CompTIA · certification · Guided course

CompTIA Security+

Security concepts, architecture, operations, governance, and incident response.

SY0-701foundationOfficial provider page ↗

Daily study planConsideringInclude new Sec+ sections and checks in your daily goal.

Catalog noteCompTIA expects Security+ V8 (SY0-801) to launch on or around November 17, 2026. SY0-701 remains available; its English exam retires June 11, 2027. This bank remains mapped to SY0-701 until its migration is reviewed.Provider catalog checked 2026-10-06.

Your course path

Start with the suggested objective

Open a section when you are ready to begin.

Course pace and remaining work

ApproachBuild in orderLearning; no professional IT experience yet

Core work left2316mRemaining short lesson blocks and checks · outside courses vary in length

Target paceNo deadlineSet a target below to calculate required weekly time

General Security ConceptsNot started

1.1 · Compare and contrast various types of security controls.

4 short lesson blocks · next block about 15m

Block 1 · Technical control · Managerial control · Operational control · Physical control

○Study lessonRequired provider lesson ○Block check

Block 2 · Build a control chain instead of trusting one label

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Preventive control

○Study lessonRequired provider lesson ○Block check

Block 4 · Classify temporary substitute safeguards

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 4Start section →

Full course map27 other objectivesOpen when you want to review progress or look ahead

General Security ConceptsNot started

1.2 · Summarize fundamental security concepts.

3 short lesson blocks · next block about 15m

Block 1 · Confidentiality · Integrity · Availability · Non-repudiation

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Turn security principles into access decisions

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish Identity authentication, High availability

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 7Start section →

General Security ConceptsNot started

1.3 · Explain the importance of change management processes and the impact to security.

3 short lesson blocks · next block about 15m

Block 1 · Change approval · Impact analysis · Backout plan · Version control

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Make a security change recoverable and observable

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Change window, Post-change validation

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 10Start section →

General Security ConceptsNot started

1.4 · Explain the importance of using appropriate cryptographic solutions.

4 short lesson blocks · next block about 15m

Block 1 · Symmetric encryption · Asymmetric encryption · Hashing · Digital signature

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose a cryptographic primitive by the property required

○Study lessonRequired provider lesson ○Block check

Block 3 · Validate a certificate path and respond to key compromise

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Choose a protected recoverable data substitute

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 14Start section →

Threats, Vulnerabilities, and MitigationsNot started

2.1 · Compare and contrast common threat actors and motivations.

4 short lesson blocks · next block about 15m

Block 1 · Nation-state actor · Organized crime · Hacktivist · Insider threat

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Use capability, intent, and opportunity to frame an actor hypothesis

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Threat actor capability

○Study lessonRequired provider lesson ○Block check

Block 4 · Scope unapproved services before containment

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 18Start section →

Threats, Vulnerabilities, and MitigationsNot started

2.2 · Explain common threat vectors and attack surfaces.

3 short lesson blocks · next block about 15m

Block 1 · Phishing · Removable media vector · Exposed service · Supply-chain compromise

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Trace a threat vector to the exposed attack surface

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Watering-hole attack, Malicious software update

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 21Start section →

Threats, Vulnerabilities, and MitigationsNot started

2.3 · Explain various types of vulnerabilities.

4 short lesson blocks · next block about 15m

Block 1 · SQL injection · Cross-site scripting · Buffer overflow · Virtual machine escape

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Reason from weakness to precondition and impact

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Race condition

○Study lessonRequired provider lesson ○Block check

Block 4 · Reduce an unsupported system's attack paths

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 24Start section →

Threats, Vulnerabilities, and MitigationsNot started

2.4 · Given a scenario, analyze indicators of malicious activity.

3 short lesson blocks · next block about 15m

Block 1 · Ransomware · Password spraying · Impossible travel · Credential replay

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Correlate indicators into a timed malicious-activity hypothesis

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Command-and-control beacon

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 27Start section →

Threats, Vulnerabilities, and MitigationsNot started

2.5 · Explain the purpose of mitigation techniques used to secure the enterprise.

2 short lesson blocks · next block about 15m

Block 1 · Network segmentation · Application allow list · Security patching · Least privilege

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose a mitigation by the failure path it removes

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 30Start section →

Security ArchitectureNot started

3.1 · Compare and contrast security implications of different architecture models.

3 short lesson blocks · next block about 15m

Block 1 · Shared responsibility · Serverless computing · Container · Industrial control system

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Map responsibility and isolation before choosing architecture controls

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Cloud control plane, Industrial safety system, Serverless execution boundary

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 3Start section →

Security ArchitectureNot started

3.2 · Given a scenario, apply security principles to secure enterprise infrastructure.

5 short lesson blocks · next block about 15m

Block 1 · Jump server · Web application firewall · Intrusion detection system · Intrusion prevention system

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Place controls where the relevant decision is visible

○Study lessonRequired provider lesson ○Block check

Block 3 · Design zones from trust and restrict every conduit

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Choose fail-open or fail-closed from consequence and recovery path

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Distinguish East-west segmentation

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 8Start section →

Security ArchitectureNot started

3.3 · Compare and contrast concepts and strategies to protect data.

3 short lesson blocks · next block about 15m

Block 1 · Tokenization · Data masking · Data encryption · Data hashing

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Protect data according to state, sensitivity, and lifecycle

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Cryptographic key management

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 11Start section →

Security ArchitectureNot started

3.4 · Explain the importance of resilience and recovery in security architecture.

3 short lesson blocks · next block about 15m

Block 1 · Hot site · Cold site · Recovery point objective · Recovery time objective

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Design recovery from business targets and prove restoration

○Study lessonRequired provider lesson ○Block check

Block 3 · Reserve time for recovery and validation

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 14Start section →

Security OperationsNot started

4.1 · Given a scenario, apply common security techniques to computing resources.

4 short lesson blocks · next block about 15m

Block 1 · Secure baseline · Mobile device management · Sandboxing · Code signing

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Harden a resource from a measured baseline

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Application allowlisting, Host firewall baseline

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Separate device identity from management enrollment

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 17Start section →

Security OperationsNot started

4.2 · Explain the security implications of proper hardware, software, and data asset management.

4 short lesson blocks · next block about 15m

Block 1 · Asset inventory · Data classification · Media sanitization · Retention policy

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Maintain security context throughout an asset's custody

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Asset owner, Secure disposal

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · State the limits of a configuration inventory

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 21Start section →

Security OperationsNot started

4.3 · Explain various activities associated with vulnerability management.

3 short lesson blocks · next block about 15m

Block 1 · CVE identifier · CVSS score · False positive · Compensating control

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Turn vulnerability findings into owned remediation decisions

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish Exploitability context

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 24Start section →

Security OperationsNot started

4.4 · Explain security alerting and monitoring concepts and tools.

3 short lesson blocks · next block about 15m

Block 1 · SIEM · NetFlow · Data loss prevention · SNMP trap

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Trace an alert from source event to analyst decision

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Log time normalization, Alert tuning

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 27Start section →

Security OperationsNot started

4.5 · Given a scenario, modify enterprise capabilities to enhance security.

3 short lesson blocks · next block about 15m

Block 1 · DMARC · SPF · DKIM · DNS filtering

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Modify a security capability and test both sides of policy

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Egress filtering

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 30Start section →

Security OperationsNot started

4.6 · Given a scenario, implement and maintain identity and access management.

3 short lesson blocks · next block about 15m

Block 1 · Role-based access control · Attribute-based access control · Just-in-time access · Passwordless authentication

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Trace identity proof, authentication, authorization, and session state

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Separate Kerberos tickets from resource permissions

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 2Start section →

Security OperationsNot started

4.7 · Explain the importance of automation and orchestration related to secure operations.

4 short lesson blocks · next block about 15m

Block 1 · Automation guardrail · Ticket automation · Orchestration failure point · Security pipeline test

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Automate security work with idempotence, guardrails, and recovery

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Automation service account, Automation idempotency

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Bound the cost of automated read-only queries

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 6Start section →

Security OperationsNot started

4.8 · Explain appropriate incident response activities.

2 short lesson blocks · next block about 15m

Block 1 · Containment · Eradication · Chain of custody · Legal hold

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Contain an incident while preserving recovery and evidence options

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 8Start section →

Security OperationsNot started

4.9 · Given a scenario, use data sources to support an investigation.

3 short lesson blocks · next block about 15m

Block 1 · Firewall log · Packet capture · Endpoint log · Vulnerability scan

○Study lessonRequired provider lesson ○Block check

Block 2 · Ask each data source only the questions it can answer

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Evidence timeline

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 11Start section →

Security Program Management and OversightNot started

5.1 · Summarize elements of effective security governance.

3 short lesson blocks · next block about 15m

Block 1 · Policy · Standard · Procedure · Guideline

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Connect governance intent to enforceable and testable work

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Policy exception

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 14Start section →

Security Program Management and OversightNot started

5.2 · Explain elements of the risk management process.

3 short lesson blocks · next block about 15m

Block 1 · Single loss expectancy · Annualized rate of occurrence · Annualized loss expectancy · Risk register

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Write a risk as a causal scenario with an accountable owner

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Use quantitative estimates without hiding uncertainty

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 17Start section →

Security Program Management and OversightNot started

5.3 · Explain the processes associated with third-party risk assessment and management.

3 short lesson blocks · next block about 15m

Block 1 · Service-level agreement · Non-disclosure agreement · Statement of work · Right-to-audit clause

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Convert supplier promises into scoped assurance and exit controls

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Vendor data-return requirement, Vendor breach notification

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 20Start section →

Security Program Management and OversightNot started

5.4 · Summarize elements of effective security compliance.

3 short lesson blocks · next block about 15m

Block 1 · Data controller · Data processor · Right to erasure · Compliance attestation

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Translate an obligation into scoped control evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Data residency, Records of processing

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 23Start section →

Security Program Management and OversightNot started

5.5 · Explain types and purposes of audits and assessments.

3 short lesson blocks · next block about 15m

Block 1 · Internal audit · External audit · Known-environment test · Unknown-environment test

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Choose an assessment that can answer the assurance question

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Distinguish Rules of engagement, Assessment remediation validation, Control self-assessment

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 27Start section →

Security Program Management and OversightNot started

5.6 · Given a scenario, implement security awareness practices.

3 short lesson blocks · next block about 15m

Block 1 · Phishing reporting · Situational awareness · Removable media training · Recurring security training

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Design awareness around risky decisions and measurable reporting behavior

○Study lessonRequired provider lesson ○Block check

Block 3 · Distinguish Role-based security training, Training effectiveness measure

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 30Start section →

★

Course progression checks

Complete these quizzes and labs to finish the guided course. The readiness checklist below has additional requirements. Course completion does not predict your exam result.

○Pass both current-profile 90-question final forms at 85%+ within 180 days○Pass 5 distinct current in-browser scenarios whose mapped content spans 5 exam domains at 70%+ within 180 days

Open practice →

Optional learning resources3 choicesOpen for another teacher, format, or question review

Optional

Another explanation or review

Messer is mapped across all objectives; eleven blocks also offer a timestamped Inside Cloud and Security choice. Ramdayal adds optional free SY0-701 question review after lessons. These resources do not change course progress or readiness.

Professor MesserExam-Aligned Course · Free