CompTIA Security+ Roadmap: Free Lessons and Labs by Exam Domain

Why it matters. Security+ is the certificate most entry-level security jobs ask for. The new version, V8 (exam code SY0-801), launches on 17 November 2026; the older SY0-701 stays available for a while after that. The topics overlap heavily, so everything here helps with either.

What V8 covers

Domain	Weight
1. General Security Concepts	16%
2. Threats, Vulnerabilities, and Attacks	24%
3. Security Architecture	19%
4. Security Operations	27%
5. Security Program Management and Oversight	14%

Up to 90 questions (multiple choice plus hands-on performance-based tasks) in 90 minutes; the passing score is 750 on a scale of 100 to 900. Check CompTIA’s official exam objectives before you book.

New to IT? Start with the Tech+ roadmap and the Network+ roadmap first; Security+ assumes you know how networks and computers work.

Domain 1: General Security Concepts (16% of the exam)

• Cryptography and PKI explained — hashing, AES, RSA, signatures and certificates, all hands-on
• Network security explained — AAA, common attacks and hardening
• Strong passwords and passphrases — authentication basics done right
• Canary tokens — deception: tripwires that tell you someone is snooping
• Home honeypot lab (OpenCanary) — a decoy that attracts and logs attackers
• DNSSEC explained — digital signatures protecting DNS

Domain 2: Threats, Vulnerabilities, and Attacks (24% of the exam)

• Read email headers and report phishing — spot spoofed senders
• AI scam defense guide — voice clones, deepfakes and social engineering
• Cyber kill chain — how attacks unfold, step by step
• ARP lab — on-path (MITM) attacks on a local network, in your own lab
• Detect a man-in-the-middle — spotting on-path attacks
• Leaked secrets — API keys and passwords left in code
• Dangling DNS and subdomain takeover — a misconfiguration attackers love
• BYOVD defense lab — vulnerable drivers used to kill security tools
• OWASP Juice Shop lab — web application vulnerabilities on your own target
• OWASP LLM Top 10 — threats to AI apps

Domain 3: Security Architecture (19% of the exam)

• VLANs and 802.1Q lab — segmentation
• NAT and firewall lab — stateful filtering, and why NAT isn’t a firewall
• Linux firewall (Linux Defenders 4) — host-based firewall rules
• WireGuard VPN lab — secure remote access
• Cloud networking and SDN explained — shared responsibility, security groups and NACLs
• Docker security lab — container isolation
• High availability and DR — redundancy, backups and recovery sites

Domain 4: Security Operations (27% of the exam)

• Incident response explained — the six phases, order of volatility and chain of custody
• SPF, DKIM and DMARC explained — email security that stops spoofing
• Splunk SIEM home lab — collect and search logs
• Which SIEM to learn — Splunk, Wazuh, QRadar and more compared
• Wazuh lab — free SIEM and XDR
• Wazuh agent alerts — endpoint monitoring
• Suricata IDS lab — write rules, catch a port scan, tune a noisy alert, then block as an IPS
• Keycloak single sign-on lab — one login for two apps, ID tokens, single logout and MFA (OIDC, SAML, OAuth)
• Atomic Red Team + Wazuh — test your detections against real techniques
• Syslog and SNMP monitoring — log collection and monitoring
• auditd (Linux Defenders 12) — who did what, and when
• SSH hardening (Linux Defenders 5) — secure remote administration
• Patching (Linux Defenders 6) — vulnerability management basics
• Vulnerability scanning lab — scan with Greenbone OpenVAS, rank with CVSS, EPSS and KEV, fix and rescan
• OpenSCAP — check a system against a security baseline
• Windows security log encyclopedia — event IDs you’ll meet
• FLARE VM file triage — safe first look at a suspicious file

Domain 5: Security Program Management and Oversight (14% of the exam)

• Risk management explained — SLE, ALE, ARO, RTO, RPO, policies and vendor agreements
• Backup and restore drill — prove your RPO and RTO
• Bug bounty platforms compared — how organizations pay outsiders to find flaws

Study games

Short, free games that drill the same things the exam asks, a different way. Best scores stay on your device.

• Port Match — timed rounds matching ports to protocols
• Put It In Order — OSI, incident response phases, order of volatility, Kill Chain
• Log Hunt — spot the attack in short logs, like the hands-on exam questions
• Flashcards — acronyms with spaced repetition
• Mnemonic Lab — memory phrases for every ordered list (Please Do Not Throw Sausage Pizza Away)
• PBQ simulator — five exam-style tasks: firewall rules, log evidence, vulnerability priority, control placement, subnetting
• Incident timeline lab — five logs, one incident, one timeline (PBQ practice)

Test yourself

Take the free Security+ practice test: 59 questions across all five V8 domains, each with an explanation, a memory hook and a link to the lesson. You get a score per domain at the end.

More free study

Free cybersecurity training (courses and videos) and free practice labs.

Roadmap, written by StashGrid with AI help. Domain names, weights and exam facts from CompTIA’s Security+ V8 page as published on 30 Oct 2026. Labs that use attack tools run only on machines you own, in an isolated lab. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.