The CompTIA Security+ SY0-701 exam is the most popular entry-level
cybersecurity certification and one of the most-cited credentials in
DoD 8140 baseline job postings. Pass at 750 out of 900. 90 questions in
90 minutes. $404 USD per attempt. Most candidates need 8 to 12 weeks of
focused study to pass on the first try. This guide is the actual
week-by-week plan, the resources that work, and the exam-day mistakes
that cost people their voucher.
The 90-second answer
Plan 10 weeks at 8 to 10 hours per week. Professor Messer's free
YouTube series carries the instruction. NerdExam covers the practice
questions. A printed exam objectives document is your single source of
truth for scope. That's the entire stack. Total cash spend if you
self-fund: $404 for the voucher.
Add Mike Chapple's Sybex book if you prefer reading to watching.
Add CertMaster Labs ($175) if you have zero hands-on security
experience. Skip the $300 bootcamps. They compress 10 weeks of
material into 1 week of cramming and the retention rate is terrible.
The first-attempt pass rate among candidates who score 80%+ on three
full timed practice exams (90 questions, 90 minutes, no breaks) is
roughly 90%. The pass rate among candidates who skip practice exams is
roughly 50%. Practice exams are the single most useful activity in
this plan and the easiest to skip.
How long should I study for Security+?
Most candidates need 8 to 12 weeks at 8 to 10 hours per week. The
honest variance comes from prior experience, not study material
quality.
| Your background | Realistic study window |
|---|---|
| 2+ years IT admin experience, no security focus | 8 to 10 weeks |
| Active sysadmin or net admin role | 6 to 8 weeks |
| Network+ certified, some security exposure | 6 to 8 weeks |
| Career changer with no IT background | 14 to 18 weeks; consider Network+ first |
| Active SOC analyst or security engineer | 4 to 6 weeks for refresher only |
| College student studying cybersecurity | 10 to 14 weeks |
The biggest predictor of pass-on-first-try is hands-on time, not study
hours. Two candidates with the same 80 hours of study will see very
different scores if one of them did command-line work (nmap, Wireshark
captures, SSH key generation) and the other watched videos. Build at
least 20 hours of lab time into the 10-week plan.
What's actually tested on Security+ SY0-701?
Security+ SY0-701 tests five domains. CompTIA updated the weights when
they retired SY0-601 in mid-2024. Every question maps to one domain.
| Domain | Weight | What it covers |
|---|---|---|
| General Security Concepts | 12% | CIA triad, AAA, change management, cryptographic solutions, zero trust |
| Threats, Vulnerabilities, and Mitigations | 22% | Threat actors, attack surfaces, malware classification, vuln analysis, indicators of compromise |
| Security Architecture | 18% | Network, infra, application, and cloud security architecture; resilience and recovery |
| Security Operations | 28% | Hardening, asset management, vuln management, monitoring, incident response, forensics |
| Security Program Management and Oversight | 20% | Risk, governance, audit, vendor assessment, security awareness, compliance |
Two domains carry 50% of the weight: Security Operations (28%) and
Threats / Vulnerabilities / Mitigations (22%). Spend the most study
time there and the math works in your favor.
The exam mix is roughly 75% multiple-choice and 25% performance-based
questions (PBQs). PBQs are simulated environments where you might be
asked to drag firewall rules into the right order, classify network
traffic from a Wireshark snippet, or identify the attack from a syslog
sample. PBQs are time-expensive and stress-inducing. Plan to skip them
on the first pass and return when you've answered the easier MCQs.
How do I structure a 10-week study plan?
The 10-week structure below tracks the official exam objectives in
roughly the order CompTIA presents them, with the heaviest-weight
domains getting extra time. Hours assume 8 to 10 hours per week.
| Week | Focus | Deliverable |
|---|---|---|
| 1 | General security concepts, CIA, AAA, change management | Watch Messer 1.1-1.4, write a 1-page CIA summary in your own words |
| 2 | Cryptographic solutions, PKI, hashing, key exchange | Generate an RSA key pair, sign and verify a file with openssl, document the steps |
| 3 | Threat actors, attack surfaces, social engineering | Map a phishing email's red flags. Read CISA's Known Exploited Vulnerabilities catalog. |
| 4 | Malware classification, indicators of compromise | Capture a process tree on your own machine. Identify 3 normal vs 3 suspicious patterns. |
| 5 | Network and infra security architecture, zero trust | Build a home lab firewall (pfSense or OPNsense in a VM). Configure two zones. |
| 6 | Application and cloud security architecture | Walk through OWASP Top 10. Run a SQL injection demo on a deliberately vulnerable app. |
| 7 | Security operations: hardening, monitoring, incident response | Set up Splunk Free or Wazuh. Ingest your own VM logs. Build 2 alert rules. |
| 8 | Forensics, automation, vendor management | Take 2 full practice exams under timed conditions. Score honestly. |
| 9 | Risk, governance, audit, compliance frameworks | Map NIST CSF v2.0 functions to specific Azure or AWS services. |
| 10 | Practice exams + weak-area cleanup | Take 3 timed practice exams. Postpone exam if you're not at 80%+. |
The single biggest miss in self-study plans is skipping week 8 lab
work for incident response. Roughly a quarter of SY0-701 questions
expect you to know what a real alert looks like, what triage steps
follow, and what evidence preservation requires. Reading about it
doesn't stick. Configuring Splunk or Wazuh does.
If you fall behind in any week, push schedule by 1 week rather than
compressing material. Compressed material doesn't retain. The exam
asks you to recognize patterns under time pressure, not regurgitate
facts.
Which Security+ study resources are worth using?
The candidates who pass on the first attempt use a consistent stack
of free and low-cost resources. Anything beyond this stack is
optional.
- Professor Messer's SY0-701 video series (free, ~50 hours of YouTube videos). The community gold standard. Watch at 1.25x playback for first pass, real-time for review.
- CompTIA Security+ SY0-701 exam objectives PDF (free, 24 pages). Print it. Highlight every sub-objective as you cover it. Don't trust any study material that doesn't map to this document.
- Mike Chapple "CompTIA Security+ Study Guide: SY0-701" ($40 Sybex book). Strong supplement if you prefer reading. Skip if Messer's videos work for you.
- A practice question bank with 800+ questions for pacing and weak-area discovery
- CertMaster Labs SY0-701 ($175). Worth it if you have zero security hands-on experience. Skip if you've ever configured a firewall, run nmap, or read Wireshark output.
- 3 full-length timed practice exams in weeks 8 and 10. Take them on a Saturday morning, treat them like the real exam, score honestly. If you're below 80%, postpone the real exam.
Skip the $300 bootcamps. They compress 10 weeks into 5 days and the
material doesn't stick. Skip the $80 mobile flashcard apps unless
you're a flashcard person already; the time is better spent on
practice questions with explanations.
For the practice question portion, NerdExam has 1,056 enriched
SY0-701 questions with full explanations covering all five domains.
Start practicing Security+ questions to
see the question style before you commit to the full plan. The
explanations show the reasoning pattern the exam expects, which is
harder to learn from videos than from doing the questions.
How do I practice for the performance-based questions?
PBQs require hands-on configuration, not memorization. The fastest
way to prepare is to build a small home lab and practice the same
five scenarios that CompTIA cycles through on every exam version.
The five PBQ scenarios you should drill before exam day:
- Firewall rule ordering: given a set of rules and a desired policy, drag the rules into the right order. Practice in pfSense or OPNsense in a VM.
- Log analysis: identify the attack from a 10 to 20 line syslog or Wireshark snippet. Practice with Wireshark sample captures and sample Splunk logs.
- Cryptography selection: pick the right algorithm for a given use case (data at rest, data in transit, integrity verification).
- Wireless security configuration: configure WPA3 vs WPA2-PSK vs Enterprise auth correctly for a stated scenario.
- Incident response sequencing: drag the IR phases into the right order for a stated breach scenario (NIST 800-61 sequence).
The home lab to support this fits on any modern laptop. A free
VirtualBox installation, two Linux VMs (one Ubuntu, one Kali), a
pfSense VM as the firewall between them, and a Windows 10 evaluation
VM as a Windows attack target. Total hardware cost: zero. Build time:
about 4 hours.
CertMaster Labs replicates a similar environment in-browser at $175
if you'd rather not build it yourself. The decision usually comes
down to whether you'll re-use the home lab after Security+ (Net+,
SY0-701 to CySA+ to Pentest+, or self-directed security learning).
The candidates who go on to a security analyst role get more value
from owning the lab. The candidates who just want the cert get more
value from CertMaster Labs.
What are the biggest exam-day mistakes?
Most Security+ failures happen because of pacing or PBQ mismanagement,
not because of knowledge gaps. The same 4 mistakes show up in
post-mortems on Reddit's r/CompTIA every week:
- Spending 8+ minutes on the first PBQ. The exam often opens with one. People panic, over-invest, and run out of time on the easier MCQs at the end. Skip every PBQ on the first pass. Flag them. Return after answering all MCQs.
- Reading every question word-by-word. 90 questions in 90 minutes is 1 minute average. Reading 200-word questions twice eats your buffer. Read once, decide, move on.
- Second-guessing 10+ answers. Statistically, your first answer is right 75% of the time. Don't change answers unless you spot a clear word you misread.
- Skipping the timed practice exams. Candidates who never time themselves discover their pace problem on exam day. By then it's too late.
A practical pre-exam check: take a 90-question practice exam under
real conditions in week 9 (no breaks, no notes, no internet). If you
score 750+ in 75 minutes or less, book the real exam within 7 days.
If you score 700 to 749, study weak areas one more week. If you score
below 700, postpone by 2 to 3 weeks. The voucher fee is too high to
gamble with.
What's next after Security+?
Once Security+ is in hand, three paths open up depending on what you
want from your career:
- Analyst track: CySA+ (CompTIA Cybersecurity Analyst). The natural follow-on. Focuses on SIEM operations, threat hunting, and vulnerability management. Most analysts do this within 6 to 12 months of Security+.
- Offensive security track: Pentest+ (CompTIA Pentest+) or OSCP. Pentest+ stays in the CompTIA ecosystem; OSCP is the gold standard but takes 6 to 9 months of study.
- Cloud security track: AWS Certified Security Specialty or Azure AZ-500 (Security Engineer). Pairs well with Security+ for cloud-focused security analyst roles.
Most people take 6 to 12 months between Security+ and their next
cert. Use that time to ship real production security work in a SOC,
GRC, or pentest role. The cert pays off when hiring managers see it
alongside actual experience, not when it's the only line on your
resume.
Ready to start? Practice with 1,056 real Security+ SY0-701 questions
on NerdExam or browse the
free per-question explanations.
CompTIA's free exam objectives PDF is also worth downloading first if
you haven't: CompTIA Security+ exam objectives.
Adjacent reading: Where to actually buy a Security+ voucher and
which discounts work,
What is MFA, What is Zero Trust,
What is a CVE, and
7 most common reasons people fail IT certification exams.
