CompTIA Security+ Study Plan: From Zero to SY0-701 in 10 Weeks
Here is your detailed, week-by-week study plan for the CompTIA Security+ (SY0-701) exam. This plan assumes you have zero background in IT security, but it is also flexible for those with some experience. You will need roughly 10–12 hours per week for 8 weeks.
How to use this plan: Each week has a clear goal, a list of resources, and a checkpoint. Do NOT move to the next week until you hit the checkpoint score. If you don’t hit it, spend an extra 2–3 days reviewing the weak areas before proceeding.
Week 1: Foundations & General Security Concepts (Domain 1)
What to study: The core principles of security: CIA triad (Confidentiality, Integrity, Availability), AAA (Authentication, Authorization, Accounting), security controls (technical, managerial, operational), and basic threat actors & threat vectors. Also, cover the fundamentals of cryptography (symmetric vs. asymmetric, hashing) at a high level.
Hours required: 12 hours (split into 4 days of 3 hours each).
If your available study time differs from the week's suggested hours, use a free CompTIA Security+ study plan to get a schedule that fits your pace.
Specific resources:
- Book: "CompTIA Security+ Get Certified Get Ahead: SY0-701 Study Guide" by Darril Gibson – Read Chapters 1 and 2.
- Video: Professor Messer’s CompTIA Security+ (SY0-701) video course – Watch “1.1 Security Objectives” and “1.2 CIA Triad” and “2.1 Cryptographic Concepts” (just the intro parts).
- Practice: Use the end-of-chapter questions in the Gibson book.
Checkpoint: Take a 20-question practice quiz on Domain 1 from any free source (e.g., ExamCompass). Score target: 70% or higher. If you score below 70%, re-read the chapter summaries and re-watch the Messer videos.
Before you invest extra review time, take the free CompTIA Security+ readiness check to quickly identify your weakest topic.
Week 2: Threats, Vulnerabilities & Mitigations – Part 1 (Domain 2)
What to study: Malware types (virus, worm, trojan, ransomware, spyware), social engineering (phishing, spear phishing, whaling, vishing, tailgating), and attack types (DoS/DDoS, man-in-the-middle, SQL injection, XSS). Also, learn about threat intelligence sources (OSINT, threat feeds).
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapters 3 and 4 (Malware & Social Engineering; Attacks).
- Video: Professor Messer – “2.1 Malware,” “2.2 Social Engineering,” “2.3 Attack Types” (watch the full sections).
- Hands-on: Set up a free account on TryHackMe and complete the “Intro to Cyber Security” room to see real-world examples of phishing and malware.
Checkpoint: Take a 30-question mixed quiz covering malware and attacks from ExamCompass or the Gibson practice tests. Score target: 75% or higher. Focus on remembering the difference between a virus and a worm, and the exact definition of a logic bomb.
Week 3: Threats, Vulnerabilities & Mitigations – Part 2 (Domain 2 continued)
What to study: Application attacks (buffer overflow, LDAP injection, XSS), network attacks (DNS poisoning, ARP spoofing, on-path attacks), and wireless attacks (evil twin, deauthentication, jamming). Also, learn about vulnerability scanning, penetration testing, and common mitigation techniques (patching, hardening, isolation).
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapter 5 (Application, Network, and Wireless Attacks) and Chapter 6 (Vulnerability Management).
- Video: Professor Messer – “2.4 Application Attacks,” “2.5 Network Attacks,” “2.6 Wireless Attacks,” and “2.8 Vulnerability Scanning.”
- Tool: Download a free trial of Nmap (or use the online version) and scan your own home router to see open ports.
Checkpoint: Take a 40-question test on Domain 2 (all topics from Weeks 2 and 3) from the Gibson online practice tests. Score target: 80% or higher. If you are below 80%, re-watch Messer’s “2.4” and “2.5” videos specifically.
Week 4: Architecture & Design (Domain 3)
What to study: Network architecture (DMZ, VLANs, VPNs, SD-WAN), cloud security (IaaS, PaaS, SaaS, shared responsibility model), virtualization, and secure infrastructure (load balancers, proxies, firewalls, IDS/IPS). Also, cover embedded systems and IoT security.
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapters 7 and 8 (Network Architecture; Cloud & Virtualization).
- Video: Professor Messer – “3.1 Network Architecture,” “3.2 Cloud and Virtualization,” “3.3 Secure Infrastructure.”
- Visual aid: Draw a simple network diagram with a firewall, DMZ, and internal network. Label where you would place a web server, database, and an IDS.
Checkpoint: Take a 35-question quiz on Domain 3 from ExamCompass. Score target: 75% or higher. Pay special attention to the shared responsibility model – it is a frequent exam question.
Week 5: Security Operations & Incident Response (Domain 4 – Part 1)
What to study: Incident response process (preparation, detection, containment, eradication, recovery, lessons learned), digital forensics (acquisition, preservation, chain of custody), and log management (SIEM, syslog, NetFlow). Also, cover the basics of disaster recovery (RTO, RPO, backup types).
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapters 9 and 10 (Incident Response; Forensics).
- Video: Professor Messer – “4.1 Incident Response Process,” “4.2 Digital Forensics,” “4.3 Logging and Monitoring.”
- Practice: Use a free online SIEM simulator (like Splunk Free) to search for a fake malicious IP address in sample logs.
Checkpoint: Take a 25-question quiz on incident response and forensics. Score target: 70% or higher. Know the difference between a full backup, incremental, and differential backup cold – you will get a question on this.
Week 6: Security Operations – Part 2 & Identity/Access Management (Domain 4 & 5)
What to study: Identity and Access Management (IAM): authentication methods (MFA, biometrics, certificates), authorization models (RBAC, ABAC, MAC/DAC), and account management (password policies, account lockout). Also, cover secure protocols (SSH, TLS, IPsec), and public key infrastructure (PKI, CAs, certificate revocation).
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapters 11 and 12 (Identity & Access Management; PKI).
- Video: Professor Messer – “4.4 Identity and Access Management,” “4.5 Account Types,” “5.1 Public Key Infrastructure.”
- Hands-on: Generate a self-signed SSL certificate using OpenSSL (free tool) to see how a CA works.
Checkpoint: Take a 40-question quiz covering IAM and PKI from the Gibson online tests. Score target: 80% or higher. If you struggle with certificate revocation lists (CRL) vs. OCSP, review that specific section.
Week 7: Risk Management, Governance & Compliance (Domain 5)
What to study: Risk assessment (quantitative vs. qualitative), risk response strategies (mitigate, transfer, accept, avoid), business continuity planning, and security policies (acceptable use, data retention, password policies). Also, cover compliance frameworks (GDPR, HIPAA, PCI-DSS, NIST), and vendor due diligence.
Hours required: 10 hours.
Specific resources:
- Book: Gibson – Chapter 13 (Risk Management) and Chapter 14 (Governance & Compliance).
- Video: Professor Messer – “5.2 Risk Management,” “5.3 Compliance and Governance.”
- Real-world: Read a summary of the GDPR and HIPAA – just the key points – to understand the difference between a data controller and data processor.
Checkpoint: Take a 30-question quiz on Domain 5. Score target: 75% or higher. Know the formulas: SLE = ALE / ARO (Single Loss Expectancy, Annualized Loss Expectancy, Annual Rate of Occurrence).
Week 8: Full Review & Domain 6 (Security+ Objectives – The "Other" 10%)
What to study: Domain 6 (which is small but essential) covers secure coding practices (input validation, error handling), and security awareness training. Then, spend the rest of the week doing a full review of all five domains.
Hours required: 12 hours.
Specific resources:
- Book: Gibson – Chapter 15 (Secure Coding & Awareness).
- Video: Professor Messer – “6.1 Secure Coding,” “6.2 Security Awareness.”
- Review: Re-read all your chapter summaries and your notes from the previous 7 weeks.
Checkpoint: Take a full-length, 90-question practice exam (simulate the real test) from the Gibson online test bank or a free source like CertMaster (the official CompTIA one). Score target: 85% or higher. If you score below 85%, identify the two weakest domains and re-study only those for 2 days.
The Final 3-Day Sprint (Before Exam Day)
Day 1: The "Weak Spot" Blitz
- Review your practice exam results. Pick the ONE domain where you scored the lowest in Week 8.
- Spend 4 hours re-watching the corresponding Professor Messer videos and re-reading the relevant Gibson chapter.
- Take a 20-question targeted quiz on that domain only. Score target: 90% (this is easy because it’s fresh).
Day 2: The "Memory Anchors" Day
- Do not study new material. Instead, write down on a blank sheet of paper all the acronyms you struggle with (e.g., RTO, RPO, SLE, ALE, CRL, OCSP, MFA, RBAC, ABAC, SIEM, SOAR).
- Create a mnemonic for each. For example, for the incident response steps (Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned) use: "Please Don't Call Every Recovery Lame."
- Re-watch Professor Messer’s “Study Groups” for the most recent SY0-701 – these are 1-hour sessions where he answers tricky questions. Watch two of them.
- Rest your brain. Go for a walk. Do NOT take a full practice test today.
Day 3: The "Simulation & Confidence" Day
- In the morning, take one final, short 30-question practice test (not the full 90) to get your brain in test mode.
- Review the answer explanations for every question, even the ones you got right.
- In the afternoon, do a "brain dump" – write out the key port numbers (22, 80, 443, 3389, 1433, 3306), the OSI model layers, and the CIA triad.
- Close your books by 6 PM. Eat a good dinner, get a full 8 hours of sleep. Do not cram that night.
See how your preparation compares to the passing standard on CompTIA Security+ practice test.