A 30-Day Study Plan for CompTIA Security+ (SY0-701)

CompTIA Security+ (SY0-701) is the cert most hiring teams treat as the baseline proof that you understand security. The exam is a maximum of 90 questions in 90 minutes, scored on a scale of 100 to 900 with a passing score of 750. A voucher runs about $425 in the US. The questions are a mix of multiple-choice and performance-based questions (PBQs), and that mix is exactly why people who "know the material" still fail.

This is a 30-day plan for a working IT person with one to two hours a day. That works out to roughly 35 to 45 study hours over the month. It assumes you already touch networks, endpoints, or tickets at work and that the vocabulary is not brand new to you. If security is genuinely foreign, give yourself six weeks instead, which is the lower end of what CompTIA itself suggests.

The plan is mapped to the five SY0-701 domains and their weights, because spending equal time on each domain is the most common way to waste this month.

How the exam actually weights your time#

Here are the official domains and weights. Budget your hours against these, not against which topics feel comfortable.

Domain 4.0 alone is more than a quarter of the exam, and domains 2.0, 4.0, and 5.0 together are 70% of it. If you only have a month, those three are where the bulk of your hours go.

Week 1: General Security Concepts and Threats (days 1 to 7)#

Cover domain 1.0 (12%) in the first two days, then start on the front half of domain 2.0 (22%).

• CIA triad, AAA, and the control types (technical, managerial, operational, physical) and categories (preventive, deterrent, detective, corrective, compensating, directive). Expect the exam to ask you to classify a control, not just define it.
• Change management and why it shows up on a security exam (approval, backout plans, maintenance windows).
• Cryptography concepts: symmetric versus asymmetric, hashing, digital signatures, PKI, certificates. Know what each one provides (confidentiality, integrity, authentication, non-repudiation).
• Threat actors and motivations, threat vectors, and attack surfaces.

Budget: about 8 to 9 hours. End the week by doing 20 to 30 practice questions on domains 1.0 and 2.0 so you find your gaps early instead of on exam day.

Week 2: Threats and Security Architecture (days 8 to 14)#

Finish domain 2.0 and move into domain 3.0 (18%).

• Malware types, social engineering techniques, and the indicators of malicious activity (the "you see X in a log, what is happening" questions).
• Common vulnerabilities and mitigation techniques: segmentation, access control, patching, hardening, isolation.
• Architecture models: cloud, on-premises, serverless, zero trust, and the security implications of each.
• Data protection: classification, encryption at rest and in transit, tokenization, masking.
• Resilience and recovery: high availability, backups, site types (hot, warm, cold), testing.

Budget: about 9 to 10 hours. This is a heavy concept week. Mix reading with questions so it does not turn into passive highlighting.

Week 3: Security Operations (days 15 to 21)#

This is the big one. Domain 4.0 is 28% of the exam, so it gets the most time of any single week.

• Hardening, secure baselines, and applying controls to endpoints, mobile, and cloud resources.
• Asset and vulnerability management: scanning, CVSS, remediation, validation.
• Monitoring and alerting: SIEM, log sources, SNMP, NetFlow, and what "tuning" means.
• Identity and access management: provisioning, MFA, SSO, federation, privileged access management, least privilege.
• Automation and orchestration (SOAR) at a concept level.
• Incident response: the phases (preparation, detection, analysis, containment, eradication, recovery, lessons learned), plus digital forensics basics.

Budget: about 10 to 12 hours. Do a timed 30-question set at the end of the week covering only domain 4.0. If you are below 70% here, you are not ready, and this is the domain to fix first.

Week 4: Program Management plus full review (days 22 to 30)#

Cover domain 5.0 (20%) in the first three or four days, then switch entirely to review.

• Governance: policies, standards, procedures, guidelines, and the roles (owner, custodian, processor, controller).
• Risk management: identification, assessment (qualitative versus quantitative), SLE, ALE, ARO, risk responses (accept, transfer, avoid, mitigate).
• Third-party and vendor risk, agreements (SLA, MOU, MSA, BPA).
• Compliance, privacy, audits, and security awareness practices.

Then spend days 26 to 30 on full-length, timed practice exams. Take at least two under real conditions: 90 minutes, no notes, no pausing. Score by domain and spend your last days on whatever sits below 75%. The day before, do light review and sleep. Do not cram new material.

Budget: about 8 to 10 hours.

The practice-question ratio and PBQ strategy#

By the back half of this plan, more than half your study time should be answering questions, not reading. A useful target is roughly 60% questions and 40% reading once you finish week two. Questions surface the gaps that reading hides, and they train the pattern-matching the exam rewards. If you want a sense of how many full practice tests is enough before you book, we wrote about that here.

PBQs are where prepared candidates lose points. They appear first on the exam, they take longer than multiple-choice, and they are weighted heavily. Two rules:

1. Skip and flag PBQs on your first pass if they stall you. Answer every multiple-choice question first, bank those points, then come back. Spending 12 minutes on one PBQ while 40 multiple-choice questions wait is how people run out of clock.
2. Practice the actual interaction types beforehand: configuring a firewall rule, matching an attack to a defense, reading a log and identifying the indicator. Knowing the concept is not the same as clicking through the simulation under time pressure.

What to drop if you fall behind#

If you lose several days, do not try to compress everything evenly. Protect domains 4.0 (28%) and 2.0 (22%) and your practice exams. Trim from the lower-weight, more memorization-heavy material: skim parts of domain 1.0 cryptography detail and the long acronym lists in domain 5.0, and lean on practice questions to backfill those instead of reading every page. Never sacrifice your two timed full-length exams. They are the highest-value hours in the month.

The one trap that fails candidates#

Memorizing definitions instead of practicing judgment. SY0-701 rarely asks "what is a SIEM." It asks "given this scenario, which control best addresses the risk," and several answers are technically correct security measures. The exam wants the best fit for the situation, not the first true statement. Candidates who only flash-card terms blank on these. The fix is volume of scenario questions plus reading the explanation on every one you miss, not just the ones you get wrong. If you want a fuller picture of the difficulty curve, see is the CompTIA Security+ exam hard, and if you are weighing this against a more advanced cert, Security+ versus CISSP covers when each one makes sense.

One scheduling note: if the worst happens, CompTIA does not require a waiting period between your first and second attempt, so a near miss is not a month-long setback. You would only wait (at least 14 days) before a third attempt.

Ready to put this into practice? Start a free practice test on ExamCoachAI. The free tier gives you 10 questions a day, which is enough to run the daily drilling this plan is built around.