CompTIA Security+ SY0-701 Study Plan 2026

Topics

• • CIA triad (confidentiality, integrity, availability)
• • AAA framework (authentication, authorization, accounting)
• • Zero Trust architecture: never trust, always verify
• • Security control types: technical, managerial, operational, physical
• • Cryptographic concepts: symmetric, asymmetric, hashing, PKI
• • Change management processes
• • Network security: firewalls, IDS/IPS, VPNs, segmentation
• • Cloud security models and shared responsibility
• • Physical security controls

Activities

• • Complete the Professor Messer SY0-701 video course for Domains 1 and 3. Take notes mapped to the official exam objectives.
• • Write the CIA triad and AAA framework from memory. For each element, write one real-world example.
• • Draw a network diagram with a DMZ, firewall, IDS, and internal network. Label where each device sits and why.
• • Explain the difference between symmetric and asymmetric encryption, and when to use each.
• • Complete a Daily Sprint in Rookie mode. Flag any topic below 60%.

Topics

• • Threat actors: nation-state, organized crime, hacktivist, insider, script kiddie
• • Social engineering: phishing, vishing, smishing, pretexting, tailgating
• • Malware types: virus, worm, trojan, ransomware, rootkit, spyware
• • Network attacks: DoS, DDoS, MITM, spoofing, DNS poisoning
• • Application attacks: injection, XSS, CSRF, buffer overflow
• • Vulnerability types and scanning
• • Threat intelligence and threat hunting
• • AI-augmented threats: deepfakes, AI-generated phishing

Activities

• • Complete the Professor Messer SY0-701 video course for Domain 2.
• • Build a table of 15 attack types with one identifying symptom and one mitigation for each.
• • Write a one-page threat actor profile for each of the five main threat actor categories.
• • Complete a Daily Sprint in Challenger mode on Domain 2. Repeat until you pass two consecutive sessions.
• • Take one Mock Exam in Challenger mode. Review every missed question.

Topics

• • Security monitoring: SIEM, SOAR, log aggregation
• • Alerting and triage
• • Vulnerability management lifecycle: identify, prioritize, remediate, verify
• • Vulnerability scanning tools and techniques
• • Penetration testing vs vulnerability assessment
• • Endpoint detection and response (EDR)
• • Security automation and orchestration

Activities

• • Complete the Professor Messer SY0-701 video course for Domain 4 (first half: monitoring and vulnerability management).
• • Install Wireshark in a lab environment and capture HTTP traffic. Identify the TCP handshake and at least one unencrypted credential.
• • Use Nmap to scan a single host in your lab. Interpret the open ports and identify the services.
• • Write a vulnerability management workflow: from scan to remediation to verification. Include escalation criteria.
• • Complete a Daily Sprint in Challenger mode on Domain 4 (monitoring portion). Repeat until you pass two consecutive sessions.

Topics

• • Incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned
• • Digital forensics: evidence handling, chain of custody, order of volatility
• • Identity and access management: authentication factors, SSO, federation, privileged access
• • Backup and recovery: RTO, RPO, backup types
• • Automation and orchestration in incident response

Activities

• • Complete the Professor Messer SY0-701 video course for Domain 4 (second half: incident response and forensics).
• • Write the incident response lifecycle from memory. For each phase, write one action a security analyst would take.
• • Document the order of volatility for digital evidence from most volatile to least volatile.
• • Design an IAM solution for a hybrid workforce: specify authentication methods, access control model, and privileged access controls.
• • Complete a Daily Sprint in Challenger mode on Domain 4 (incident response). Repeat until you pass two consecutive sessions.

Topics

• • Governance: policies, standards, procedures, guidelines
• • Risk management: risk assessment, risk register, risk treatment (avoid, transfer, mitigate, accept)
• • Compliance frameworks: GDPR, HIPAA, PCI-DSS, SOC 2
• • Security awareness training design
• • Third-party risk management and vendor assessment
• • Business continuity and disaster recovery planning
• • Data classification and privacy

Activities

• • Complete the Professor Messer SY0-701 video course for Domain 5.
• • Create a risk register for a sample organization with five risks. Include likelihood, impact, and treatment choice for each.
• • Map GDPR, HIPAA, and PCI-DSS requirements to a hypothetical healthcare company's data flows.
• • Design a security awareness training program with three modules and success metrics.
• • Complete a Daily Sprint in Challenger mode on Domain 5. Repeat until you pass two consecutive sessions.

Topics

• • PBQ format: drag-and-drop, firewall rule configuration, log interpretation, network diagram labeling
• • PBQ strategy: read the full task before acting, verify before submitting
• • Full syllabus review across all five domains
• • Time management (90 minutes for up to 90 questions)
• • Distractor elimination for scenario-based questions

Activities

• • Complete at least 5 full PBQ exercises. Focus on firewall rule configuration, drag-and-drop matching, and network diagram labeling.
• • Take at least 3 Mock Exams in Legend mode. For every missed question, write one sentence explaining the security principle behind the correct answer.
• • Simulate real exam conditions once: no phone, no breaks, 90 minutes, same time of day as your scheduled exam.
• • Practice time management: budget 2 minutes per PBQ and 45 seconds per multiple choice question. Adjust based on your PBQ count.
• • Book your exam when your readiness score is stable and above 80, with every domain covered.