SY0-801 Study Plan: 4-Week and 8-Week Options

The short answer

Plan on roughly 60 to 120 hours of study in total. If you already work in IT and know networking, four weeks of 15 to 20 hours each can be enough. If security is new to you, eight weeks of 8 to 12 hours each is safer. These ranges are estimates, not promises. Your background, how you learn, and how often you review all change the number.

Pick the plan that matches your starting point, follow the order of the domains, and use practice exams to decide where to spend the extra hours.

Before you start

Download the free exam objectives from the CompTIA Security+ V8 page. Print or copy the list and tick topics off as you learn them.
Pick a main learning source: a book, a video course or the vendor’s own learning material. Practice exams measure readiness. They do not replace learning material.
Book the exam date once you finish week 1. A date makes the plan real. Remember that CompTIA expects the exam to launch on or around November 17, 2026.
Keep a short notebook of things you got wrong and why. You will reread it in the last week.

For general habits such as spaced review and active recall, see how to study for IT certification exams.

The 4-week plan

Best for people with IT experience and some security exposure. About 15 to 20 hours per week.

Week 1: Domain 1 (16%) and the start of Domain 2. Cover control categories and types, Zero Trust, change management (approvals, backout, fail forward) and cryptography: symmetric and asymmetric encryption, hashing, digital signatures, certificates and PKI. Start threat actors and motivations. End the week with a short quiz on what you covered.

Week 2: Finish Domain 2 (24%) and Domain 3 (19%). Study threat vectors, vulnerabilities, indicators of malicious activity and the AI risks objective. Then architecture: cloud and hybrid models, segmentation, data protection, resilience and recovery. Take your first practice exam at the end of the week, cold, and read every explanation.

Week 3: Domain 4 (27%). This is the biggest block, so give it the whole week. Work through hardening, firewalls and intrusion tools, email security, vulnerability management, monitoring, identity and access, automation and incident response. Do small labs if you can, such as reading a firewall rule set or a log file.

Week 4: Domain 5 (14%), review and timed practice. Cover governance, risk calculations, third-party risk, compliance, audits and awareness training. Spend the second half of the week on timed practice exams, reviewing weak domains each day.

The 8-week plan

Best for people new to security or returning to study after a break. About 8 to 12 hours per week.

Week	Focus	Domain
1	Core concepts: CIA, AAA, control categories and types, Zero Trust, least privilege	1
2	Cryptography and PKI, then change management	1
3	Threat actors, vectors, vulnerabilities, scoring (CVSS, CVE)	2
4	Indicators of malicious activity, malware, social engineering, application and credential attacks, AI risks	2
5	Architecture models, secure design, data protection, resilience and recovery	3
6	Mitigating controls, asset and vulnerability management, monitoring and alerting	4
7	Identity and access, automation, incident response, investigation sources	4
8	Governance, risk, third-party risk, compliance, audits, awareness; final timed practice	5

Take a baseline practice exam at the end of week 2 or 3 to see where you stand. It will feel hard. That is the point. Take another after week 6, and then one full timed set in week 8.

How to use practice exams in the plan

Baseline test: early, with no preparation, to find gaps.
Topic review: after each domain, answer questions on that domain only, and read the explanation for every option, including the ones you got right.
Timed sets: in the last two weeks, sit full sets with a timer and no notes. The real exam gives you about a minute per question.
Error log: write down each miss in one line: what the question tested, why you chose your answer, and what rule would have led you to the right one.

Keep a target score for practice exams that sits comfortably above the passing line. Our sets use pass marks that are deliberately higher than the exam needs. See how we write our questions for the thinking behind that.

Topics that deserve extra time

The difference between similar terms: hashing versus digital signatures, tokenization versus masking, hot versus warm versus cold sites, RTO versus RPO.
Risk math: single loss expectancy, annualized rate of occurrence and annualized loss expectancy.
Order and sequence: incident response phases, order of volatility, change management steps.
Email authentication records: SPF, DKIM and DMARC.

The last three days

Three days out: take your last full timed practice exam. Review every miss in the error log.
Two days out: reread the error log and your notes on the confusing pairs. Review the acronym list in the objectives document. Do not learn new topics.
The day before: light review for an hour at most. Check your ID, your booking and your route or your online-proctoring system check. Sleep.
Exam day: eat, arrive early and use the flag-and-return approach for long questions. Our exam day guide has a checklist.

What if you are behind?

Move the exam date rather than skipping a domain. Skipping Domain 4 in particular is costly because it is the largest block. If time is short, trim depth in Domain 5 before you trim breadth anywhere else.

More guides for SY0-801

Next step

Read the domains explained to see what to practice in each domain. When your first domain is done, the SY0-801 practice tests give you five sets to use as baseline, topic review and final timed check.

Try the SY0-801 practice exams