A walkthrough
Everything you need to qualify, in one place — here is how it fits together.
8140.study turns a certification you were told to get into a plan you can follow: 28 certification paths built from the vendors’ published exam blueprints, 361 hours of material, 1,000 practice-exam questions, and a free reference library for the whole DoD Cyber Workforce Framework. This is the five-minute tour.
Pick your certification and set your exam date
Start from what you were told to get — a certification like Security+ or CISSP, or a baseline level like IAT II — and add it to your plan with the date you intend to sit the exam. You can study for one certification or several at once.
From the exam date the platform works backward into a pace, so “someday” becomes “this many lessons a day to finish a week early.” Browse the certification paths.
62% complete · on pace
18% complete · on pace
Target a certification or a baseline level. Study for one or several at once.
Learn the material, built from the real exam blueprint
Every course’s modules are generated from the vendor’s own published exam domains, so what you study matches what you will be tested on — and when a vendor reweights an exam, the course follows instead of quietly going stale.
Lessons are real instruction written for a working adult, grounded in DoD reality — STIGs, RMF, ATO, impact levels — where that is genuine. Each domain includes at least one hands-on lab: a scenario with a decision in it, not a click-through. The opening module of every course is free, lab and knowledge check included.
Confidentiality, integrity, and availability are not three boxes to tick. They are three pressures that pull against each other, and security engineering is mostly the work of deciding which one wins when they conflict. Full-disk encryption raises confidentiality and costs you a little availability. Aggressive integrity checking on a file transfer raises integrity and costs you throughput. An air gap maximizes confidentiality and destroys availability for anyone who needed the data quickly. There is no configuration that maximizes all three, and an engineer who claims otherwise has simply not found the tradeoff…
Lab: classify controls and route a change for an enclave
You support a moderate-impact enclave hosting a logistics application for roughly 400 users. Work through the following in order and write your answers down before checking your reasoning against the…
- Classify a mixed set of controls by both category and type.
- Identify the security-relevant failure in a change proposal.
- Write a backout condition that an approver can actually test.
Check yourself as you go
Every module ends with a knowledge check written as scenarios, not recall. The distractors are plausible on purpose — a common misconception, or a right answer to a different question — and every explanation says why the correct answer is correct and why the tempting wrong one fails. That second half is where the learning happens.
A supply depot's inventory system is encrypted by ransomware. Investigation confirms no data left the network and no records were altered before encryption. Which security objective was harmed?
- Confidentiality, because the attacker had access to the data
- Integrity, because the files are no longer in their original form
- Availability, because authorized users cannot reach the data they need
- Non-repudiation, because the attacker's actions cannot be attributed
Know when you are actually ready
Sit a full-length practice exam, weighted to the real blueprint, and get scored by domain — not one number, but where you are strong and where you are thin, with your weakest domain flagged so you know exactly what to study next.
A readiness score blends how much of the material you have covered with how you are performing per domain. It is never a pass prediction — vendors score on scales a raw percentage cannot reconstruct — but it is an honest picture of where you stand. There is a timed simulation mode too, because most first-time failures are pacing failures.
Make it stick between now and exam day
Every question you miss goes into a spaced-repetition review deck and comes back on widening intervals — the day after, then a few days later, then a week — until it sticks, resetting if you miss it again. The single highest-value study signal you have is the answer you got wrong, and this is where it stops evaporating.
A study streak and daily pace keep the plan honest without nagging, and all of it follows you across devices.
5-day study streak · keep it going
Pass, and prove it
When you pass, mark it — the credential moves into your wallet with the issuer’s renewal clock running, and the platform points you at what to study next. Passing becomes a beginning, not an off-ramp. Your wallet is where you keep proof of what you hold, in one place, across every certification you earn.
Mark a certification passed and its renewal clock starts here.
The reference library underneath it all
Even before you subscribe, the whole DoD Cyber Workforce Framework is documented and free: every certification the 8140 matrix references, all the DCWF work roles and what qualifies each, and the old 8570 baseline levels — IAT, IAM, IASAE, CSSP — preserved from the last public capture after DoD took the table offline.
Start with the free first module.
The opening module of every course is free — lessons, the lab and the knowledge check. See the material before you pay for any of it.