A Security+ study plan that fits around a job

I work, I run a one person web business, and I am studying for Security+ SY0-701 at the same time. The standard advice is "study two hours every night," and that plan dies the first week a client calls or a deploy breaks. This is the plan I actually run, built to survive a real schedule.

One honest thing first: I have not passed the exam yet. I am mid study, on both Security+ and eJPT. So this is not a how-I-passed post. It is a how-I-keep-studying-without-quitting post, which I think is the harder problem anyway.

The exam objectives are the only syllabus

CompTIA publishes the SY0-701 exam objectives as a free PDF. That document is the entire contract between you and the exam. Every question maps back to a line in it.

Most people buy a 700 page book or a 30 hour video course and treat its table of contents as the plan. That is backwards. Books and courses are explanations. The objectives are the syllabus. I keep the PDF on my phone and treat it like a checklist:

• Five domains, dozens of objectives. Each one gets a mark: never seen, seen, or can explain it out loud.
• The test for "can explain it" is explaining it to an imaginary salon owner. If I can tell a nail salon owner why her booking page needs HTTPS without saying "asymmetric," I understand certificates well enough.
• Whatever still has the first mark is what I study next. Weakest first, not chapter order.

The tradeoff: objectives-first study gives you coverage, not depth. You can check off "explain PKI" and still be shaky on it. That is what practice questions and labs are for.

One question a day is the floor, not the plan

I built a daily Security+ question with a streak into my own app, mostly to keep myself honest. One question a day sounds useless. It is not, for one reason: it keeps the exam in working memory on the days when everything else falls apart.

My rules:

• The daily question is the minimum, not the target. Some days it is all I do, and that day still counts.
• If I get it wrong, that objective goes to the front of my flashcard queue.
• Never guess just to protect the streak. A streak measures consistency, not learning. A 60 day streak of half asleep guesses teaches nothing. The streak is a tripwire, not a trophy.

Flashcards live in dead time, labs live on weekends

My week has two kinds of study time, and I stopped pretending they are interchangeable.

Dead time is waiting on a build, standing in line, the ten minutes before an appointment. That time is for flashcards: port numbers, acronyms, which control type a fence is. Recognition level material. I run them on my phone because the phone is what is already in my hand. I once shipped a code fix from a chairlift using Termux, so flashcards on a lift are easy mode.

Weekend blocks are one or two 90 minute sessions, phone face down. That time is for what flashcards cannot teach:

• Opening a real TLS certificate chain in the browser and explaining every link in it.
• Spinning up a small VM, hashing files, reading auth logs, cracking a throwaway password list I made myself.
• Practice exams against the clock. Security+ gives you 90 minutes. If you never rehearse the clock, the clock wins.

Mixing the two fails in both directions. Spending your one good weekend block on flashcards wastes your best focus. Trying to lab while standing in line at the grocery store teaches nothing.

What a realistic week looks like

Not a fantasy schedule. The actual one:

• Monday through Friday: the daily question, about two minutes, plus flashcards in whatever dead time shows up. Usually 10 to 20 minutes total. Zero guilt on the two minute days.
• Saturday: one 90 minute lab or practice test block, early, before the day gets eaten.
• Sunday: 30 minutes reviewing everything I got wrong that week, then updating the objectives checklist.

That is four to five hours a week. At that pace I am looking at months to be ready, not weeks, and I accept that. I have client work to do and a business to run. A plan that demands 15 hours a week does not survive contact with my calendar, so it is not a plan, it is a wish. Slow and still running beats fast and abandoned.

I run the same structure for eJPT, just with more weight on the weekend labs, because that exam is hands on and flashcards only carry you so far there.

The daily question, the Security+ and eJPT flashcards, the quizzes, and the streaks are all things I built into Aldo's Toolkit, free on both stores, no ads, no tracking, because I wanted them in my own pocket. If you want the same setup, that is where to get it.