CompTIA Security+: what it covers and an eight-week study plan

What the exam measures

Security+ is a broad entry-level certification covering general security concepts, threats and vulnerabilities, security architecture, security operations, and program management and oversight. It includes multiple-choice and performance-based questions and is widely listed for entry security roles and some government positions. Check CompTIA’s current exam code and objectives before you plan, because versions are refreshed every few years.

• General security concepts: controls, CIA, zero trust, cryptography basics
• Threats, vulnerabilities, and mitigations
• Security architecture: on-premises, cloud, and network design
• Security operations: monitoring, incident response, identity
• Program management: governance, risk, compliance, awareness

An eight-week outline

Spend the first six weeks on domains in order of weight and weakness, with one lab task per objective cluster. Use week seven for full practice exams and gap repair, and week eight for review and rest. About an hour a day on weekdays and two on weekends is a typical pace for someone with some IT background.

week 1  general concepts; lab: classify controls in your home lab
week 2  threats and vulnerabilities; lab: read Windows failed-logon events
week 3  architecture; lab: diagram segmented lab network with firewall rules
week 4  operations part 1; lab: centralize logs into a SIEM
week 5  operations part 2; lab: write an incident timeline from logs
week 6  program management; lab: draft a one-page risk register
week 7  two full timed practice exams; fix weakest objectives
week 8  flashcard review, light practice, rest before exam

Lab: one objective, three ways

Choose one objective, such as comparing authentication methods. Write five flashcards, do a hands-on task such as enabling multi-factor authentication on a test account and reviewing its sign-in log, and answer ten practice questions on it. Note which of the three methods exposed gaps, and use that mix for the remaining objectives.

After Security+

Common next steps are CySA+ or a practical blue team certification for defensive roles, or eJPT for offensive interest, along with a provider cloud certification if your target jobs are cloud heavy.