The shape of the plan
Eight weeks, 45-60 minutes a day, five days a week. That is roughly 35 hours of focused study, enough for Security+ if every hour aims at a gap instead of re-reading what you already know. If you have no IT background, add two weeks at the front for Network+ basics.
Weeks 1-2: Vocabulary (General Security Concepts, 12%)
Learn the language first: CIA triad, AAA, control types, crypto basics, physical controls. This domain is only 12%, but every later domain speaks its vocabulary. Drill the acronyms until recognition is instant.
Weeks 3-4: Threats (Threats and Mitigations, 22%)
Actors, vectors, vulnerabilities, indicators, mitigations. This is the biggest memorization block. Pair every attack with its one distinguishing detail (channel for phishing family, trigger for logic bombs, stealth for APTs). Start one topology lab per week now; firewall logic rewards early exposure.
Weeks 5-6: Architecture + Operations core (18% + half of 28%)
Security zones, WAF vs firewall, VPNs, hardening, asset management, vulnerability management, monitoring. This is where the ports sheet earns its keep: learn each port with its job and direction, not as a number.
Week 7: Operations finish + Governance (rest of 28% + 20%)
Identity, automation, incident response order, risk math (ALE = SLE × ARO, practice the arithmetic), third-party risk, compliance, awareness. Governance feels boring and scores easy points. Do not skip it.
Week 8: Simulate, patch, book
Two full 90-question sittings under the 90-minute clock, three days apart. After each, study ONLY the missed domains for two days, then re-simulate. Book the exam when a fresh simulation (questions you have never seen) lands comfortably above your target, not when repeats feel easy.
What a study day looks like (50 minutes)
- 0-5: warm-up. Five flashcards or ports from the queue. No new material. Wake the memory up.
- 5-30: today's session. Twenty-five questions aimed at your gaps. Mark confidence honestly; read every explanation, including for ones you got right by luck.
- 30-40: one lab or game. Alternate days: firewall or log lab one day, Port Patrol or Decode Drop the next.
- 40-50: notes and queue. Convert today's misses into study notes (one tap each), glance at tomorrow's flashcard forecast, stop.
The rules that make it work
- Daily sessions beat weekend marathons. Spaced repetition needs sleep between sessions.
- Confidence matters. Mark guesses as guesses. Lucky hits need review too.
- Labs before exam month. Performance questions come first on exam day; meet them in practice labs by week 4.
- Never study your strengths in week 8. The readiness view names your weakest topics: that list IS the week-8 syllabus.
Where the hours go
Domain weights are not study weights, but they are the closest honest guide we have. A sensible split of 35 hours:
- General Security Concepts (12%): about 3 hours. Vocabulary and control types. Learn it once, use it everywhere.
- Threats and Mitigations (22%): about 8 hours. The biggest memory block. Spend the time on indicators and mitigations, not on actor trivia.
- Architecture (18%): about 6 hours. Zones, segmentation, crypto placement, resilience. Draw the diagrams by hand.
- Security Operations (28%): about 10 hours. The heaviest domain and the one most people under-study. Monitoring, identity, incident response, automation.
- Governance (20%): about 6 hours. Risk math, third-party risk, compliance, awareness. Cheap points if you read carefully.
- Two full simulations: about 4 hours including review. Not optional.
If a domain is already strong from your job, move its hours to Operations or Threats. The plan bends; the simulation decides.
If you only have four weeks
You can still sit the exam, but the plan changes shape. Spend week 1 on vocabulary and the ports sheet, because every later question speaks that language. Spend week 2 on threats and architecture together, since attacks and controls explain each other. Week 3 is Operations, all of it, with one lab a day. Week 4 is Governance plus two full sittings, three days apart, and nothing new after the second sitting. You will not cover every objective in depth. You will cover the ones that decide the score.
The resource stack, and what to skip
Use three things. The official objectives PDF is the syllabus: every topic you study should map to a line in it. One video course, free or cheap, gives the first explanation of each domain. This site gives the questions and labs that turn recognition into recall. That stack is enough.
Skip anything selling stolen test content. It is often wrong, and using it risks your certification. Skip a second video course unless the first one lost you completely. Skip buying three simulators; one good simulator, reviewed properly, teaches more than three rushed ones.
Practise with labs and PBQs
Weeks 1 to 3 are for reading. Week 4 is where hands should start, and not later. The SY0-701 pack holds 56 performance-based questions and 47 labs, every one graded on the state you leave rather than the words you choose, and every count on this page is read from the live catalogue.
Book them the way you book questions. Take one lab on the topic you studied that morning, in the same session if you can, because the gap between reading and doing is where most of a study week quietly disappears. Start with control selection and firewall rules, which are the two shapes the exam repeats most, then move to log triage and incident order. The SY0-701 lab catalogue sorts them by objective, and the labs hub covers the other certifications if you are studying more than one.
Two rules make the time count. After a failure, write the sentence you would say to a colleague: what you changed and how you proved it. Then redo the same lab from scratch a week later, because the second run is the one that survives exam pressure. The PBQ method is the long version of both rules, and it is worth reading before your first sitting rather than after it.
Exam week, day by day
Monday: one full simulation under time. Review every miss the same day, and write one sentence per miss. Tuesday: patch the two weakest domains, no new material. Wednesday: light day. Ports, acronyms, and the risk formulas for 30 minutes. Thursday: second full simulation, earlier in the day if possible, so your brain practices at exam time. Friday: review the simulation, pack your ID, confirm the appointment, sleep. Saturday: exam.
Do not study new material in the last 48 hours. A new topic you half-learn competes with everything you know, and the exam rewards calm recall.
If you fail
A fail is information, not a verdict. The score report lists your domain percentages. The two lowest domains are your next study plan, and the gap between them and your best domain tells you how far away you were. Book the retake while the material is warm, usually two to four weeks out, and study only the listed weak domains plus one full simulation. Do not restart the whole course. You are patching, not rebuilding.
One more habit: keep a single page of mistakes. Every question you miss gets one line, written in your own words. Read that page before each simulation. Most people miss the same three or four ideas in different clothes.