Free Security+ study kit

Security+ study plan: four weeks, one printable review sheet

A free plan for CompTIA Security+ SY0-701, weighted by how much each domain counts on the exam, with a one-page review sheet you can print or save as PDF. It also answers the question everyone has right now: SY0-701 or the new SY0-801?

Start with the free diagnostic

SY0-701 or SY0-801?

ItemSY0-701 · V7SY0-801 · V8
Exam codeSY0-701 (V7)SY0-801 (V8)
AvailableSince 7 November 2023Expected on or around 17 November 2026
English retirement11 June 2027Estimated three years after launch
FormatUp to 90 questions, 90 minutes, pass at 750 (100–900)Up to 90 questions, 90 minutes, pass at 750 (100–900)
Domain weights (1 → 5)12 · 22 · 18 · 28 · 20 %16 · 24 · 19 · 27 · 14 %

If you are already studying and can sit the exam before June 2027, stay on SY0-701: CompTIA itself says V7 "remains a strong option". If you are starting from zero and booking late next year, plan for SY0-801, which adds coverage of AI-related risks. The five domains keep the same order in both versions, so most of the work carries over. CertSprint's question bank is mapped to SY0-701.

Checked 2 November 2026 on CompTIA Security+ V7 (SY0-701) and CompTIA Security+ V8 (SY0-801).

The plan

Four weeks, weighted by the exam

Plan on about an hour on weekdays. If a checkpoint fails, give that week a few more days: the weights tell you where extra time pays off most.

  1. Week 1 · The vocabulary

    General Security Concepts · 12% of the exam · 83 practice questions

    • Take the free diagnostic first, before reading anything. It shows where you already stand.
    • Learn control categories and control types as two separate axes (see the review sheet).
    • Cover the CIA triad, AAA, zero trust (policy engine, administrator, enforcement point) and the PKI building blocks: hashing, signatures, certificates.

    Checkpoint: You can classify any control by category and by type without hesitating.

  2. Week 2 · Attacks and their answers

    Threats, Vulnerabilities & Mitigations · 22% of the exam · 118 practice questions

    • Threat actors by attribute: resources, sophistication, motivation, not just the label.
    • Threat vectors and vulnerability types across application, OS, web, cloud, hardware and supply chain.
    • For every attack you study, write down the single best mitigation, not just one that helps.

    Checkpoint: Given a scenario, you name the specific weakness before you look at the options.

  3. Week 3 · Where controls go, and who owns them

    Security Architecture · 18% of the exam · 106 practice questions + Security Program Management & Oversight · 20% of the exam · 104 practice questions

    • Architecture models, security zones, device placement and fail-open versus fail-closed.
    • Data protection: what is reversible and what is not (encryption, hashing, tokenization, masking).
    • Governance, risk management, third-party risk, compliance, audits and security awareness.

    Checkpoint: You can say which asset a control protects and which policy or role requires it.

  4. Week 4 · Operations, then a full timed run

    Security Operations · 28% of the exam · 135 practice questions

    • Hardening, vulnerability management, monitoring and alerting, identity and access management.
    • The incident response order on the review sheet, and what belongs to each phase.
    • End the week with a timed simulation: 90 questions in 90 minutes, then review every miss by domain.

    Checkpoint: No domain is far below the others. Fix the weakest one before you book.

One-page review sheet

Insecure protocol → secure replacement

InsecureUse instead
Telnet · 23SSH · 22
FTP · 20/21SFTP · 22 (over SSH) or FTPS · 989/990
HTTP · 80HTTPS · 443
LDAP · 389LDAPS · 636
SNMP v1/v2c · 161/162SNMPv3 · 161/162 (adds authentication and encryption)
POP3 · 110POP3S · 995
IMAP · 143IMAPS · 993
SMTP · 25SMTPS · 465, or submission · 587 with STARTTLS
DNS · 53DNSSEC (integrity and origin, not confidentiality)

Controls: two separate axes

Categories
Technical · Managerial · Operational · Physical
Types
Preventive · Deterrent · Detective · Corrective · Compensating · Directive
Example
A firewall rule is technical and preventive; a security camera is physical and detective (deterrent when visible).

Protecting data: is it reversible?

Encryption
Reversible with the key.
Hashing
One-way. Proves integrity; salted for stored passwords.
Tokenization
Value replaced by a token; the original lives in a separate vault.
Masking
Hides part of the value when displayed (•••• 4821).

Incident response, in order

  1. Preparation
  2. Detection
  3. Analysis
  4. Containment
  5. Eradication
  6. Recovery
  7. Lessons learned

Recovery metrics

RPO
How much data you can afford to lose, measured in time.
RTO
How long until the service must be back.
MTTR
Average time to repair.
MTBF
Average time between failures.

getcertsprint.com · CompTIA Security+ SY0-701

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. No account or card needed; create a free account only to keep your progress on every device.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

Practise each week's domain

546 Security+ questions mapped to the SY0-701 domains, each with a full explanation. The first 20 are free.

Start free