A walkthrough

Everything you need to qualify, in one place — here is how it fits together.

8140.study turns a certification you were told to get into a plan you can follow: 28 certification paths built from the vendors’ published exam blueprints, 361 hours of material, 1,000 practice-exam questions, and a free reference library for the whole DoD Cyber Workforce Framework. This is the five-minute tour.

1Step 1

Pick your certification and set your exam date

Start from what you were told to get — a certification like Security+ or CISSP, or a baseline level like IAT II — and add it to your plan with the date you intend to sit the exam. You can study for one certification or several at once.

From the exam date the platform works backward into a pace, so “someday” becomes “this many lessons a day to finish a week early.” Browse the certification paths.

Your study plan
Security+ (SY0-701)Exam in 38 days

62% complete · on pace

CySA+ (CS0-003)Exam in 74 days

18% complete · on pace

Target a certification or a baseline level. Study for one or several at once.

2Step 2

Learn the material, built from the real exam blueprint

Every course’s modules are generated from the vendor’s own published exam domains, so what you study matches what you will be tested on — and when a vendor reweights an exam, the course follows instead of quietly going stale.

Lessons are real instruction written for a working adult, grounded in DoD reality — STIGs, RMF, ATO, impact levels — where that is genuine. Each domain includes at least one hands-on lab: a scenario with a decision in it, not a click-through. The opening module of every course is free, lab and knowledge check included.

The CIA triad in a DoD contextreading · 12 min

Confidentiality, integrity, and availability are not three boxes to tick. They are three pressures that pull against each other, and security engineering is mostly the work of deciding which one wins when they conflict. Full-disk encryption raises confidentiality and costs you a little availability. Aggressive integrity checking on a file transfer raises integrity and costs you throughput. An air gap maximizes confidentiality and destroys availability for anyone who needed the data quickly. There is no configuration that maximizes all three, and an engineer who claims otherwise has simply not found the tradeoff

An actual lesson from the free first module — not a mockup.
Hands-on lab22 min

Lab: classify controls and route a change for an enclave

You support a moderate-impact enclave hosting a logistics application for roughly 400 users. Work through the following in order and write your answers down before checking your reasoning against the

  • Classify a mixed set of controls by both category and type.
  • Identify the security-relevant failure in a change proposal.
  • Write a backout condition that an approver can actually test.
A situation with a decision in it — written scenarios, not click-throughs.
3Step 3

Check yourself as you go

Every module ends with a knowledge check written as scenarios, not recall. The distractors are plausible on purpose — a common misconception, or a right answer to a different question — and every explanation says why the correct answer is correct and why the tempting wrong one fails. That second half is where the learning happens.

Knowledge check

A supply depot's inventory system is encrypted by ransomware. Investigation confirms no data left the network and no records were altered before encryption. Which security objective was harmed?

  • Confidentiality, because the attacker had access to the data
  • Integrity, because the files are no longer in their original form
  • Availability, because authorized users cannot reach the data they need
  • Non-repudiation, because the attacker's actions cannot be attributed
Every question explains why the tempting wrong answer fails.
4Step 4

Know when you are actually ready

Sit a full-length practice exam, weighted to the real blueprint, and get scored by domain — not one number, but where you are strong and where you are thin, with your weakest domain flagged so you know exactly what to study next.

A readiness score blends how much of the material you have covered with how you are performing per domain. It is never a pass prediction — vendors score on scales a raw percentage cannot reconstruct — but it is an honest picture of where you stand. There is a timed simulation mode too, because most first-time failures are pacing failures.

Practice exam · by domainSY0-701
General security concepts12% of exam
Threats, vulnerabilities, and mitigations22% of exam
Security architecture18% of exam
Security operations28% of exam
Security program management and oversight20% of exam
Real published domains and weights; scores shown are an example. Your weakest domain is flagged, and you can drill it.
5Step 5

Make it stick between now and exam day

Every question you miss goes into a spaced-repetition review deck and comes back on widening intervals — the day after, then a few days later, then a week — until it sticks, resetting if you miss it again. The single highest-value study signal you have is the answer you got wrong, and this is where it stops evaporating.

A study streak and daily pace keep the plan honest without nagging, and all of it follows you across devices.

Review — due today
Network segmentationseen once · due now
Certificate revocation (OCSP vs CRL)missed twice · due now
SIEM correlation rulesgraduating in 14 days

5-day study streak · keep it going

6Step 6

Pass, and prove it

When you pass, mark it — the credential moves into your wallet with the issuer’s renewal clock running, and the platform points you at what to study next. Passing becomes a beginning, not an off-ramp. Your wallet is where you keep proof of what you hold, in one place, across every certification you earn.

Your credentials
CompTIA Security+Earned · renews in 2 yr 10 mo
CompTIA CySA+In progress

Mark a certification passed and its renewal clock starts here.

Free to read, always

The reference library underneath it all

Even before you subscribe, the whole DoD Cyber Workforce Framework is documented and free: every certification the 8140 matrix references, all the DCWF work roles and what qualifies each, and the old 8570 baseline levels — IAT, IAM, IASAE, CSSP — preserved from the last public capture after DoD took the table offline.

Start with the free first module.

The opening module of every course is free — lessons, the lab and the knowledge check. See the material before you pay for any of it.