Most Security+ advice stops right where it gets useful. "Make a study plan." "Space out your reps." "Focus on your weak areas." Sure. But what does week three actually look like?
Here's an 8-week Security+ SY0-701 study plan that tells you what to do on specific days, when to take your first full-length practice exam, and when you should stop studying new material and start rehearsing. It's built for someone with roughly 10–15 hours a week. Compress or stretch it if your life says otherwise — there's a section near the end for that.
One thing before you start: take a diagnostic before you study anything. Not after week one. Before Monday. You need a real baseline, not a score colored by whatever you crammed the night before.
How this plan is built
The weights on SY0-701 aren't even. Domain 4 (Security Operations) is 28% of the exam. Domain 1 (General Security Concepts) is 12%. So the plan leans harder on Domain 4 than a symmetric "one domain per week" schedule would. That's deliberate — you should be spending disproportionate time on the domains that actually drive your score.
The rough shape:
- Weeks 1–2: Foundations. Domain 1 and Domain 5. Conceptual material, most of it about why security exists before you touch how.
- Weeks 3–4: Threats, attacks, and the start of architecture. Domain 2 and a runway into Domain 3.
- Week 5: Finish Domain 3. First full-length practice exam on Saturday.
- Weeks 6–7: Domain 4 — the biggest domain and the one most people underestimate.
- Week 8: No new material. Just practice exams, review, and booking the real thing.
A note on flashcards: start them in week one and never stop. 10–15 minutes a day. Security+ has a ridiculous number of acronyms, and trying to learn them in week seven is a terrible idea.
Week 1: Baseline + Domain 1
Take the diagnostic Monday morning before you've studied anything. Yes, you'll score badly. That's the point — you're trying to see which domains are actually your weak spots, not the ones you think are your weak spots. People are usually wrong about this. I've seen network engineers bomb Domain 3 because they confused "how networks work" with "how Security+ tests networks."
Then dig into Domain 1 for the rest of the week. The CIA triad, control categories (preventive, detective, corrective, deterrent), gap analysis, risk basics, intro-level crypto. Aim for roughly 10–12 articles per weekday, then use the weekend to do 150–200 practice questions and review whatever felt shaky.
One thing that trips people up here: the exam tests control categories and control types as separate concepts, and they're easy to conflate. If you can't explain the difference between a "technical preventive" and a "managerial corrective" control by Friday, slow down before you move on. This stuff compounds — Domain 1 is the vocabulary you'll be applying all exam.
By Sunday you should be able to explain the CIA triad to a non-technical friend and not just recite the words.
Week 2: Domain 5 while Domain 1 settles
Domain 5 is governance, risk, and compliance. It's also the domain most technical people underestimate and lose the most points on.
I studied with a guy who had 8 years of pentest experience and kept getting Domain 5 questions wrong because he was answering as an attacker, not as a security program manager. The exam wants you to think about policy, process, and documentation before you reach for a tool. If a question asks what to do when a new vendor wants access to customer data, "run a vulnerability scan" is the technical answer. It's also wrong. The Security+ answer is closer to "check the third-party risk management process."
Pairing Domain 5 with Domain 1 back-to-back is intentional. Both are conceptual. Both reward reasoning over recall. Your brain is still cementing Domain 1 while you're learning Domain 5, and the overlap between risk management in D1 and D5 reinforces both.
Daily cadence: ~9–11 articles on weekdays, 100–150 mixed D1/D5 questions across the weekend, flashcards every day. If you're ending the week unable to articulate the difference between governance and risk management, spend an extra day on it before moving to Week 3. You'll see this distinction tested in multiple ways.
Week 3: Domain 2, part one — the attacker side
Now we switch modes. Domain 2 is threats, vulnerabilities, and mitigations — 22% of the exam. We're splitting it across two weeks because it's a lot of material and because the attacker/defender sides deserve separate focus.
This week, study the attacker side. Threat actors (nation-state, organized crime, insider, hacktivist), malware types, social engineering techniques, password attacks, vulnerability assessment fundamentals. Target 7–8 articles per weekday. Do 100–125 practice questions over the weekend, all scoped to Domain 2.
A micro-observation from watching people study this domain: most candidates can list the malware types from memory by Wednesday but can't tell you why ransomware is categorically different from a worm in terms of business impact. The exam cares about the second thing. If your studying is producing a mental flashcard deck, that's fine — but your mental model should be richer than "match word to definition."
Week 4: Finish Domain 2, start Domain 3
Monday through Thursday finish Domain 2 — the defender side. Vulnerability management processes, the difference between scanning and penetration testing, patch management, incident response basics. Friday through Sunday, pivot to Domain 3 (Security Architecture) and get through the intro material: network design principles, segmentation, DMZs, cloud architecture fundamentals.
By now you should have done roughly 450–600 practice questions. Your accuracy on Domain 1 questions should be noticeably higher than it was in Week 1. If it isn't, something is wrong with how you're studying — probably you're doing questions without reviewing the ones you got wrong, which is the most common self-sabotage pattern I see.
Quick check before Week 5: can you walk someone through the difference between a vulnerability scan, a penetration test, and a bug bounty program? If not, revisit Monday's material before pushing forward.
Week 5: Finish Domain 3 + your first real practice exam
Study the rest of Domain 3 Monday through Friday. Cloud security, virtualization and containers, IoT, resilience, recovery strategies, business continuity. The cloud material is heavier than it looks — don't rush it.
Saturday afternoon, take your first full-length practice exam. Untimed, closed notes, 100–120 questions covering Domains 1, 2, 3, and 5. This is the most important event in the whole plan so far, so block real time for it. No phone.
Here's how to read your score:
- Under 70%: Stop. Don't move to Domain 4 yet. Go back and find the domain dragging you down and spend 2–3 extra days on it.
- 70–79%: You're on pace. Domain 4 is next and it's big, so you'll need that margin.
- 80%+: You're ahead of schedule. Keep the pace, don't coast.
Sunday is review day. Go through every question you got wrong and every question you got right but were unsure on. That second category matters more than people think — those are the ones you'll miss under exam-day pressure.
Another pattern I've noticed: people who avoid full-length practice exams usually delay booking the real test. It's not about readiness — it's avoidance. If you find yourself pushing this Saturday exam to "next week when I feel more prepared," that's the signal to do it anyway.
Weeks 6–7: Domain 4 (where most points live)
Domain 4 is 28% of the exam. More than a quarter of your score rides on this material. It's also dense with terminology — IAM, authentication factors, authorization models, cryptography, PKI, network security tools, incident response, monitoring, SOAR. Two full weeks isn't overkill. It's barely enough.
Week 6: IAM and cryptography
Identity and access management, MFA, SSO, federation, authorization models (RBAC, ABAC, MAC, DAC), cryptography fundamentals, encryption standards, hashing, digital signatures, certificates.
10 articles a day on weekdays. 125–150 practice questions on the weekend. Bump flashcards up to 20 minutes a day — the terminology density here is punishing.
The thing to internalize: authentication and authorization are different, and the exam tests whether you actually know the difference. "Proving who you are" vs. "deciding what you can do." I've watched people lose 5–8 points on this alone because they were treating them as synonyms.
Week 7: PKI, network tools, incident response + second practice exam
Finish Domain 4. PKI end-to-end (this is the trickiest cryptography topic on the exam for most candidates), firewalls, IDS/IPS, proxies, incident detection and response, logging and monitoring, SIEM, SOAR.
Same cadence — 11 articles a day on weekdays, but on Saturday stop studying new material. Saturday morning, review your roughest Domain 4 material. Saturday afternoon, take your second full-length practice exam.
You should be hitting 75%+ by now. If you're between 70 and 75 and the exam is still a week away, you have enough time — but barely. If you're below 70 after Week 7, consider pushing the real exam out by a week or two. Passing a rescheduled exam is better than failing an on-time one.
Week 8: Stop learning. Start rehearsing.
No new material this week. None. The temptation to open a new topic will be strong — resist it. The Security+ exam isn't rewarding last-minute knowledge acquisition. It's rewarding the recall and application of things you already know under pressure.
Here's how I'd structure this week:
- Monday: Full-length practice exam (your third).
- Tuesday: Review Monday's results. Spend 2–3 hours deep on the weakest domain.
- Wednesday: Short domain-specific practice test on that weakest area. Then a second test on the second-weakest.
- Thursday: Full-length practice exam (your fourth).
- Friday: Review. If you're at 80%+ on Thursday's exam, book the real one for early next week.
- Saturday: Light work. One short exam on your worst topic. Flashcards.
- Sunday: Flashcards and rest. Absolutely no new content.
When do you book the real exam? The honest answer: when you hit 80% on a full-length practice exam and the score feels consistent, not lucky. A single 80% that followed a 72% and a 74% doesn't count. Two or three in the 80s in a row does.
Every candidate I've seen fail a Security+ attempt they thought they'd pass had the same pattern: one good practice score in the final week, which they treated as proof. Two good scores is proof. One is noise.
Compressing or stretching the timeline
Compressed (5–6 weeks, 20–30 hrs/week): Combine Domains 1 and 5 into one intensive week. Collapse Domain 2 into one week. Move Domain 3 and the first practice exam together. Domain 4 becomes one heavy week instead of two. Final review + exam in Week 6. This only works if you already have real security experience. If you don't, don't try it — you'll retain the surface and the exam will punish you.
Extended (10–12 weeks, 7–10 hrs/week): Insert a review week after every two content weeks. Move the first practice exam to Week 7, the second to Week 11, exam in Week 12. This is usually the better plan if you're working full time. Retention is higher and the study habit is easier to maintain. The plan people say they'll follow and the plan they actually follow are rarely the same — pick the one you'll actually do.
What "ready" feels like per domain
Ignore the scores for a second. Here's what each domain should feel like when you've actually got it:
- Domain 1 — You can explain the CIA triad to a non-technical relative and give real examples of each control type without looking anything up.
- Domain 2 — You can describe three attack vectors and the mitigation for each. You can explain why social engineering is effective, not just that it is.
- Domain 3 — You can sketch a segmented network on a whiteboard and defend your design choices. You can name two real trade-offs between cloud and on-prem.
- Domain 4 — You can walk through an authentication flow, explain what PKI actually does in plain English, and list the first five steps of an incident response.
- Domain 5 — You can articulate why governance matters before controls. You can describe three compliance frameworks without Googling.
If you can't do something in that list after its week, go back. Moving forward with shaky foundations is how people end up at 73% in Week 8 wondering what went wrong.
Why 80% is the target
People argue about the practice-exam threshold. 75%? 85%? There's no perfect number, but 80% is where the probability curve gets comfortable. It means you've got enough margin for exam-day nerves and the two or three questions that are just strangely worded.
Scoring 80% means you're getting 80 of 100 right and you can roughly explain why — not that you guessed 80 correctly. If you're hitting the number but couldn't defend your answers to a peer, the number is lying to you. Go back and review.
A few things I'd tell anyone starting today
Read the articles first, then the practice questions, then use flashcards to lock in terms. Doing it in the reverse order wastes time because you don't yet know what you're looking for.
Don't skip hand-written notes. There's real evidence that writing forces deeper processing than reading, and Week 8 becomes much easier if you have your own notes to review instead of re-reading every article from Week 1.
Tell someone your exam date. Not for inspiration — for accountability. The people who quietly slip their dates by two weeks never tell anyone. The people who told their team on Slack tend to show up.
And when you get a question wrong on practice, ask why you got it wrong, not what the right answer was. The wrong answer is usually more informative than the right one.
If you haven't taken the diagnostic yet, go do that before anything else on this plan. Fifty questions, instant results, a per-domain breakdown. No signup. Most people are wrong about where they're weakest — the diagnostic is how you find out for real, and it only takes about 30 minutes: learnzapp.com/apps/comptia/security-plus/.
Then start Week 1. That's the hard part — not the studying, the starting.