easier if you have your own notes to review instead of re-reading every article from Week 1.
Tell someone your exam date. Not for inspiration — for accountability. The people who quietly slip their dates by two weeks never tell anyone. The people who told their team on Slack tend to show up.
And when you get a question wrong on practice, ask why you got it wrong, not what the right answer was. The wrong answer is usually more informative than the right one.
If you haven't taken the diagnostic yet, go do that before anything else on this plan. Fifty questions, instant results, a per-domain breakdown. No signup. Most people are wrong about where they're weakest — the diagnostic is how you find out for real, and it only takes about 30 minutes: learnzapp.com/apps/comptia/security-plus/.
Then start Week 1. That's the hard part — not the studying, the starting.