DEV Community: NERDEXAM

CompTIA A+ 220-1102 (Core 2): What's Actually Tested

NERDEXAM — Sun, 02 Aug 2026 14:02:52 +0000

CompTIA A+ 220-1102 (Core 2) is the software, operating systems, and security
half of the A+ certification. The exam costs about $253, runs 90 minutes, has
up to 90 questions, and requires 700 out of 900 to pass. One important fact up
front: the A+ credential requires passing BOTH Core 1 (220-1101) AND Core 2
(220-1102). You can take them in either order, but you must pass both within
three years of each other to earn the full certification. Core 2 is where
Windows, malware removal, security, and professional procedures live. If Core 1
is about what hardware is, Core 2 is about what you actually do with it on the
job.

A note on versions: CompTIA refreshes A+ every few years. The 220-1101 and
220-1102 pair is the widely taken and fully recognized version at the time of
writing. Before you schedule your exam, confirm the currently active exam
objectives on comptia.org, since CompTIA periodically releases a newer version
and retires older ones.

The 90-second answer

Take A+ Core 2 if you are finishing the A+ certification after Core 1, or
if you are starting with Core 2 because software and security topics are your
stronger side. Core 2 is the half that maps most directly to help desk,
desktop support, and IT support work. Malware removal, Windows troubleshooting,
and professionalism topics show up in day-one job tasks more than you might
expect from an exam.

Skip A+ Core 2 if you already have 2 or more years of hands-on IT
experience and want a more advanced credential. If your goal is networking,
jump to Network+. If your goal is security, Security+ is achievable with some
IT experience and covers security in far more depth than Core 2 does. A+ Core
2 alone, without Core 1, does not earn you the A+ credential, so there is no
partial credit for passing one exam.

What does the 220-1102 actually test?

220-1102 covers four domains. Operating Systems and Security each take 28% of
the exam, making them the two heaviest areas. The other 44% splits evenly
between Software Troubleshooting and Operational Procedures.

Domain	Weight	What it covers
Operating Systems	28%	Windows editions, install and upgrade paths, command-line tools, Control Panel and Settings, networking config; plus macOS, Linux, and mobile OS basics
Security	28%	Physical and logical security, malware types and removal, social engineering, authentication, securing workstations and mobile devices, data destruction
Software Troubleshooting	22%	Troubleshooting Windows OS problems, PC and mobile OS security issues, malware removal steps, app and mobile troubleshooting
Operational Procedures	22%	Documentation and change management, backup and recovery, safety and environmental controls, communication and professionalism, scripting basics, remote access technologies

The exam blends multiple choice with performance-based questions (PBQs) that
drop you into a simulated Windows environment and ask you to configure settings,
navigate the registry, or run the right command-line tool. Unlike Core 1, which
rewards broad hardware recognition, Core 2 rewards process knowledge. The exam
will ask for the exact seven steps of the malware removal procedure in order.
It will ask which Windows edition includes BitLocker. It will ask what command
outputs active TCP connections. Those questions are not conceptual. Either you
know the answer or you don't, and the only fix is drilling specifics.

If you've heard that Core 2 is the "easier" half of A+, that's only true if
you study Windows and security topics the same way you would study hardware.
Many candidates underestimate Core 2 because the subject matter feels familiar,
then get tripped up by the procedure-level precision the exam expects.

How hard is the 220-1102?

A+ Core 2 is a difficulty 2.5 out of 5. Slightly harder than Core 1 in
practice, because the breadth is similar but the questions expect exact
procedural knowledge, not just recognition. CompTIA does not publish pass rates,
but community surveys suggest first-attempt pass rates in the 65 to 75% range
for candidates who studied 6 or more weeks.

The hard parts are specific:

The malware removal procedure. CompTIA publishes a seven-step best practice: identify and research malware symptoms, quarantine infected systems, disable system restore in Windows, remediate the infection, schedule scans and run updates, enable system restore and create a restore point, then educate the end user. The exam tests the order, not just the steps.
Windows command-line tools. You need to know what ipconfig, netstat, sfc, chkdsk, diskpart, tasklist, gpupdate, and regedit do, and when to use each one. PBQs may put you in a CMD prompt and ask you to run the right command.
Edition-specific features. BitLocker is Pro and Enterprise. Group Policy is Pro and above. Windows Home does not have Remote Desktop host capability. These distinctions show up repeatedly.
The CompTIA troubleshooting methodology. Identify the problem, establish a theory of probable cause, test the theory, establish a plan of action and implement, verify full system functionality, and document findings. The exam tests the order of these steps the way a recipe tests ingredients.
PBQs at the start. Performance-based questions usually appear early. They can burn five to ten minutes each. Flag them, work through the multiple-choice first, then come back. The pacing math is unforgiving: 90 questions in 90 minutes leaves no buffer for getting stuck.

People who fail Core 2 usually fail because they studied concepts rather than
procedures. Knowing that malware is bad does not help you when the question
asks for step four of seven.

How long should you study for 220-1102?

CompTIA recommends 9 to 12 months of IT experience before A+. Most candidates
study for Core 2 right after Core 1, which means the OS and networking
fundamentals are already fresh. That helps. A realistic study plan:

Coming straight from Core 1 or with IT experience: 4 to 6 weeks at 8 to 10 hours per week
With general computer comfort, no Core 1 background: 6 to 8 weeks at 8 to 10 hours per week
Complete beginner taking Core 2 first: 8 to 10 weeks, and plan to study Core 1 topics in parallel to build context
Studying Core 1 and Core 2 back to back: plan 10 to 16 weeks total and consider sitting Core 2 within four to eight weeks of Core 1

The biggest waste of study time on Core 2 is treating it like Core 1 and
drilling acronyms instead of procedures. Core 2 rewards active recall of
process steps: what order, what command, what edition, what setting. Flashcards
work well. Walking through simulated Windows configurations in practice
questions works better.

A realistic week-by-week pace for a 6-week plan looks like:

Week 1: Windows editions and features, install and upgrade paths, command-line tools (ipconfig, netstat, sfc, chkdsk, diskpart, tasklist, regedit)
Week 2: Windows Settings and Control Panel, networking configuration in Windows, macOS and Linux basics
Week 3: Security fundamentals (physical and logical security, authentication, BitLocker, mobile device security, data destruction methods)
Week 4: Malware types, the seven-step malware removal procedure cold, social engineering, securing workstations
Week 5: Operational procedures (change management, documentation, backups, scripting basics, remote access: RDP, SSH, VPN, MDM)
Week 6: Software troubleshooting methodology, PBQ drills, timed practice exams, procedures review

Most failures trace back to skipping week 4. Security is 28% of the exam and
the malware removal steps are tested repeatedly and in exact order. Knowing
the concept is not enough.

What does the 220-1102 cost?

The exam itself is about $253 USD per attempt (2026 US price). The full A+
requires two exams, so the combined cost for both Core 1 and Core 2 is roughly
$506 before any voucher discounts. Total cost depends on your study path:

Component	Range	Notes
Exam fee (Core 2)	~$253	One attempt. Retake is another ~$253 if you fail. Full A+ needs Core 1 too.
Study course	$0 to $130	Professor Messer's A+ Core 2 videos are free; CompTIA CertMaster Learn is the paid official path
Practice questions	$0 to $50	NerdExam has 859 220-1102 questions if you want a free option
Lab software	$0	Windows virtual machines (free trial ISOs from Microsoft) cover most PBQ scenarios
Books	$0 to $50	Mike Meyers' All-in-One covers both cores; optional if you use video plus questions
Total realistic spend	$253 to $480	Cheapest viable path: ~$253 (exam only) plus free videos

CompTIA sells bundle vouchers covering both Core 1 and Core 2 at a slight
discount, and academic pricing is available through qualifying schools. There
is no free retake, so do not schedule until your practice scores sit above 700
consistently. A failed attempt costs the full fee again.

What salary can you expect after passing?

A+ is an entry-level credential and Core 2 topics (help desk, OS support,
security basics) map directly to the roles it opens. 2026 US salary estimates
from job boards show:

Help desk / IT support technician: $40,000 to $60,000
Desktop support specialist: $50,000 to $70,000
Field service technician: $45,000 to $65,000
Junior system administrator: $55,000 to $75,000

The honest framing: A+ earns you the entry IT job. The salary growth comes from
what that job teaches you, plus the next cert. People at the top of these
ranges hold A+ plus Network+ or Security+, with a year or two of hands-on
experience behind them. The A+ itself is the door, not the destination. Pay
climbs fast once Network+ and Security+ are added and you have real tickets
closed and systems managed.

What study resources actually work?

The candidates who pass Core 2 on the first attempt use a focused stack:

Professor Messer's free A+ Core 2 video series. The community default. Complete, current, and free. Watch at 1.5x and take notes on procedures, not just concepts.
Mike Meyers' All-in-One A+ book or CompTIA CertMaster Learn for structured depth if videos alone don't make the procedures stick. Pick one, not both.
Heavy practice questions focused on procedures. Core 2 is won or lost on exact-step knowledge. A strong question bank with full explanations is the single highest-leverage study tool here.
PBQ-specific practice. The simulations favor candidates who have actually navigated Windows Settings, run command-line tools, and configured remote access. Do as many simulated tasks as you can find.
Procedure cheat sheets memorized cold: the seven malware removal steps, the CompTIA troubleshooting methodology in order, Windows edition feature differences, and the key command-line tools and what they output.

Skip the brain-dump sites. They are against CompTIA policy, frequently
inaccurate, and they teach you to recognize leaked questions rather than
understand procedures, which is exactly what the PBQs expose. The r/CompTIA
subreddit has the most current crowd-sourced advice on which resources are
working this quarter.

For the practice question portion, NerdExam has 859 enriched 220-1102
questions with full explanations. Start practicing 220-1102 questions
to see the question style before you commit to a study plan. The free
explanations show you the procedure-level reasoning the exam expects, which
is far harder to absorb from video walkthroughs alone.

Who should NOT take 220-1102?

The cert is wrong for these candidates:

You are	Take instead
Already 2+ years into an IT role	CompTIA Network+ or Security+ (skip the entry credential)
Targeting networking specifically	CompTIA Network+ (N10-009)
Targeting cybersecurity with some experience	CompTIA Security+ (SY0-701)
A cloud-focused developer or engineer	A cloud foundation cert (AWS CLF-C02 or AZ-900)
Taking Core 2 without Core 1 and expecting A+	You need both cores; plan to sit Core 1 too
Only studying the software concepts but not certifying	Skip the exam fee; just study the material

The path matters more than the badge. Core 2 is valuable when you are
completing the A+ certification and moving into a help desk or desktop support
role. It is a poor use of time and money if you are already working in IT at a
level above entry, or if your career is headed toward cloud or software
engineering. Hiring managers do not expect experienced candidates to hold A+;
they penalize entry candidates who cannot walk through a basic troubleshooting
call.

What's next after 220-1102?

Passing Core 2 completes the A+ certification, assuming Core 1 is also done.
Here is the standard path forward:

Finish A+ with Core 1: If you haven't yet, pass Core 1 (220-1101) to earn the full A+ credential. Most people sit both exams within one to two months of each other.
CompTIA Network+ (N10-009): The natural next step for anyone leaning toward infrastructure, network admin, or IT operations work. Builds directly on the networking concepts from both A+ cores.
CompTIA Security+ (SY0-701): The highest-value follow-on for most A+ holders. DoD-approved, widely required for government and contractor roles, and the cert that moves you from "support" pay to "security" pay.
Land the job first. A+ plus a help desk role for 6 to 12 months beats collecting three certs with no experience. Hiring managers want both the credential and the tickets-closed history behind it.

The cert ladder pays off when each rung sits on top of real job experience.
A+ opens the door. Network+ and Security+, earned while working an IT role,
are what push salaries into the $70K to $90K range.

Ready to start? Practice with real 220-1102 questions on NerdExam
or jump straight into the free per-question explanations.
The official A+ objectives are worth reviewing before you build a study plan:
see CompTIA's A+ certification page
for the current exam blueprint and any version updates.

CompTIA A+ 220-1101 (Core 1): What's Actually Tested

NERDEXAM — Sat, 01 Aug 2026 14:02:21 +0000

CompTIA A+ 220-1101 (Core 1) is the hardware-and-networking half of the A+
certification, the credential most help desk and IT support hires start with.
The exam was $249, ran 90 minutes, had up to 90 questions, and required 675
out of 900 to pass. One important fact up front: the 220-1101 version retired
on September 25, 2025, and was replaced by 220-1201 (the V15 release). If
you're booking a test today, you'll sit 220-1201, not 220-1101. The good news
is the two are about 80% the same exam, so everything here still maps almost
directly to what you'll study. Read this as the honest overview of Core 1,
with the version change called out where it matters.

The 90-second answer

Take A+ Core 1 if you want to break into IT support, help desk, or field
tech work and you don't have a degree or prior certs. A+ is the credential
that gets resumes past the first filter for $40K to $55K entry roles. Core 1
is the hardware, networking, and troubleshooting half. You pass it plus Core
2 (220-1102, now 220-1202) to earn the full A+.

Skip A+ Core 1 if you already have 2+ years of hands-on IT experience or
a networking-focused goal. If you're aiming straight at networking, Network+
is the better target. If you're aiming at security, you can often skip A+ and
go Security+ with some experience. A+ is an entry credential, not a career
capstone. Paying $249 twice to prove you can reseat RAM is wasteful if you're
already past that level.

What does A+ Core 1 actually test?

220-1101 tested five domains. The weights below are the official 220-1101
breakdown. The successor 220-1201 keeps the same five domain names with only
minor weight shifts, so this table is still your study map.

Domain	Weight	What it covers
Hardware and Network Troubleshooting	29%	Diagnosing failed RAM, storage, displays, printers, network connectivity, and a methodical troubleshooting process
Hardware	25%	RAM, storage (SATA/NVMe), CPUs, motherboards, power supplies, cables, connectors, peripherals, printers
Networking	20%	Ports and protocols, TCP/IP, Wi-Fi standards, SOHO routers, network types, DNS, DHCP
Mobile Devices	15%	Laptop components, display types, mobile connectivity, accessories, configuration
Virtualization and Cloud Computing	11%	Cloud models (IaaS/PaaS/SaaS), client-side virtualization, resource requirements

The exam is broad, not deep. It rewards recognition over reasoning. A typical
question shows you a symptom (\"a laptop displays dim, flickering output that
improves when you press on the bezel\") and asks for the most likely cause.
You're matching symptoms to components, ports to protocols, and standards to
speeds. Performance-based questions (PBQs) put you in a simulated interface
and ask you to configure a SOHO router or match cables to ports.

If you've heard A+ described as \"a mile wide and an inch deep,\" that's
accurate. The challenge is volume, not difficulty.

How hard is A+ Core 1?

A+ Core 1 is a difficulty 2 out of 5. It's an entry exam by design. Harder
than nothing, easier than Network+ or Security+. The published pass mark is
675 on a 100 to 900 scale, which works out to roughly 75%. CompTIA does not
publish pass rates, but community surveys put first-attempt pass rates around
65 to 75% for people who studied 6+ weeks.

The hard part isn't any single concept. The hard parts are:

Sheer breadth. You memorize dozens of port numbers, Wi-Fi standards, RAM types, connector shapes, and cable categories. None of it is hard, but there is a lot of it.
Performance-based questions first. PBQs usually appear at the start. They eat time and rattle nervous candidates. Flag them, skip ahead, do the multiple-choice, then come back.
Trick distractors. Many questions offer two plausible answers (for example, two RAM types that both fit the slot) where only one matches the full scenario.
Pacing. Up to 90 questions in 90 minutes is one minute each. PBQs can burn five minutes apiece, so the multiple-choice has to move fast.

People who fail Core 1 usually fail because they crammed acronyms without
ever touching hardware, or they froze on the opening PBQs and lost 20 minutes
before answering a single regular question. Do the PBQs last.

How long should you study for A+ Core 1?

CompTIA recommends 12 months of hands-on IT support experience before A+.
Most candidates don't have that, and that's fine, you just study longer. A
realistic plan:

With IT experience (1+ year): 3 to 5 weeks at 8 to 10 hours per week
With some computer comfort, no IT job: 6 to 8 weeks at 8 to 10 hours per week
Complete beginner: 10 to 12 weeks, and budget hands-on time with real or simulated hardware
Studying Core 1 and Core 2 back to back: plan 10 to 16 weeks total and test for Core 1 first

The biggest waste of study time is pure video watching with no recall
practice. A+ is a memorization exam, so active recall (flashcards, practice
questions) beats passive video by a wide margin. If you can, open a desktop
case and identify the parts. Building or upgrading one cheap PC teaches more
hardware than ten hours of lectures.

A realistic week-by-week pace for a 6-week plan looks like:

Week 1: Hardware fundamentals (RAM types, storage, CPUs, motherboards, power supplies)
Week 2: Cables, connectors, peripherals, and printers
Week 3: Networking (ports and protocols, TCP/IP, DNS, DHCP)
Week 4: Wi-Fi standards, SOHO routers, network types, mobile devices
Week 5: Virtualization, cloud models, and the full troubleshooting methodology
Week 6: Performance-based question drills, timed practice exams, and memorizing the port-number and Wi-Fi-standard cheat sheets cold

Most failures come from skipping the dedicated troubleshooting week. The
troubleshooting domain is 29% of the exam, the single biggest slice, and it's
the one that rewards method (identify the problem, establish a theory, test,
resolve, document) over raw facts.

What does A+ Core 1 cost?

The exam itself was $249 USD per attempt, and that's the same price as the
current 220-1201. Remember A+ requires two exams (Core 1 and Core 2), so the
full certification is two fees. Real total cost depends on your study path:

Component	Range	Notes
Exam fee (Core 1)	$249	One attempt. Retake is another $249 if you fail. Full A+ needs Core 2 too.
Study course	$0 to $130	Professor Messer's A+ videos are free; CompTIA CertMaster Learn is the paid official path
Practice questions	$0 to $50	NerdExam has 1003 220-1101 questions if you want a free option
Lab hardware	$0 to $100	Optional. An old desktop or a $40 parts bundle helps the hardware domain stick
Books	$0 to $50	Mike Meyers' All-in-One is the classic; optional if you use video plus questions
Total realistic spend	$249 to $480	Cheapest viable path: $249 (exam only) plus free videos

CompTIA sometimes bundles a Core 1 plus Core 2 voucher pack and discounts
retakes, and academic vouchers run cheaper if you qualify through a school.
There's no free retake, so don't book until your practice scores sit above
the pass line consistently.

What salary can you expect?

A+ is an entry-level credential, and the salaries reflect that. It opens the
door; it doesn't pay six figures on its own. 2025 to 2026 US data shows:

Entry help desk / IT support technician: $40,000 to $55,000
Field service / desktop support technician: $45,000 to $60,000
Median across A+ holders: roughly $63,000 (skewed up by people who hold more than just A+)
With 3+ years plus a second cert (Network+ or Security+): $70,000 to $85,000

The honest framing: A+ gets you the first IT job. The salary jump comes from
the experience that job gives you, plus the next cert. Treat A+ as the entry
ticket, not the destination. The people earning $80K with \"A+\" on their
resume earned it through the roles A+ unlocked, not the cert itself.

A practical tip: if you're currently in a non-IT job and earn A+, apply
internally first. Many companies will move a warehouse or retail employee
into a help desk seat once they have A+, and that internal move is often
easier than breaking in cold from the outside.

What study resources actually work?

The candidates who pass on the first attempt use a consistent, cheap stack:

Professor Messer's free A+ Core 1 video series on YouTube. It's the community default for a reason: complete, current, and free. Watch at 1.5x.
CompTIA CertMaster Learn or Mike Meyers' All-in-One book for structured depth if videos alone don't stick. Pick one, not both.
Heavy practice questions to convert recognition into recall. This is the single highest-leverage activity for a memorization exam.
PBQ-specific practice. The simulations trip people up. Do as many as you can find so the format isn't new on test day.
Cheat sheets memorized cold: port numbers, Wi-Fi standards (and their speeds and frequencies), RAM generations, and the troubleshooting steps in order.

Skip the expensive bootcamps. A+ does not require one. Free Professor Messer
videos plus a strong question bank cover the same ground for a fraction of
the cost. The r/CompTIA subreddit has the most current crowd-sourced advice
on which resources are working this quarter.

For the practice question portion, NerdExam has 1003 enriched 220-1101
questions with full explanations. Start practicing 220-1101 questions
to see the question style before you commit to a study plan. The free
question explanations show you the symptom-to-component reasoning the exam
expects, which is exactly the pattern videos teach slowest.

Who should NOT take A+ Core 1?

The cert is wrong for these candidates:

You are	Take instead
Already 2+ years into an IT role	Network+ or Security+ (skip the entry credential)
Targeting networking specifically	CompTIA Network+
Targeting cybersecurity with some experience	CompTIA Security+
A software developer	A+ teaches nothing relevant; skip it
Booking a test in 2026	The same content, but as 220-1201 (V15), since 220-1101 retired in September 2025

The last row matters most right now. If you search for \"220-1101\" and try to
register, you won't be able to: it's retired. Study the same domains, but
book the 220-1201 exam. Any 220-1101 material that covers the five domains
above is roughly 80% applicable, with updates mostly in cloud, Wi-Fi 6E/7,
and newer connector standards.

What's next after A+ Core 1?

Core 1 is half the A+. Here's the realistic path forward:

Finish A+: Pass Core 2 (220-1102, now 220-1202) to earn the full certification. Most people do this within a month or two of Core 1.
Network+: The natural next step for anyone leaning toward infrastructure or network admin work. Builds directly on the networking domain you just studied.
Security+: The highest-value follow-on for most A+ holders. DoD-approved, widely required, and the cert that moves you from \"support\" pay to \"security\" pay.
Land the job first. A+ plus a help desk role for 6 to 12 months beats collecting certs with no experience. Hiring managers want both.

Most people go A+, then Network+ or Security+ within a year, while working an
entry IT role. The cert ladder pays off when each rung sits on top of real
job experience, not when you stack three certs with an empty work history.

Ready to start? Practice with real 220-1101 questions on NerdExam
or jump straight into the free per-question explanations.
The official A+ objectives are also worth skimming before you build a study
plan: see CompTIA's A+ page here.

CISSP Certification: What's Actually Tested and How Hard It Really Is

NERDEXAM — Sun, 12 Jul 2026 14:02:26 +0000

The CISSP (Certified Information Systems Security Professional) from (ISC)2 is
the most recognized senior-level security certification in the world. The exam
is $749, runs 180 minutes, uses a computerized adaptive format of 100 to 150
questions, and requires 700 out of 1000 to pass. The part most people miss:
you also need 5 years of paid, full-time security work experience to become a
fully certified CISSP. Pass the exam without it and you become an Associate of
(ISC)2 until you earn the years. Most candidates need 3 to 6 months of study.
This is a mile-wide, inch-deep exam that rewards management thinking over deep
technical recall.

The 90-second answer

Take CISSP if you already have several years in security or IT and you're
targeting roles like security manager, security architect, GRC lead, or CISO.
It's the credential that shows up as "required" or "strongly preferred" in
senior security job postings more than any other. If you want one cert that
moves you from technician to leadership track, this is it.

Skip CISSP if you're new to security or you don't yet have the 5 years of
qualifying experience. You can still sit the exam and become an Associate, but
the cert is built around the assumption that you've managed risk in the real
world. Start with Security+ (SY0-701) for fundamentals, get a couple of years
on the job, then come back. Going straight to CISSP from zero security
experience usually means a failed attempt and a $749 retake.

What does the CISSP actually test?

CISSP tests eight domains, known as the Common Body of Knowledge (CBK). The
weights below took effect with the April 2024 refresh and run through the
current exam. Every question maps to one domain.

Domain	Weight	What it covers
Security and Risk Management	16%	Governance, risk management, compliance, legal, ethics, BCP fundamentals
Asset Security	10%	Data classification, ownership, handling, retention, privacy
Security Architecture and Engineering	13%	Secure design, models, cryptography, physical security
Communication and Network Security	13%	Network architecture, secure protocols, segmentation
Identity and Access Management (IAM)	13%	Authentication, authorization, provisioning, federation
Security Assessment and Testing	12%	Audits, vulnerability assessment, pen testing, logging
Security Operations	13%	Incident response, monitoring, forensics, DR, change management
Software Development Security	10%	SDLC security, secure coding concepts, application controls

The exam is conceptual, not hands-on. You will never configure a firewall or
write a line of code. Instead you get a scenario and you pick the answer a
risk-aware manager would choose. A typical question gives you four technically
correct options and asks for the BEST or FIRST action. The expected answer
almost always favors people and process over technology, and risk reduction
over a quick technical fix.

If you've ever heard "think like a manager, not an engineer," you've heard
someone describe how to pass CISSP.

How hard is the CISSP?

CISSP is a difficulty 4 out of 5. The content itself is not deeply technical,
but the breadth is enormous and the question style trips up strong engineers.
(ISC)2 does not publish a pass rate, but community surveys consistently put
first-attempt pass rates somewhere around 60% to 70%, and many strong
candidates fail the first time.

The hard part is not memorizing facts. The hard part is:

Breadth: eight domains spanning law, cryptography, networking, software, and governance. Nobody is an expert in all eight.
The "manager mindset" pivot: technical people instinctively pick the technical fix, which is often the wrong answer on this exam.
The adaptive format: the test gets harder as you answer correctly, so it never feels like you're doing well. Many people leave convinced they failed.
Wording precision: "BEST," "FIRST," "MOST," and "MOST effective" each change the correct answer. Misreading the qualifier sinks otherwise-prepared people.

People who fail CISSP usually fail because they studied the technology and
ignored the test-taking pivot, or because they panicked when the adaptive
engine kept feeding them hard questions. The exam is designed to feel
uncomfortable. That is normal, not a signal you're failing.

The most common failure pattern looks like this: a senior engineer with 10
years of hands-on work assumes the exam will reward depth, skims the manager
mindset advice, walks in confident, and keeps picking the "implement the
control" answer when the question wanted "assess the risk first." Build the
mindset shift in week 2, not week 10. Do at least 1,000 practice questions and
read every explanation, even on the ones you got right.

How long should you study for CISSP?

(ISC)2 assumes 5 years of security experience before you sit the exam. That
experience is baked into the question difficulty. On top of that, plan study
time based on your background:

With 5+ years of broad security experience: 2 to 3 months at 8 to 10 hours per week
With strong experience in only a few domains: 4 to 5 months, with extra time on your weak domains (usually cryptography, law, and software security)
Coming from a technical-only background (sysadmin, network, dev): 5 to 6 months to build the governance and risk vocabulary the exam expects
Coming from GRC or audit with light technical depth: 4 to 5 months, focused on networking, architecture, and cryptography

The biggest waste of study time is re-reading the 1,000-page official study
guide cover to cover. Read it once, then live in practice questions. The exam
is about applying judgment under specific wording, which you only build by
drilling questions and dissecting why the wrong answers are wrong.

A realistic week-by-week pace for a 12-week study plan looks like:

Week 1: Domain 1 (Security and Risk Management), the heaviest domain
Week 2: Domain 1 continued plus the manager-mindset pivot and risk formulas
Week 3: Domain 2 (Asset Security) and data lifecycle
Week 4: Domain 3 (Security Architecture and Engineering), models
Week 5: Domain 3 cryptography deep dive (a common weak spot)
Week 6: Domain 4 (Communication and Network Security)
Week 7: Domain 5 (Identity and Access Management)
Week 8: Domain 6 (Security Assessment and Testing)
Week 9: Domain 7 (Security Operations), incident response, forensics, DR
Week 10: Domain 8 (Software Development Security) and SDLC
Week 11: Full-length practice exams, weak-domain cleanup
Week 12: More timed practice, mindset drills, light review only

Most people underestimate Domain 1. At 16% it's the single largest slice, and
its risk, governance, and legal concepts thread through every other domain. If
you're shaky on Domain 1, you're shaky on the whole exam.

What does the CISSP cost?

The exam itself is $749 USD in the Americas. Beyond that, real total cost
depends on your study path:

Component	Range	Notes
Exam fee	$749	One attempt. Retakes cost the same $749 each.
(ISC)2 annual maintenance fee	$135/year	Required once certified, plus CPE credits
Study guide / OSG	$0 to $60	The Official Study Guide and "Sybex" practice tests
Practice questions	$0 to $80	NerdExam has 1536 CISSP questions if you want a free option
Optional bootcamp	$0 to $3,500	Most self-studiers skip this entirely
Total realistic spend	$750 to $900	Cheapest viable path: exam plus a single study guide

Retakes are not cheap and the policy is strict: you wait 30 days after a first
fail, 60 days after a second, and 90 days after a third, with a maximum of
four attempts in any 12-month period. That waiting structure is the real
reason to over-prepare rather than gamble on a borderline first attempt.

What salary can you expect?

CISSP is one of the highest-paying security certifications, partly because it
gates senior roles. 2026 salary data from US job boards shows:

National average for CISSP holders: $135,000 to $165,000 base
Security architect and security manager roles: $150,000 to $180,000
Top US metros and senior IC roles: $180,000 to $200,000+
Director and CISO-track roles with CISSP: $200,000 to $300,000+ total comp

The cert alone doesn't deliver these numbers. The 5-year experience
requirement means every certified CISSP already has a real track record, which
is exactly why the credential correlates with senior pay. The CISSP is the
filter that gets your resume past the keyword screen for security leadership
jobs. The experience is what gets you hired.

A practical negotiation tip: if you earn CISSP while employed, time the
conversation with your manager before your review cycle, not after. Many
security teams have a formal pay band for CISSP holders because client
contracts and compliance frameworks sometimes require a certain number of
certified staff. That makes you measurably more valuable to bill out. Internal
moves with a fresh CISSP historically clear 8 to 15% base bumps. External
moves into a senior security role clear far more.

What study resources actually work?

The candidates who pass on the first attempt use a consistent stack:

One primary text for breadth. The Official (ISC)2 CISSP Study Guide (the "OSG") or Eleventh Hour CISSP for a faster pass. Read once, do not memorize.
A heavy diet of practice questions with full explanations. This is the single highest-return activity for CISSP. Drill the wrong-answer reasoning, not just the right answer.
A concept-anchoring resource for the manager mindset. Free YouTube walkthroughs of "BEST vs FIRST" question logic are widely available and close the gap engineers struggle with.
The official exam outline (free from (ISC)2). Map every study session to a domain and weight so you spend time proportional to the exam.
At least two full-length timed practice exams in the final two weeks. Treat them like the real thing. If you're below 75% on the second, push your exam date.

Skip the expensive bootcamps unless your employer pays. The CISSP body of
knowledge is stable and well-documented, and a self-study stack covers the
same ground for under $100. Reddit's r/cissp has the most current
crowd-sourced advice on which resources are working this quarter.

For the practice question portion, NerdExam has 1536 enriched CISSP questions
with full explanations. Start practicing CISSP questions
to see the question style before you commit to a study plan. The free
explanations show you the "think like a manager" reasoning pattern the exam
expects, which is the hardest thing to learn from a textbook and the easiest
thing to learn by doing questions.

Who should NOT take CISSP?

The cert is wrong for these candidates:

You are	Take instead
New to security entirely	CompTIA Security+ (SY0-701) first
A hands-on pentester or red teamer	OSCP or GPEN for the technical track
A cloud security engineer	CCSP (also (ISC)2) or a cloud-vendor security cert
An IT generalist with no security experience	Security+ now, CISSP in 2 to 3 years
Someone without the 5 years of experience	Sit it as Associate if you want, but know the cert is provisional until you earn the years

The path matters more than the cert. CISSP is a leadership and governance
credential. If your career is heading deep into offensive security or cloud
engineering, a technical cert serves you better. Chasing CISSP too early
wastes months and risks a failed attempt on an exam built for people with a
decade of context.

What's next after CISSP?

Once CISSP is in hand, a few paths open up depending on direction:

Management track: CISSP concentrations like ISSMP (management) or the CISM from ISACA. Natural fits for security managers and aspiring CISOs.
Architecture track: the ISSAP concentration, which goes deeper on secure design and is built specifically for security architects.
Cloud track: CCSP from (ISC)2 pairs cleanly with CISSP and is the obvious next move as workloads keep migrating to cloud.
Audit and governance track: CISA from ISACA, which complements CISSP for GRC and audit-heavy roles.

Most people don't rush the next cert after CISSP. The credential carries
weight on its own for years. Use the time to ship real security leadership
work and earn the CPE credits you need to keep CISSP active. The cert pays off
when hiring managers see it alongside a real track record, not when it's the
only line on your resume.

Ready to start? Practice with real CISSP questions on NerdExam
or jump straight into the free per-question explanations.
The official exam outline from (ISC)2 is also worth reading first if you
haven't: review the CISSP exam outline here.

Cisco 350-701 SCOR (CCNP Security Core): What's Actually Tested

NERDEXAM — Fri, 10 Jul 2026 14:02:32 +0000

The Cisco 350-701 SCOR (Implementing and Operating Cisco Security Core
Technologies) is the core exam for CCNP Security and also qualifies as the
written/qualifying exam for CCIE Security. The exam is $400, runs 120
minutes, carries 90 to 110 questions, and requires approximately 825 out
of 1000 to pass based on community consensus. Most candidates need 10 to
14 weeks of structured study. The questions are multiple choice and
drag-and-drop with no back button, and they span the entire Cisco security
product stack: ASA, Firepower Threat Defense, ISE, Umbrella, WSA, Secure
Endpoint, and more. If you already operate Cisco security gear day-to-day,
you can compress that timeline. If you are coming from a general networking
background with little security exposure, budget the full 14 weeks and
spend meaningful time in a lab or sandbox.

The 90-second answer

Take 350-701 SCOR if you want to earn CCNP Security or qualify for the
CCIE Security lab, and you are willing to learn how the full Cisco security
portfolio fits together. It is the credential that signals to employers
you can design, implement, and operate enterprise security using Cisco
platforms, not just configure one firewall in isolation. Job postings for
Network Security Engineer, Security Architect, and senior SOC roles
regularly list CCNP Security as a requirement or strong preference.

Skip 350-701 SCOR if you have no networking foundation yet, no exposure
to Cisco gear, or you are pursuing a vendor-neutral security role that will
never touch Cisco infrastructure. The exam assumes you can navigate ASA and
FTD policy, understand 802.1X flows end to end, and reason about cryptographic
protocols. Walking in without that background usually produces a $400 fail.

What does the 350-701 actually test?

The 350-701 blueprint covers six domains. Cisco publishes the exact topic
weights and they have been stable across recent exam versions. Every
question maps to one of these domains.

Domain	Weight	What it covers
Security Concepts	25%	Common threats and attack types (on-prem and cloud), cryptography (PKI, TLS, hashing), network security design, virtualization and cloud security models, security intelligence, programmability and APIs (Python, REST)
Network Security	20%	Cisco ASA and Firepower Threat Defense (FTD) policies, NGFW and NGIPS, site-to-site and remote-access VPNs (IPsec, SSL/TLS), network infrastructure hardening
Securing the Cloud	15%	Cloud service and deployment models, shared responsibility, Cisco Umbrella, CASB, workload security, app and data security in the cloud
Content Security	15%	Cisco Web Security Appliance (WSA), Secure Email Gateway (formerly ESA), Umbrella DNS-layer security, URL filtering, anti-malware
Endpoint Protection and Detection	10%	Cisco Secure Endpoint (AMP for Endpoints), EDR and EPP concepts, outbreak control, retrospective security, MDM concepts
Secure Network Access, Visibility, and Enforcement	15%	Cisco ISE, 802.1X, MAC Authentication Bypass, AAA (TACACS+, RADIUS), posture assessment, profiling, TrustSec, network telemetry (NetFlow, Stealthwatch/Secure Network Analytics)

The exam rewards genuine product familiarity. A question may describe an
ISE deployment scenario and ask which policy set applies, or present an
FTD access control rule and ask what traffic is blocked. You need to know
how these products behave, not just what acronyms stand for.

Security Concepts at 25% is the heaviest domain. Candidates who underestimate
cryptography and programmability here are often surprised. You need to be
comfortable with TLS handshake mechanics, certificate chain validation,
hashing algorithms, and how REST APIs fit into a security automation workflow.
That last piece - writing and reading simple Python scripts that call Cisco
APIs - appears in multiple question styles and punishes candidates who skipped
the automation module.

How hard is the 350-701?

350-701 SCOR is a difficulty 4 out of 5. Substantially harder than CCNA,
and meaningfully harder than a single-product certification. Cisco does not
publish a pass rate, but community surveys suggest first-time pass rates in
the 50% to 65% range for candidates who studied at least 10 focused weeks.

The hard parts are specific:

Breadth across the full Cisco security stack. You cannot specialize your way through six domains. ISE, FTD, Umbrella, WSA, and Secure Endpoint all appear, and gaps in any one of them show up in the score
No back button. Cisco exams do not let you flag and return. A complex drag-and-drop scenario early in the exam burns time you cannot recover
The overlap between domains. A VPN question may require cryptography knowledge (Security Concepts) and FTD configuration knowledge (Network Security) simultaneously, so weak spots in one domain compound
Cloud security depth. Candidates with traditional on-prem backgrounds frequently underweight the cloud domain, then discover 15% of their score depends on it
ISE complexity. 802.1X with posture and profiling has many moving parts. Candidates who have never deployed ISE often find those questions the hardest to reason through without hands-on context

The most common failure pattern: candidate studies the video course cover to
cover, never deploys a virtual ASA or FTD sandbox, walks in confident, and
then hits the drag-and-drop policy scenarios that require knowing exactly
which traffic-matching rule fires in which order. Study with a product, not
just about a product.

How long should you study for 350-701?

Cisco recommends 3 to 5 years of security experience as background for this
exam. There are no formal prerequisites, but that recommendation signals the
expected baseline. For actual study time:

With 3+ years of Cisco security operations experience: 8 to 10 weeks at 10 to 12 hours per week, focusing on blueprint gaps and the automation domain
With 1 to 3 years of mixed networking and security experience: 10 to 12 weeks at 10 to 12 hours per week
CCNA-level networking background, limited security experience: 12 to 14 weeks, and consider spending the first two weeks building baseline security concepts before the structured blueprint study begins
Switching from a non-Cisco security background (Palo Alto, Fortinet): 10 to 12 weeks, mostly to map your existing knowledge onto Cisco product equivalents and learn ISE from scratch

A realistic week-by-week pace for a 12-week plan looks like:

Week 1: Security concepts - threat landscape, attack types, network security design principles
Week 2: Cryptography - PKI, TLS, IPsec, hashing, key exchange
Week 3: ASA fundamentals - policies, NAT, access control, VPN basics
Week 4: Firepower Threat Defense - access control policies, IPS, file and malware inspection
Week 5: VPNs in depth - site-to-site IPsec, AnyConnect SSL, FlexVPN
Week 6: Cisco ISE - 802.1X, MAB, AAA, RADIUS, TACACS+
Week 7: ISE advanced - posture, profiling, TrustSec, guest access
Week 8: Cloud security - Umbrella, CASB, workload security, shared responsibility models
Week 9: Content security - WSA, Secure Email Gateway, URL filtering, anti-malware
Week 10: Endpoint security - Secure Endpoint/AMP, EDR/EPP, MDM concepts, retrospective security
Week 11: Network telemetry, visibility, programmability (Python/REST API automation, NetFlow, Stealthwatch)
Week 12: Full timed practice exams, weak-domain review, time management drills

The automation and programmability section in week 11 is where many
candidates discover they are behind. Do not leave it for week 12. Simple
Python scripts calling Cisco REST APIs appear across multiple domains, not
just in Security Concepts.

What does the 350-701 cost?

The exam itself is $400 USD plus any local taxes. A failed attempt costs
the full $400 again, with a mandatory 5-day wait before you can rebook.

Component	Range	Notes
Exam fee	$400	One attempt. Retake is another $400, with a 5-day wait after a fail.
Study course	$0 to $200	Cisco dCloud sandbox access is free; paid video courses (CBT Nuggets, Pluralsight) run $50 to $200
Practice questions	$0 to $60	NerdExam has 918 SCOR questions with full explanations
Lab access	$0 to $100	Cisco dCloud provides free FTD, ISE, and ASA labs; DevNet sandboxes are free
Books	$0 to $80	Cisco Press "Implementing and Operating Cisco Security Core Technologies" is the standard reference
Total realistic spend	$400 to $700	Cheapest viable path: $400 (exam only, free dCloud labs)

Cisco does not routinely offer retake vouchers or discount programs, so the
"do not book until your practice scores are consistently above 80%" rule
matters more at $400 per attempt than it does on cheaper exams. Cisco
occasionally runs promotional pricing through the Cisco Learning Network
Store and Cisco partner programs, so check before you purchase.

What salary can you expect after passing?

CCNP Security is a mid-to-senior credential, and the pay reflects it.
2026 US salary ranges from job boards show:

Network Security Engineer with CCNP Security: $105,000 to $145,000
Security Engineer or SOC lead with CCNP Security: $95,000 to $135,000
Senior Security Engineer or Security Architect with CCNP Security: $140,000 to $180,000

The cert does not deliver those numbers on its own. CCNP Security combined
with hands-on Cisco security operations experience is what moves the needle.
Candidates who earn CCNP Security and then spend two to three years deploying
ISE, FTD, and Umbrella in production environments regularly hit the upper
end of those ranges. The cert signals credibility to a hiring manager; the
experience is what negotiates the salary.

A practical note: many enterprise security architect and lead engineer
postings list CCNP Security or equivalent as required, which means not
having it quietly removes you from the candidate pile before a human reads
your application. The salary lift is real, but the mechanism is access to
roles, not a direct pay bump on a current position.

What study resources actually work?

The candidates who pass 350-701 on the first attempt use a consistent stack:

One structured course that covers every domain. Cisco's own learning materials on the Cisco Learning Network are the most blueprint-aligned starting point. CBT Nuggets and Pluralsight both have SCOR tracks that candidates rate highly
Hands-on lab time, every week. Cisco dCloud provides free virtual labs for ASA, FTD, ISE, Umbrella, and Secure Endpoint. DevNet sandboxes cover the programmability topics. Configure actual 802.1X authentication, build an FTD access control policy, and write a Python script against the ISE API before exam day
The official Cisco Press book for the 350-701. It maps directly to the blueprint and includes chapter-end questions. Use it as a reference alongside the video course, not as a replacement for lab time
At least 500 practice questions before booking. Domain-weighted practice is important here because the six domains test different skills. A high score in Security Concepts does not predict performance on ISE configuration scenarios
Two full-length timed practice exams in the final two weeks. Score them honestly. If you are below 78% on the second attempt, postpone the real exam and spend another week on weak domains

Avoid brain-dump sites that claim to sell real exam questions. They violate
Cisco's certification agreement, they frequently contain incorrect answers,
and they train pattern recognition rather than product knowledge, which is
exactly what the scenario-based questions punish. Reddit's r/ccnp and the
Cisco Learning Network forums have the most current crowd-sourced advice on
what is working this exam cycle.

For the practice question portion, NerdExam has 918 enriched 350-701 SCOR
questions with full explanations. Start practicing 350-701 questions
to see the question style before you commit to a study plan. The explanations
walk through the reasoning behind each answer, which is especially useful
for the multi-product scenario questions where understanding why one answer
is correct and the others are wrong is the actual learning.

Who should NOT take 350-701?

The cert is wrong for these candidates:

You are	Take instead
New to networking with no Cisco foundation	CCNA 200-301 first to build routing, switching, and subnetting fundamentals
New to security with no enterprise exposure	CompTIA Security+ for a vendor-neutral foundation
Focused on enterprise routing and switching	ENCOR 350-401 (CCNP Enterprise) is the right core exam
Cloud-only security with no on-prem Cisco gear	AWS Security Specialty, CCSP, or a cloud-native security cert
Looking for a general IT security credential	CompTIA Security+ or CySA+ covers more job postings at lower cost

The path matters more than the badge. SCOR is an excellent investment when
your career runs on Cisco security infrastructure and you are ready to
operate it at an expert level. It is a poor use of $400 and three months
if your environment runs a different firewall vendor and no Cisco ISE. The
exam tests a specific stack deeply, not general security principles broadly.

What's next after 350-701?

Passing 350-701 SCOR opens several concrete paths:

Complete CCNP Security: pair SCOR with one concentration exam. The 300-710 SNCF (Securing Networks with Cisco Firepower) is the most common choice and aligns with what the market demands. Other options include 300-715 SISE (ISE), 300-720 SESA (email security), 300-725 SWSA (web security), and 300-730 SVPN (VPNs)
CCIE Security path: SCOR counts as the written/qualifying exam for CCIE Security. Once SCOR is complete, you can register for the CCIE Security lab exam, which is an 8-hour hands-on practical
Vendor-neutral pairing: many candidates add CISSP after CCNP Security for senior architect and leadership roles. The two credentials complement each other well - CCNP Security demonstrates Cisco product depth, CISSP demonstrates security program breadth
Specialization: if your work centers on email security or web proxy, the content security concentration (300-720 or 300-725) deepens that specific expertise

Most people spend 6 to 12 months between passing SCOR and sitting a
concentration exam. Use that window to deploy what you studied in production.
CCNP Security pays off most when a hiring manager sees it next to real
Cisco security operations experience. Note that Cisco certifications expire
after three years, so plan to recertify via Continuing Education credits or
by retaking the exam before that window closes.

Ready to start? Practice with real 350-701 SCOR questions on NerdExam
or jump straight into the free per-question explanations.
If you want to verify the official exam blueprint before committing to a
study plan, the current topic list is published on the
Cisco Learning Network.

Cisco 350-401 ENCOR (CCNP Enterprise Core): What's Actually Tested

NERDEXAM — Thu, 09 Jul 2026 14:02:24 +0000

The Cisco 350-401 ENCOR (Implementing and Operating Cisco Enterprise Network
Core Technologies) is the core exam for CCNP Enterprise and doubles as the
written qualifying exam for CCIE Enterprise Infrastructure and CCIE Enterprise
Wireless. The exam costs $400, runs 120 minutes, has 90 to 110 questions, and
requires a score of around 825 out of 1000 to pass. Cisco does not publish an
official cut score, but that figure reflects consistent community consensus.
Most experienced engineers need 10 to 14 weeks of focused study. The question
mix is heavily scenario-based multiple choice and drag-and-drop, with far fewer
hands-on simulations than CCNA. If you hold a CCNA and have worked in
enterprise networks, this is the next logical credential. If you are brand new
to Cisco gear, start with CCNA first.

The 90-second answer

Take 350-401 ENCOR if you are an experienced network engineer who wants
to advance from CCNA to CCNP, or if your role already involves enterprise
routing, switching, wireless, SD-WAN, or SD-Access. ENCOR is also the
required qualifier if you are eventually targeting a CCIE lab. The credential
is widely recognized by enterprise employers and represents a real knowledge
step up from associate-level certs.

Skip 350-401 ENCOR if you have not yet passed CCNA 200-301 or built
genuine hands-on networking experience. There are no formal prerequisites,
but Cisco recommends three to five years of enterprise networking experience,
and that recommendation reflects the actual question difficulty. Going in
underprepared costs $400 for the first attempt and $400 again for the
retake, with a five-day wait between attempts.

What does the 350-401 actually test?

ENCOR covers six domains. The current blueprint is version 1.1. Every
question maps to one of these.

Domain	Weight	What it covers
Architecture	15%	Enterprise network design, high availability, wireless deployment models, Cisco SD-WAN and SD-Access fabric design
Virtualization	10%	Device virtualization (VMs, containers), data path virtualization (VRF, GRE, IPsec), network virtualization (LISP, VXLAN)
Infrastructure	30%	Layer 2 (VLANs, trunking, EtherChannel, STP), Layer 3 (OSPF, EIGRP, BGP), wireless (AP modes, WLC, roaming), IP services (NTP, NAT, DHCP, IP SLA, QoS)
Network Assurance	10%	SNMP, syslog, NetFlow/Flexible NetFlow, SPAN/RSPAN, IP SLA, Cisco DNA Center assurance, debugs and show commands
Security	20%	Device access control (AAA, TACACS+, RADIUS), CoPP, ACLs, port security, 802.1X, MACsec, wireless security
Automation	15%	Python basics, JSON, REST APIs, data models and YANG, EEM, Cisco DNA Center APIs, config management (Ansible, Puppet, Chef), SDN concepts

Infrastructure carries the highest weight at 30%, so routing protocol depth
matters more here than on any other Cisco exam below the CCIE. You need to
understand OSPF neighbor adjacencies, BGP path selection, EIGRP metric
calculation, and STP root bridge election, not just recognize the terms.

The Architecture and Automation domains together are 30% of the exam and they
reward candidates who have worked with modern enterprise designs. SD-WAN and
SD-Access questions describe a fabric or a deployment scenario and ask you to
identify the correct component, design decision, or troubleshooting step.
These are not conceptual-only questions. You need to know how SD-WAN control
plane, data plane, and management plane separate, and where Cisco DNA Center
fits in SD-Access fabric design.

The Security domain at 20% is broader than most candidates expect. AAA using
TACACS+ versus RADIUS is a common topic, as is CoPP (Control Plane Policing),
which protects the router control plane itself. 802.1X and MACsec appear in
scenario questions that mix wireless and wired access.

Automation at 15% is not optional studying. Community feedback from recent
exam sittings consistently flags Python, REST APIs, and YANG data models as
live on exam day. You do not need to write production Python, but you do need
to read a short script and understand what it does, parse a JSON payload, and
describe how a RESTCONF or NETCONF call is structured.

How hard is the 350-401?

ENCOR is a difficulty 4 out of 5. Clearly harder than CCNA 200-301, which is
a 3.5, and significantly broader in scope. Cisco does not publish a pass rate,
but community surveys suggest first-time pass rates are lower than CCNA,
largely because the breadth and depth of six domains is genuinely demanding
even for working engineers.

The hard parts are specific:

The Infrastructure domain alone is 30% of the exam and it expects depth on three routing protocols plus wireless and QoS, not just awareness of them
SD-WAN and SD-Access are tested at a design and troubleshooting level that many engineers have not encountered in day-to-day operations, especially those in shops that have not deployed Viptela or Catalyst Center
Automation questions require you to read and reason about code, JSON, and API calls even if you are not primarily a programmer
No back button. Cisco exams lock each question on submission, so a scenario you get stuck on burns time you cannot recover
At 90 to 110 questions in 120 minutes, you average just over one minute per question. Scenario-based items that require you to work through a multi-step design problem will consume two to three minutes each if you are not prepared

The most common failure pattern is candidates who know routing and switching
well but underestimate the Architecture and Automation domains. Solid OSPF
and BGP knowledge is necessary but not sufficient. Someone who scored well
on CCNA by memorizing show commands and protocol theory will struggle with
ENCOR's SD-WAN design and Python-parsing questions.

How long should you study for 350-401?

Cisco recommends three to five years of enterprise networking experience before
sitting the exam. That is not a suggestion to ignore. For actual study time:

With 3+ years enterprise networking and CCNP-level exposure at work: 8 to 10 weeks at 10 to 15 hours per week
With CCNA and 1 to 3 years networking experience: 12 to 14 weeks at 10 to 15 hours per week
With CCNA and less than one year of hands-on work: 16 to 20 weeks, and seriously consider accumulating more lab and production experience before booking
Coming from a different vendor or role type (Juniper, cloud, security): 12 to 16 weeks to ramp on Cisco-specific implementations of shared concepts

A realistic week-by-week pace for a 12-week plan looks like:

Week 1: Enterprise architecture fundamentals, high availability designs, SD-WAN overview (Architecture domain foundation)
Week 2: SD-Access fabric design, overlay and underlay, Catalyst Center role
Week 3: Virtualization - VRF, GRE, IPsec, LISP, VXLAN concepts and use cases
Week 4: Layer 2 deep dive - VLANs, trunking, EtherChannel, STP variants
Week 5: OSPF areas, LSA types, neighbor adjacency troubleshooting
Week 6: EIGRP metrics and tuning, BGP path selection, route redistribution
Week 7: Wireless - AP modes, WLC architecture, roaming, wireless security
Week 8: IP services - QoS, NTP, NAT, DHCP, IP SLA
Week 9: Security - AAA, TACACS+ vs RADIUS, CoPP, 802.1X, MACsec, ACLs
Week 10: Network Assurance - SNMP, NetFlow, SPAN, DNA Center assurance, debug and show command strategy
Week 11: Automation - Python basics, JSON, REST APIs, YANG, DNA Center APIs, Ansible fundamentals, EEM
Week 12: Full timed practice exams, review weak domains, scenario drilling

The biggest waste of study time on ENCOR is focusing almost exclusively on
Infrastructure and ignoring Automation and Architecture. Many experienced
engineers come in strong on routing and switching, then get blindsided by
SD-WAN design questions and Python-parsing items that together account for
nearly a third of the exam.

What does the 350-401 cost?

The exam itself is $400 USD plus any local taxes. That is $100 more than CCNA,
and Cisco does not routinely issue discounted retake vouchers, so a failed
attempt means another $400 after the mandatory five-day wait.

Component	Range	Notes
Exam fee	$400	One attempt. Retake is another $400 with a 5-day wait after a fail.
Study course	$0 to $200	Nick Russo's free materials, Cisco's own dCloud labs, or a paid Udemy course at $15 to $30 on sale
Practice questions	$0 to $60	NerdExam has 1,356 ENCOR questions if you want a free option
Lab access	$0 to $200	Cisco dCloud is free; CML Personal or EVE-NG with IOS-XE images for deeper routing scenarios
Books	$0 to $80	Cisco Press ENCOR Official Cert Guide by Chapple and Lacoste is the standard reference
Total realistic spend	$400 to $700	Cheapest viable path: $400 (exam only, if you leverage free resources)

Given the $400 per-attempt cost, the "do not book until your practice scores
are consistently above 80%" rule matters more here than on almost any other
associate or professional cert. Cisco occasionally runs promotional pricing or
partner voucher bundles through the Cisco Learning Network Store, so check
before you buy.

What salary can you expect after passing?

CCNP-level credentials move you from entry-to-mid into mid-to-senior
compensation territory. ENCOR alone qualifies you for CCNP Enterprise once
you add a concentration exam, and that combination is a recognized signal
for senior-level roles. 2026 US estimates from job boards:

Network Engineer with CCNP Enterprise: $95,000 to $130,000
Senior Network Engineer or Network Architect with CCNP: $130,000 to $175,000
Network Operations lead or consultant with CCNP: $100,000 to $145,000

CCNP holders in enterprise networking consistently out-earn CCNA-only
candidates by a meaningful margin. The gap widens further once CCNP is
combined with three or more years of production enterprise experience. At the
CCIE level, which ENCOR partially qualifies you for, total compensation
packages regularly exceed $175,000 in major markets.

The cert itself is the signal that gets you past resume filters for senior
network engineer and architect roles. The real pay trajectory requires the
cert plus actual work delivering SD-WAN rollouts, BGP policy changes, or
wireless infrastructure at scale.

What study resources actually work?

The candidates who pass ENCOR on the first attempt tend to use a consistent
stack:

One structured course for breadth. Cisco Press's Official Cert Guide is the most thorough single resource; INE and CBT Nuggets both have video courses that are strong on the Infrastructure and Automation domains
A real lab, not just Packet Tracer. ENCOR covers IOS-XE behaviors, SD-WAN control plane, and YANG that Packet Tracer does not model well. Cisco dCloud is free and has pre-built ENCOR topology labs. CML (Cisco Modeling Labs) Personal is worth the cost if you plan to push toward CCIE
Dedicated automation practice. Do not just read about Python and REST APIs. Write a short Python script that calls a DNA Center sandbox API. Cisco DevNet has a free always-on DNA Center sandbox at developer.cisco.com. Parsing JSON by hand in a sandbox makes the automation questions concrete
At least 600 practice questions before exam day, weighted toward Infrastructure and Security, with scenario-based items so design and troubleshooting questions do not surprise you
Two full-length timed practice exams in the final two weeks. Treat them like the real thing. If you are scoring below 80%, postpone the real exam. At $400 an attempt, postponing is almost always the right financial decision

Avoid brain-dump sites. Cisco actively updates ENCOR question pools and brain
dumps go stale quickly. More importantly, ENCOR rewards the ability to reason
through a scenario, not recognize a memorized answer string. The Cisco
Learning Network forums and Reddit's r/ccnp have current, crowdsourced
guidance on which resources are working this quarter.

For practice questions, NerdExam has 1,356 enriched 350-401 ENCOR questions
with full explanations. Start with a free ENCOR practice question
to see the question style and reasoning depth before you commit to a study plan.
Working through explanations for Infrastructure and Automation items shows you
exactly how Cisco frames scenario logic, which is easier to absorb from worked
examples than from video summaries.

Who should NOT take 350-401?

The exam is wrong for these candidates:

You are	Take instead
Brand new to networking with no Cisco experience	CCNA 200-301 first to build the foundation
A pure cloud engineer who never configures Cisco gear	AWS, Azure, or GCP networking certifications
Security-focused and not doing network operations	CCNP Security (SCOR 350-701) or CompTIA Security+
Looking for vendor-neutral fundamentals validation	CompTIA Network+ is broader and cheaper
A network engineer who only needs CCNA-level validation	Stay at CCNA until you have the production experience ENCOR expects

The investment here is not just the $400 exam fee. It is 10 to 14 weeks of
serious study time. That time is well spent for a working network engineer
ready to move into senior roles. It is a poor investment for someone who
wants a cert badge without the underlying experience the badge implies to
hiring managers who actually verify it in interviews.

What's next after 350-401?

Passing ENCOR opens several paths:

Complete CCNP Enterprise: Add one concentration exam. The most common pick is 300-410 ENARSI (Advanced Routing and Services), which deepens OSPF, BGP, EIGRP, and VPN troubleshooting. Other concentration options include 300-415 ENSDWI (SD-WAN) and 300-435 ENAUTO (Automation), depending on where your career is pointing.
CCIE Enterprise lab path: ENCOR satisfies the written/qualifying requirement for both CCIE Enterprise Infrastructure and CCIE Enterprise Wireless. The lab exams are a separate and significantly harder undertaking, but ENCOR is the required gateway. Most engineers spend one to two years in production and focused lab work between passing ENCOR and attempting the CCIE lab.
SD-WAN or Automation specialization: 300-415 ENSDWI and 300-435 ENAUTO are both viable concentration choices if your shop is deep in Viptela SD-WAN or Catalyst Center automation. Either makes a strong resume signal in enterprise sales engineering and network architect roles.
DevNet Professional: If the Automation domain on ENCOR sparked genuine interest in network programmability, the Cisco DevNet Professional path (350-901 DEVCOR) builds directly on those skills.

Note that Cisco certifications expire after three years. ENCOR's three-year
clock starts on your pass date. You can renew by passing any 300-level or
higher Cisco exam, or by passing ENCOR again, or by completing continuing
education credits through the Cisco Learning Network.

Ready to start? Browse all 350-401 ENCOR practice questions on NerdExam
or jump straight into the free per-question explanations.
If you want to explore the official blueprint before you buy study materials,
the current exam topics are published on the
Cisco Learning Network.

Certified Ethical Hacker (CEH v13, 312-50): What's Actually Tested

NERDEXAM — Tue, 07 Jul 2026 14:04:04 +0000

The Certified Ethical Hacker (CEH v13, exam 312-50) is the single most
recognized name in offensive security certification. The exam voucher runs
about $1,199, the clock is 4 hours, and you face 125 multiple-choice
questions across 20 hacking domains. The passing threshold is not a fixed
number - EC-Council uses per-form cut scores that range from 60% to 85%
depending on how the question set is calibrated, often cited around 70%.
Version 13 layers generative AI throughout every module, so expect
questions on using AI to assist each phase of hacking and on securing AI
systems. Most candidates need 6 to 10 weeks of focused prep. If you are
already working in security operations or penetration testing, 4 to 6 weeks
is realistic. If you are coming from a general IT background, budget the
full 10 weeks and go domain by domain.

The 90-second answer

Take CEH v13 if you need the credential for a specific reason: DoD
8570/8140 compliance, a government or defense-contractor role that
explicitly lists it, or an employer whose HR checklist requires it. CEH is
the dominant name-recognition cert in offensive security, and its DoD
approval is the primary reason thousands of candidates pay $1,199 for an
exam that is otherwise considered broad and not deeply technical.

Skip CEH v13 if you want to prove hands-on hacking ability. CEH is
widely described as "a mile wide and an inch deep." It tests whether you
can recognize tools, phases, and terminology, not whether you can exploit a
live target. If your goal is to impress a hands-on hiring team, OSCP
carries far more weight. If budget is the constraint, CompTIA PenTest+
(PT0-003) covers similar ground for roughly a third of the price.

What does the CEH v13 actually test?

CEH v13 spans 20 hacking modules mapped to nine broad domain groups. The
blueprint weights below are approximate and established across recent
versions. Version 13's headline change is that generative AI appears across
all 20 modules - questions cover AI-assisted recon, malware that leverages
AI techniques, and defending AI infrastructure, so do not ignore those additions.

Domain	Approx. Weight	What it covers
Information Security and Ethical Hacking Overview	~6%	Hacking concepts, attack phases, the cyber kill chain, ethics, laws and standards
Reconnaissance Techniques	~21%	Footprinting, OSINT, scanning networks (Nmap), enumeration
System Hacking Phases and Attack Techniques	~17%	Vulnerability analysis, system hacking, privilege escalation, malware (trojans, viruses, worms, fileless)
Network and Perimeter Hacking	~14%	Sniffing, social engineering, denial of service, session hijacking, evading IDS/firewalls/honeypots
Web Application Hacking	~16%	Hacking web servers and web apps, SQL injection, OWASP-style flaws
Wireless Network Hacking	~6%	Wireless encryption, wireless attacks, and tools
Mobile, IoT, and OT Hacking	~8%	Mobile platform attacks, IoT and operational-technology threats
Cloud Computing	~6%	Cloud concepts, container and serverless security, cloud attack vectors
Cryptography	~6%	Ciphers, PKI, encryption tools, cryptanalysis attacks

Reconnaissance is the heaviest single area at roughly 21%, which reflects
how much of real-world offensive work starts with Nmap scans, OSINT
gathering, and enumeration before anything touches an exploit. Web
application hacking at ~16% is the second-heaviest block, and SQL injection
appears repeatedly across multiple question styles there.

The exam rewards breadth over depth. A typical question presents a scenario
and a list of tools, then asks which tool fits the described technique, or
which phase of hacking the described activity belongs to. You will see
Nmap, Metasploit, Wireshark, John the Ripper, Aircrack-ng, SQLmap, and
several dozen other tools referenced by name. Knowing what each tool does
and which phase it maps to is more important than knowing how to run them
in a live shell.

How hard is the CEH v13?

CEH v13 is a difficulty 3 out of 5. It is broader than Security+, but the
questions are more recall-oriented than the deep analysis that OSCP or even
CASP+ requires. The "mile wide, inch deep" criticism is accurate and worth
taking seriously when you plan your prep strategy.

The genuinely hard parts are:

The sheer volume of tools, techniques, and acronyms across 20 domains. There are hundreds of named tools in the blueprint and you need to know roughly what each one does.
The AI additions in v13 are newer, so practice materials for those topics are thinner than for the core domains. Budget extra time for AI-assisted attack and defense content.
The variable cut score. You do not know whether you landed a 60%-cut or an 85%-cut form until you sit down. Scoring in the high 70s on practice exams is not a safe buffer.
The eligibility barrier before you even book the exam. You either complete official EC-Council training (which bundles the voucher and typically costs $2,000 or more) or you pay a $100 non-refundable application fee and document at least 2 years of information-security work experience. No shortcut around that gate.

The most common failure pattern is underestimating the tool and technique
volume. Candidates who consume a single video course and skip the tool
flashcard work tend to blank on the scenario questions that ask "which of
these tools performs passive fingerprinting" or "which malware type
self-replicates without user interaction." The breadth is the difficulty,
not the depth of any single topic.

How long should you study for CEH v13?

EC-Council recommends candidates have a background in information security
before attempting the exam. That recommendation is real - the domains
assume you already know networking basics and general security concepts.
For actual study time:

With 2+ years of security operations or pen testing experience: 4 to 6 weeks at 8 to 10 hours per week
With a general IT or networking background and Security+: 6 to 8 weeks at 8 to 12 hours per week
New to security but with solid IT fundamentals: 10 weeks, and consider CompTIA Security+ first to build the foundational vocabulary
Switching from a purely defensive (blue team) background: 6 to 8 weeks, focused on offensive phases, tools, and the attack-centric framing the exam uses

The biggest study mistake is drilling only the domains you already know.
Reconnaissance is ~21% of the exam and most security practitioners have
gaps in wireless (~6%), IoT/OT (~8%), or the specific cryptanalysis
vocabulary. Map your weak domains in week 1 and weight your time there.

A realistic week-by-week pace for an 8-week plan looks like:

Week 1: Hacking overview, attack phases, kill chain, laws and ethics; begin tool inventory flashcards
Week 2: Footprinting, OSINT tools, Nmap scanning, enumeration techniques
Week 3: Vulnerability analysis, system hacking phases, privilege escalation methods
Week 4: Malware types, sniffing, social engineering, DoS/DDoS, session hijacking
Week 5: IDS/firewall/honeypot evasion, web server and web app hacking, SQL injection, OWASP flaws
Week 6: Wireless attacks, mobile hacking, IoT and OT threats
Week 7: Cloud security, cryptography, and the AI-assisted techniques added in v13
Week 8: Full timed practice exams, tool and phase flashcard review, weak-domain sweep

Most shortfalls trace back to the tool-recognition questions in week 2 and
3 content. Reconnaissance and system hacking together account for nearly
40% of the exam. If your flashcards are not covering named tools per phase
by week 3, the timed practice exams in week 8 will feel thin.

What does the CEH v13 cost?

The exam voucher alone is about $1,199. That is one of the most expensive
single-exam vouchers in the certification market, and the total cost depends
heavily on which eligibility path you take.

Component	Range	Notes
Exam voucher (remote proctored)	~$1,199	One attempt via EC-Council's ECC Exam platform
Official EC-Council training	$2,000+	Bundles the voucher; required unless you apply via experience path
Experience-path application fee	$100 non-refundable	Requires 2+ years documented infosec experience; no training required
Study course (third-party)	$30 to $200	Matt Walker, Total Seminars, or Pluralsight if you go the experience path
Practice questions	$0 to $60	NerdExam has 627 CEH questions; official iLabs is a separate paid add-on
Total via official training path	$2,000 to $3,000+	Voucher typically bundled but training cost dominates
Total via experience path	$1,300 to $1,600	$100 app fee + $1,199 voucher + third-party study materials

The price is the most common reason candidates hesitate. CompTIA PenTest+
(PT0-003) covers much of the same conceptual ground for roughly $404. The
reason CEH stays popular despite the cost is its DoD 8570 approval and its
presence on HR job-requirement checklists for government and contractor
roles. For those specific roles, the premium is often unavoidable.

EC-Council also charges an annual ECE membership fee during the 3-year
cert validity period. Factor that in if you are calculating total cost of
ownership. Retake policy and fees vary; check the EC-Council site before
you book.

What salary can you expect after passing?

CEH is primarily a compliance and name-recognition cert, so the salary
ranges reflect the roles it unlocks rather than a direct premium for the
cert itself. 2026 US data from job boards shows:

SOC analyst or security analyst with CEH: $75,000 to $110,000
Vulnerability analyst or assessor with CEH: $90,000 to $125,000
Penetration tester with CEH: $95,000 to $140,000
Senior offensive security roles with CEH plus 5+ years: $130,000 to $170,000

A realistic note on what the cert does and does not do: CEH functions
largely as a hiring filter and a compliance checkbox, especially in
government and defense-contractor environments that require DoD 8570/8140
alignment. You will often see it listed as required for roles where the
actual work is more audit-style than active exploitation. For hands-on
penetration testing teams, OSCP carries significantly more weight with
technical hiring managers. CEH gets you past the HR screen; OSCP gets you
respect in the room. Many candidates hold both.

What study resources actually work?

The candidates who pass on the first attempt tend to use a consistent stack
built around breadth and tool recognition:

One structured course covering all 20 modules. Matt Walker's CEH study guides are the community standard for the experience-path self- study approach. Total Seminars and Pluralsight both offer solid video-based coverage.
A dedicated tool inventory. Build a flashcard deck mapping every named tool to its phase (recon, exploitation, post-exploitation, etc.) and its category (network scanner, password cracker, packet sniffer, wireless cracker, web app scanner). The exam uses tool names constantly.
Phase mapping practice. Know the five phases of hacking (recon, scanning, gaining access, maintaining access, covering tracks) and map every domain activity to one of those phases. Many questions are just "which phase does this describe."
At least 500 practice questions before exam day. Include questions that test tool recognition and attack/defense framing, not just definitions. Practice under time pressure: 125 questions in 4 hours is about 115 seconds per question, which is tighter than it sounds when long scenarios are involved.
Two full-length timed practice exams in the final two weeks. If your score is below the 75% mark on both, push the exam date and work the weak domains. The variable cut score means you want a real buffer.

Skip brain-dump sites. EC-Council actively pursues cert fraud, and more
practically, the questions on the actual exam are scenario-based in ways
that brain dumps do not prepare you for. You will recognize a question's
answer without understanding why, which leaves you flat when the scenario
twists slightly.

For the practice question portion, NerdExam has 627 enriched CEH 312-50
questions with full explanations. Start practicing CEH v13 questions
to see the tool-recognition and scenario framing before you commit to a
study plan. The explanations map answers back to the five hacking phases
and the relevant domain, which is exactly the mental model the exam tests.

Who should NOT take the CEH v13?

The cert is the wrong fit for several common candidate profiles:

You are	Take instead
On a budget and want hands-on proof of offensive skill	OSCP or CompTIA PenTest+ (PT0-003) at roughly one-third the cost
Brand new to security entirely	CompTIA Security+ first to build the foundational vocabulary
A blue-team defender who has no offensive requirement	CySA+ or GIAC GCIH, which are purpose-built for detection and response
A cloud security specialist	A cloud security cert (AWS Security Specialty, Google PCSE, or CCSP)
Someone who needs pen test credibility with technical teams	OSCP; CEH is a box-check, OSCP is a proof of work

The price-to-value calculation is honest: if you do not need CEH for a
specific role requirement or DoD compliance, you can cover the same
conceptual material for far less money and earn more hands-on credibility
with OSCP or PenTest+. CEH's value is real but narrow. It is the standard
HR filter for government and contractor offensive security roles, and that
is the use case it is optimized for.

What's next after CEH v13?

Once CEH is in hand, several paths branch depending on your goal:

Hands-on credibility track: CEH Practical (the lab-based companion exam) is the natural next step. Pass CEH Practical alongside CEH ANSI and you become a CEH Master, which signals hands-on ability that the multiple- choice exam alone cannot prove. After that, OSCP is the gold standard for offensive security credibility with technical teams.
Broader pen testing track: CompTIA PenTest+ (PT0-003) or GIAC GPEN if you want more structured coverage of the pen testing lifecycle beyond CEH's breadth-over-depth approach.
Defense and detection track: If you discover that your work is more detection and response than offensive, pivot to CompTIA CySA+ or GIAC GCIH. Many CEH holders end up in hybrid roles where both views matter.
Cloud offensive track: CCSP or AWS Security Specialty if your environment is heavily cloud-based and the Cloud Computing domain was the area where you felt most engaged.

Most people take 6 to 12 months between CEH and their next cert. Use that
window to put the domains into practice - run a home lab, work through a
CTF platform, or move into a role where you are doing actual vulnerability
assessments. CEH on a resume paired with real work experience is a strong
combination. CEH alone, without applied experience, gets you past the
filter but not much further.

Ready to start? Browse the full CEH 312-50 question bank on NerdExam
or jump straight into the free per-question explanations.
If you are still weighing whether CEH is the right cert for your situation,
the official EC-Council program page at
eccouncil.org/programs/certified-ethical-hacker-ceh
has the current eligibility requirements, approved training providers, and
the official blueprint mapped to each domain.

Cisco Certified Network Associate (CCNA 200-301): What's Actually Tested

NERDEXAM — Mon, 06 Jul 2026 14:01:52 +0000

The Cisco Certified Network Associate (CCNA 200-301) is the single most
recognized entry credential in networking. The exam is $300, runs 120
minutes, has roughly 100 questions, and requires about 825 out of 1000 to
pass. Most candidates need 10 to 16 weeks of focused study. The questions
mix multiple choice with drag-and-drop and live router/switch simulations,
so pure memorization does not cut it. If you already configure Cisco gear
at work, you can pass in a couple of months. If you are new to networking,
budget the full 16 weeks and spend real time in a lab.

The 90-second answer

Take CCNA 200-301 if you want a networking career and you are willing
to learn subnetting, routing, and switching by actually configuring
devices. It is the credential that gets your resume past the filter for
network technician, NOC, help desk, and junior network engineer roles. No
single cert is more widely requested in networking job postings.

Skip CCNA 200-301 if you have zero interest in command-line device
configuration or you are chasing cloud or security roles that do not touch
Cisco gear. If you only want to validate general IT fundamentals, CompTIA
Network+ is a gentler, vendor-neutral starting point. Going straight to
CCNA with no networking exposure usually ends in a failed first attempt
and another $300.

What does the CCNA 200-301 actually test?

CCNA 200-301 covers six domains. The blueprint has been stable since the
exam consolidated to a single test in 2020, with minor refreshes. Every
question maps to one of these.

Domain	Weight	What it covers
Network Fundamentals	20%	OSI/TCP-IP models, cabling, IPv4/IPv6 addressing, subnetting, switches vs routers
Network Access	20%	VLANs, trunking, EtherChannel, STP, wireless LAN concepts, WLC config
IP Connectivity	25%	Routing tables, static routing, OSPFv2, default gateways, FHRP basics
IP Services	10%	DHCP, DNS, NAT, NTP, SNMP, syslog, QoS concepts
Security Fundamentals	15%	Access control, port security, ACLs, VPN concepts, WPA, layer 2 threats
Automation and Programmability	10%	REST APIs, JSON, controller-based networking, Ansible/Puppet/Chef concepts, SDN

The exam rewards hands-on muscle memory. A simulation question may drop
you into a router CLI and ask you to configure OSPF or fix a VLAN trunk,
then grade your actual configuration. Subnetting shows up everywhere, and
you have to do it fast and in your head, because there is no calculator.

If you have heard "CCNA is the cert that finally makes subnetting click,"
that is because the exam forces it.

How hard is the CCNA 200-301?

CCNA 200-301 is a difficulty 3.5 out of 5. Harder than CompTIA Network+,
much easier than CCNP Enterprise (ENCOR 350-401). Cisco does not publish a
pass rate, but community surveys put first-time pass rates in the 60% to
70% range for people who studied at least 10 weeks and did real labs.

The hard parts are specific:

Subnetting under time pressure, including VLSM, with no calculator
Live simulation questions that grade your actual device configuration, not a multiple-choice guess
The breadth: six domains spanning switching, routing, services, security, and automation, so you cannot specialize your way through
No back button. Cisco exams do not let you flag and return to questions, so a simulation you get stuck on burns time you cannot recover

People who fail CCNA usually fail on pacing and subnetting speed, not on
concepts they never saw. The simulation questions early in the exam are
the classic trap.

The most common failure pattern looks like this: candidate watches an
entire video course, never racks up real CLI hours, walks in, hits an OSPF
simulation at question 12, spends 18 minutes on it, then rushes the rest
and runs out of time. Final result: fail. Build CLI fluency in week 4,
not week 12, and drill subnetting until you can do a /26 split in under 30
seconds.

How long should you study for CCNA 200-301?

Cisco lists no formal prerequisites, but recommends roughly one year of
networking experience. That assumption is baked into the question
difficulty. For actual study time:

With 1+ year hands-on networking experience: 8 to 10 weeks at 8 to 12 hours per week
With CompTIA Network+ or some IT background: 12 to 14 weeks at 8 to 12 hours per week
Brand new to networking: 16 to 20 weeks, and consider Network+ first to build vocabulary
Switching from another vendor (Juniper, Aruba): 8 to 10 weeks, mostly to learn Cisco IOS syntax and the CCNA blueprint's edges

The biggest waste of study time is watching videos without touching a CLI.
Build a lab. Cisco Packet Tracer is free and covers most of the blueprint;
GNS3 or EVE-NG with real IOS images go further. Configure VLANs and
trunks, stand up OSPF between three routers, break STP on purpose and fix
it. That hands-on work is what makes simulation questions painless.

A realistic week-by-week pace for a 12-week plan looks like:

Week 1: OSI/TCP-IP models, cabling, switch vs router basics
Week 2: IPv4 addressing and subnetting (start drilling now)
Week 3: VLSM, IPv6 addressing, subnetting speed drills
Week 4: Switch configuration, VLANs, access vs trunk ports
Week 5: Spanning Tree Protocol, EtherChannel, port security
Week 6: Static routing, routing tables, default gateways
Week 7: OSPFv2 single-area, neighbor adjacencies, troubleshooting
Week 8: Wireless LAN concepts, WLC configuration, AP modes
Week 9: IP services (DHCP, DNS, NAT, NTP, SNMP, syslog)
Week 10: Security (ACLs, VPN concepts, layer 2 threats, WPA)
Week 11: Automation and programmability (REST, JSON, SDN, Ansible)
Week 12: Full timed practice exams, simulation drills, subnetting speed

Most failures trace back to skipping the subnetting reps in weeks 2 and 3.
Subnetting touches Network Fundamentals, IP Connectivity, and IP Services,
which together are well over half the exam.

What does the CCNA 200-301 cost?

The exam itself is $300 USD plus any local taxes. Beyond that, total cost
depends on your study path:

Component	Range	Notes
Exam fee	$300	One attempt. Retake is another $300, with a 5-day wait after a fail.
Study course	$0 to $150	Jeremy's IT Lab (free on YouTube) or a paid Udemy course at ~$15 on sale
Practice questions	$0 to $60	NerdExam has 1794 CCNA questions if you want a free option
Lab software	$0	Cisco Packet Tracer is free; GNS3 and EVE-NG are free too
Books	$0 to $60	Wendell Odom's Official Cert Guide library is the standard reference
Total realistic spend	$300 to $500	Cheapest viable path: $300 (exam only)

Unlike some vendors, Cisco does not routinely hand out 50% retake
vouchers, so a failed attempt costs the full $300 again. That makes the
"do not book until your practice scores are solid" rule more important here
than on cheaper exams. Cisco does occasionally run promotional pricing or
voucher bundles through partners and the Cisco Learning Network Store, so
check before you buy.

What salary can you expect after passing?

CCNA is an entry-to-mid credential, so the salary range is wide and
depends heavily on the role and your experience. 2026 US data from job
boards shows:

Help desk or NOC technician with CCNA: $50,000 to $70,000
Network administrator with CCNA: $70,000 to $95,000
Network engineer with CCNA: $90,000 to $130,000
Senior network engineer with CCNA plus 3+ years: $120,000 to $150,000, often on the path to CCNP

The cert alone does not deliver the top numbers. CCNA opens the door; the
pay jumps come from production experience and, usually, a follow-on cert
like CCNP. Where you see CCNA pay $60K, the holder is early-career. Where
you see $130K, the holder has years of real network operations behind the
cert.

A practical note: CCNA is most valuable as a hiring filter. Many network
engineer and NOC postings list it as required or strongly preferred, which
means not having it quietly removes you from the pile before a human reads
your resume. The salary lift is real but indirect. It comes from getting
access to roles you could not apply for without it.

What study resources actually work?

The candidates who pass on the first attempt use a consistent stack:

One structured course for breadth. Jeremy's IT Lab on YouTube is the community favorite and completely free; Wendell Odom's Official Cert Guide pair is the gold-standard book set if you prefer reading
A lab, used daily. Cisco Packet Tracer (free) covers most of the blueprint. GNS3 or EVE-NG with real IOS images go deeper for OSPF and automation topics
A dedicated subnetting drill. subnettingpractice.com or a flashcard app, every day, until a /26 or /28 split is automatic
At least 500 practice questions before exam day, including simulation-style questions so the live labs do not surprise you
Two full-length timed practice exams in the final two weeks. Treat them like the real thing, no breaks, and score honestly. If you are below 80% on the second one, postpone the real exam

Skip the brain-dump sites that sell "real exam questions." They are
against Cisco policy, frequently wrong, and they teach you to recognize
answers instead of configure devices, which is exactly what the
simulations punish. Reddit's r/ccna has the most current crowd-sourced
advice on which resources are working this quarter.

For the practice question portion, NerdExam has 1794 enriched CCNA 200-301
questions with full explanations. Start practicing CCNA 200-301 questions
to see the question style before you commit to a study plan. The free
question explanations alone show you the reasoning the exam expects,
especially for subnetting and routing logic that is hard to absorb from
videos.

Who should NOT take CCNA 200-301?

The cert is wrong for these candidates:

You are	Take instead
Brand new to IT entirely	CompTIA Network+ (or A+) first to build fundamentals
Focused on cybersecurity, not networking	CompTIA Security+ or the Cisco CyberOps Associate path
A cloud engineer who never touches Cisco gear	AWS, Azure, or GCP networking certs
An experienced network engineer with CCNP-level skills	Skip CCNA, go straight to CCNP Enterprise (ENCOR 350-401)
Only validating general IT for a help desk role	CompTIA A+ plus Network+ is a cheaper, broader fit

The path matters more than the badge. CCNA is excellent when networking is
your career direction. It is a poor use of three months if your role lives
in the cloud console and never opens an IOS prompt. Hiring managers do not
penalize cloud or security candidates for lacking CCNA; they penalize
networking candidates who cannot subnet.

What's next after CCNA 200-301?

Once CCNA is in hand, a few paths open depending on where you want to go:

Enterprise track: CCNP Enterprise (ENCOR 350-401 plus a concentration exam). The natural follow-on for network engineers, and where the real salary jumps live. Most people do this 12 to 24 months after CCNA.
Security track: CCNP Security, or pivot toward Cisco CyberOps and CompTIA Security+ if you want to move into a SOC.
Automation track: Cisco DevNet Associate (200-901). Pairs well with CCNA as networking shifts toward automation and infrastructure-as-code.
Data center or service provider track: CCNP Data Center or CCNP Service Provider, if your employer runs that kind of environment.

Most people take 12 to 24 months between CCNA and CCNP. Use that window to
ship real network operations work. CCNA pays off when a hiring manager
sees it next to actual experience, not when it is the only line on your
resume. Note that Cisco certifications expire after three years, so plan to
recertify or move up to CCNP before then.

Ready to start? Practice with real CCNA 200-301 questions on NerdExam
or jump straight into the free per-question explanations.
If you are still building fundamentals first, download Cisco Packet Tracer
from the Cisco Networking Academy
and start configuring before you spend a dollar on the exam.

What's Actually Tested on CAS-005

NERDEXAM — Sun, 05 Jul 2026 14:01:09 +0000

What the CompTIA SecurityX (CAS-005) Exam Actually Tests

The CAS-005 is CompTIA's advanced-level security certification, replacing CAS-004 and rebranded under the SecurityX name. It targets practitioners with at least ten years of IT experience, including five or more in hands-on security roles. This is not a memorization exam. It tests your ability to analyze scenarios, synthesize competing priorities, and make defensible security decisions in complex enterprise environments.

If you are preparing, start by reviewing the CAS-005 study guide to map your existing knowledge against the domains before you commit to a study schedule.

The four domain areas below represent the actual content the exam covers. Each section describes what skills are tested, what conceptual depth is expected, and where candidates typically struggle.

Governance, Risk, and Compliance

This domain is broader than it sounds. CAS-005 does not test whether you can define risk terminology. It tests whether you can apply risk frameworks to real enterprise scenarios and make trade-off decisions under constraints.

What is actually tested:

Selecting and integrating risk frameworks (NIST RMF, ISO 27001, COBIT) in context. You need to know not just what each framework contains but when to use one over another, and how to reconcile conflicting requirements when an organization spans multiple regulatory jurisdictions.
Third-party and supply chain risk. This includes vendor risk assessment, contractual controls, and evaluating the security posture of partners who have access to your environment or data. Expect scenario-based questions where a supplier introduces risk and you have to determine the appropriate control or response.
Compliance mapping across overlapping frameworks. Many organizations must satisfy PCI-DSS, HIPAA, SOC 2, and state-level privacy laws simultaneously. The exam tests your ability to identify gaps, avoid duplicating controls, and prioritize remediation based on risk exposure.
Policy development and enforcement mechanisms. You will be expected to understand how policies cascade from governance documents into technical controls, and how to evaluate whether a policy is enforceable or merely aspirational.
Risk appetite and risk tolerance. These are not interchangeable terms on this exam. Expect questions that require you to distinguish between the two and justify a security investment or exception decision based on organizational risk appetite.

Where candidates struggle:

Most test-takers underestimate this domain because they treat it as soft knowledge. The harder questions here involve multi-part scenarios where legal, operational, and security requirements are in tension. You must be able to articulate why one control satisfies a compliance requirement better than another in a specific context, not just generically.

Security Architecture

This is one of the highest-weighted domains on CAS-005 and the area where the exam demands the most systems-level thinking. Architecture questions require you to design, evaluate, and improve security controls across complex, heterogeneous environments.

What is actually tested:

Zero Trust architecture principles. This goes well beyond the buzzword. You are expected to understand identity-centric access, micro-segmentation, continuous verification, and how to transition a legacy perimeter-based network toward a Zero Trust model without breaking operations.
Cloud and hybrid environment design. Questions cover multi-cloud security architecture, workload isolation, cloud-native controls versus third-party solutions, and shared responsibility boundaries. You need to understand how security architecture decisions differ between IaaS, PaaS, and SaaS deployments.
Secure network design. This includes defense-in-depth segmentation, secure remote access architectures (ZTNA versus traditional VPN), and how to architect networks that support both operational technology (OT) and information technology (IT) environments.
Cryptographic architecture. Expect questions on key management at scale, public key infrastructure design, certificate lifecycle management, and the architectural implications of algorithm deprecation (including post-quantum considerations).
Resilience and redundancy. Architecture is not just about preventing attacks. The exam tests your understanding of high availability design, failover strategies, backup architecture, and disaster recovery planning from a security perspective.

Where candidates struggle:

Candidates with strong hands-on backgrounds sometimes answer these questions too tactically. When the exam asks what architecture best supports a given requirement, it is looking for design rationale, not a list of specific tools. Practice thinking in terms of trust boundaries, data flows, and control placement.

The CAS-005 practice questions on NerdExam include scenario-based architecture items that help you develop this kind of structured reasoning.

Security Engineering

Security engineering tests your ability to implement and evaluate technical security controls. The difference from architecture is the level of specificity - engineering questions get into the mechanics of how controls work, not just where they fit in a design.

What is actually tested:

Identity and access management implementation. This includes federated identity, SAML, OAuth, OIDC, privileged access management (PAM), and how to evaluate IAM implementations for weaknesses. You need to understand not just how these protocols work but what attack vectors they introduce when misconfigured.
Endpoint and application hardening. Secure baseline configurations, application control, firmware security, and OS-level hardening are all in scope. The exam often presents a scenario where a system is partially hardened and asks you to identify the remaining gaps.
Vulnerability management at scale. This covers the full cycle from discovery to remediation prioritization. Expect questions on CVSS scoring interpretation, exploitability context, compensating controls, and how to communicate risk from vulnerability findings to non-technical stakeholders.
Security automation and orchestration. SOAR platforms, scripting for security tasks, and integrating disparate security tools into a cohesive workflow are tested. You do not need to write production code, but you do need to understand how automation changes detection and response timelines.
Secure development and DevSecOps. The exam covers how to integrate security into CI/CD pipelines, including static analysis, software composition analysis, container security, and secrets management in development workflows.

Where candidates struggle:

Engineering questions reward depth. Candidates who know a topic at a conceptual level often lose points here because they cannot distinguish between two technically valid answers that are appropriate in different contexts. Precision matters.

Security Operations

This domain tests your ability to respond to threats, investigate incidents, and operate security programs in a sustained way. It is not just about incident response process - it emphasizes analytical judgment and operational decision-making.

What is actually tested:

Threat intelligence integration. Consuming, evaluating, and acting on threat intelligence is a core skill. This includes understanding threat actor taxonomy, campaign attribution, indicator management, and how to operationalize intelligence in detection and hunting workflows.
Incident response and forensics. Expect scenarios that test your ability to prioritize containment versus evidence preservation, scope an incident from initial indicators, and determine appropriate escalation paths. Digital forensics questions cover memory acquisition, log analysis, and chain of custody.
Detection engineering. Writing and tuning detection logic, reducing false positives, and aligning detections to frameworks like MITRE ATT&CK are all tested. The exam expects you to evaluate detection coverage, not just describe how SIEM tools work.
Threat hunting. You will be expected to describe a hypothesis-driven hunting approach, identify data sources required for specific hunts, and evaluate the results of a hunt against a known threat model.
Monitoring and logging architecture. Centralized logging, log retention requirements, and the trade-offs between log fidelity and storage cost are fair game. Expect questions where you must select the most relevant data sources for a given investigation.

Where candidates struggle:

Operations candidates who are strong practitioners sometimes rely on experience rather than framework knowledge. This exam rewards candidates who can articulate their operational decisions in structured terms. If you know what you would do in an incident but cannot explain why it aligns with a specific phase of the NIST incident response lifecycle or a comparable framework, you will leave points on the table.

How to Use This Structure in Your Prep

The four domains are not equal in weight, and your study plan should reflect that. Start with your weakest area based on an honest self-assessment, then use structured practice to identify specific gaps rather than broad topic review.

The CAS-005 exam catalog page has the current domain weightings and exam logistics you need before you register.

Focus especially on scenario-based practice. The CAS-005 uses performance-based and scenario-anchored questions heavily. Drilling isolated facts will not prepare you for questions that require you to synthesize information across multiple domains and justify a course of action. Practice making decisions, not just recalling definitions.

Microsoft Azure DevOps Engineer (AZ-400): What's Actually Tested

NERDEXAM — Fri, 03 Jul 2026 14:01:51 +0000

The Microsoft AZ-400 is the exam that earns you the Azure DevOps Engineer
Expert certification. It runs 100 minutes, costs $165, has roughly 40 to
60 questions, and requires 700 out of 1000 to pass. One critical detail
before you register: passing AZ-400 alone does not award the Expert cert.
You must also hold either AZ-104 (Azure Administrator Associate) or AZ-204
(Azure Developer Associate). If you do not have one of those already, earn
it first. The exam questions assume you are already comfortable operating
Azure at associate level. Most candidates with that foundation need 8 to
12 weeks of focused study to pass.

The 90-second answer

Take AZ-400 if you are already an AZ-104 or AZ-204 holder and you
work in, or want to move into, a DevOps or platform engineering role on
Azure. The exam is heavy on Azure Pipelines and GitHub Actions, Git
strategy, Infrastructure as Code, and pipeline security. It validates
exactly the skills those job postings ask for, and it is the only
Microsoft cert that explicitly owns the DevOps Engineer Expert title.

Skip AZ-400 if you do not yet have AZ-104 or AZ-204. Go earn one of
those first because you need it anyway. If you are new to Azure entirely,
start with AZ-900 then work toward AZ-104 or AZ-204 before touching this
exam. If your DevOps focus is on AWS, the AWS DevOps Engineer Professional
(DOP-C02) is the better match for your stack.

What does the AZ-400 actually test?

AZ-400 covers five domains. The build-and-release-pipeline domain is
enormous and dominates the exam. Everything else is real but secondary
to pipeline fluency.

Domain	Weight	What it covers
Design and implement processes and communications	10 to 15%	Agile and DevOps practices, work traceability, metrics and dashboards, notifications, Azure Boards and GitHub integration with Teams
Design and implement a source control strategy	15 to 20%	Git branching models, repository structure, monorepos, Git LFS, pull-request workflows, code review policies
Design and implement build and release pipelines	40 to 45%	Azure Pipelines and GitHub Actions, YAML pipelines, self-hosted and Microsoft-hosted agents, deployment patterns (blue/green, canary, rings), ARM/Bicep/Terraform IaC, Azure Artifacts package management, secrets and quality gates
Develop a security and compliance plan	10 to 15%	Securing pipelines and secrets via Key Vault, dependency and code scanning, GitHub Advanced Security, least-privilege service connections
Implement an instrumentation strategy	5 to 10%	Application Insights and Azure Monitor telemetry, log queries and alerts, feedback loops, site reliability practices

The pipeline domain is nearly half the exam on its own. If you are not
comfortable writing YAML pipelines from scratch, fixing broken stage
dependencies, and wiring in Key Vault secret references, that gap will
show on exam day. The exam tests pipeline mechanics at a real depth, not
just conceptual awareness.

Case-study sections appear in many AZ-400 sittings. Once you submit answers
inside a case-study and move on, Microsoft does not let you return to those
questions. Read each case-study scenario carefully before answering anything
in it.

The branching strategy questions go deeper than most candidates expect.
You should understand trunk-based development, Gitflow, GitHub Flow, and
the tradeoffs for large teams and release-train models. Monorepo design
and Git LFS also show up, especially in the source control domain.

How hard is the AZ-400?

AZ-400 is a difficulty 4 out of 5. It is an expert-level cert by design,
and Microsoft positions it above all Associate certs. The breadth is the
main challenge: you need real fluency across culture and process, source
control, CI/CD pipelines, infrastructure as code, pipeline security, and
monitoring, all within one exam. Community surveys suggest first-time pass
rates for candidates who studied 8 or more weeks sit somewhere in the 55%
to 70% range, though Microsoft does not publish official figures.

The hard parts are specific:

YAML pipeline syntax at depth. Multi-stage pipelines with environments, approvals, variable groups, and Key Vault linkage are common question territory. You cannot bluff YAML mechanics with conceptual understanding.
Infrastructure as Code scope. ARM, Bicep, and Terraform all appear. You do not need to be an expert in all three, but you need to recognize correct syntax and understand the deployment model for each.
Case-study no-return rule. Once you advance past a case-study section you cannot go back, so misreading the scenario burns points you cannot recover.
The security domain is narrower than a dedicated security cert but tricky. Questions on GitHub Advanced Security features, service connection permissions, and Key Vault secret scoping are easy to confuse if you lack hands-on time with them.

The most common failure pattern is candidates who know Azure Pipelines from
using it but have never written a YAML pipeline from a blank file, managed
a variable group with Key Vault linkage, or configured an environment with
approval gates. Knowing how a CI/CD tool works at a user level is not the
same as knowing how to design and secure one. Build that gap in your study
plan before you book the exam.

How long should you study for AZ-400?

Microsoft recommends having the AZ-104 or AZ-204 associate cert plus
practical experience with Azure DevOps and GitHub before sitting this exam.
That is the right baseline. For actual study time from that starting point:

With daily hands-on Azure Pipelines and GitHub Actions work: 6 to 8 weeks at 8 to 10 hours per week
With AZ-104 or AZ-204 but limited pipeline experience: 10 to 12 weeks at 8 to 12 hours per week
With an associate cert and some pipeline exposure but not deep YAML experience: 12 weeks, weighted toward the pipeline domain in weeks 4 through 9
Switching from AWS DevOps or another cloud's CI/CD tooling: 8 to 10 weeks, mostly to learn Azure-specific pipeline mechanics and IaC tooling

The single biggest study mistake is treating this as a read-heavy cert.
Azure Pipelines and GitHub Actions reward hands-on reps. Create a free
Azure DevOps organization, build multi-stage YAML pipelines, deploy to
environments with approval gates, link a variable group to Key Vault, and
run a Bicep or Terraform deployment from a pipeline stage. These tasks take
an hour each to set up, and they make the exam questions feel concrete
rather than abstract.

A realistic week-by-week pace for a 10-week plan looks like:

Week 1: DevOps culture, Agile practices, Azure Boards and GitHub integration, work traceability and metrics
Week 2: Git fundamentals review, branching strategies (trunk-based, Gitflow, GitHub Flow), pull-request policies, code review configuration
Week 3: Monorepo design, Git LFS, repository scaling approaches
Week 4: Azure Pipelines foundations, classic vs YAML, agents, triggers
Week 5: Multi-stage YAML pipelines, environments, approvals, gates
Week 6: GitHub Actions, reusable workflows, secrets, runner types, comparison with Azure Pipelines
Week 7: IaC with ARM, Bicep, and Terraform; pipeline-driven deployments; deployment patterns (blue/green, canary, rings)
Week 8: Azure Artifacts, package management, upstream sources, feed permissions; quality gates and test result integration
Week 9: Pipeline security, Key Vault integration, service connections, GitHub Advanced Security, dependency scanning
Week 10: Application Insights, Azure Monitor, log alerts, feedback loops; full timed practice exams and case-study drills

Most failures trace to weeks 4 through 7. If your YAML pipeline skills are
weak, double the time there and cut from the monitoring week, which is the
lightest domain on the exam.

What does the AZ-400 cost?

The exam itself is $165 USD plus any applicable local taxes. Total cost
depends on how you study:

Component	Range	Notes
Exam fee	$165	One attempt. Retake requires a 24-hour wait after a fail.
Microsoft Learn	$0	The official AZ-400 learning path is free and covers all five domains
Study course	$0 to $50	Many instructors publish AZ-400 courses on Udemy at $12 to $15 on sale
Practice questions	$0 to $40	NerdExam has 619 AZ-400 questions if you want a structured practice option
Azure DevOps org	$0	Free Azure DevOps organization with Basic plan for labs; Azure free tier for resource deployments
Total realistic spend	$165 to $250	Cheapest viable path: $165 (exam only, using free Microsoft Learn content and free Azure DevOps)

Microsoft certification prices vary by country. The $165 figure is the US
price; check the Microsoft Learn certification page for your region before
registering. Microsoft occasionally offers exam vouchers through partners,
learning challenges, and Microsoft events such as Ignite and Build, so
watch for promotions before paying full price.

One cost that is easy to forget: the annual renewal. Unlike CompTIA or
Cisco certifications with multi-year cycles, Microsoft role-based
certifications expire after one year. Renewal is free and unproctored via
a short online assessment on Microsoft Learn, available within 6 months of
your cert expiry date. Set a calendar reminder. A lapsed cert means the
Expert badge disappears from your transcript until you renew it.

What salary can you expect after passing?

AZ-400 is an expert-level cert, and the associated roles sit at mid to
senior levels. 2026 US salary estimates from job boards show:

DevOps Engineer with AZ-400: $115,000 to $155,000
Azure DevOps / Release Engineer with AZ-400: $110,000 to $150,000
Senior DevOps or Platform Engineer: $145,000 to $185,000
Cloud Engineer with DevOps focus: $120,000 to $160,000

The cert is a hiring signal for roles that already pay well. It will not
turn a junior engineer into a senior one overnight, but it removes you from
the automatic screen-out pile for mid-level DevOps roles, and it gives you
a credible answer when a hiring manager asks how you know Azure pipelines.
The salary impact is clearest when the cert is combined with two or more
years of hands-on Azure DevOps or GitHub Actions work. On a resume with
real project experience behind it, AZ-400 is a genuine differentiator for
Azure-heavy employers.

What study resources actually work?

The candidates who pass on the first attempt tend to use a similar stack:

Microsoft Learn AZ-400 learning path for breadth. It is official, free, and maps to every exam domain. Treat it as your outline, not your only resource. The hands-on exercises in the labs are more valuable than the reading.
A personal Azure DevOps organization, used daily. Free to create. Build pipelines that fail, fix them, add environments and approvals, link Key Vault. Passive reading about YAML pipelines does not prepare you for writing one under exam conditions.
GitHub Actions practice. Create a free GitHub repository and replicate your Azure Pipelines workflows as Actions. The comparison between the two tools is a recurring exam theme, and hands-on experience with both makes those questions easy.
An IaC lab. Deploy a simple Azure resource via Bicep and via Terraform from a pipeline stage each. You do not need to be an IaC expert; you need to know how pipelines consume templates and what the deployment flow looks like for each.
At least 400 to 600 practice questions before exam day, including questions on pipeline security and case-study formats.
Two full timed practice exams in the final two weeks. If you are below 75% on the second one, postpone the real exam and spend the extra time in the pipeline domain.

Skip any site that claims to sell "real exam questions." Beyond the ethical
issue, those dumps train you to recognize memorized answers, not to reason
through a scenario you have never seen, which is exactly what AZ-400's
case-study and design questions require.

For the practice question portion, NerdExam has 619 enriched AZ-400
questions with full explanations. Start practicing AZ-400 questions
to see the question style and the reasoning the exam expects, particularly
for pipeline design and IaC scenarios where the right answer hinges on a
detail you can only internalize from doing the work.

Who should NOT take AZ-400?

The cert is wrong for these candidates:

You are	Take instead
No Azure associate cert yet	AZ-104 or AZ-204 first (you need one to earn the Expert cert anyway)
Brand new to Azure entirely	AZ-900 then AZ-104 or AZ-204 before AZ-400
AWS-focused DevOps engineer	AWS DevOps Engineer Professional (DOP-C02)
Only want CI/CD basics, no cert needed	Skip and learn Azure Pipelines or GitHub Actions directly on the job
Targeting Azure architecture, not DevOps	AZ-305 (Azure Solutions Architect Expert) is the better path

The prerequisite structure matters here more than on most exams. If you sit
AZ-400 without an associate cert and somehow pass, you still do not earn
the Expert certification. The badge requires both. That makes attempting
AZ-400 without AZ-104 or AZ-204 a pure waste of a $165 exam fee. Get the
associate cert first. It also ensures your Azure fundamentals are solid
enough that the exam questions on resource configuration and access control
do not slow you down.

What's next after AZ-400?

AZ-400 is already an expert-level cert, so there is no natural "next rung"
on the same ladder. The paths from here depend on where you want to grow:

Architecture track: AZ-305 (Azure Solutions Architect Expert) pairs naturally with a DevOps background. The overlap in IaC, networking, and security design is real, and many senior platform engineers hold both.
Security specialization: the Microsoft Cybersecurity Architect (SC-100) or the AZ-500 (Azure Security Engineer Associate) if you want to deepen the pipeline security and identity work from AZ-400 into a dedicated security credential.
Lateral depth: AI-900 or AI-102 if your team is adding AI workloads to the pipelines you already own. Not a deep technical extension, but useful for teams building ML deployment pipelines.
Renewal, annually. Set the reminder now. Microsoft role-based certs expire after one year. The renewal assessment is free and unproctored on Microsoft Learn, but you have to do it. A lapsed Expert cert is surprisingly common and looks careless to hiring managers who check transcript dates.

The most direct value from AZ-400 comes from the 12 to 24 months after
passing, when you are operating Azure DevOps environments at scale and the
cert maps directly to what you do every day. The Expert badge earns its
keep when a job posting lists it as preferred and you can click through on
your Microsoft Learn transcript to prove it.

Ready to start? Browse AZ-400 practice questions on NerdExam
or jump straight into the
free per-question explanations.
If you want the official exam outline before you plan your study path, the
Microsoft AZ-400 certification page
has the current skills-measured document and a link to register.

Microsoft Azure Fundamentals (AZ-900): What's Actually Tested

NERDEXAM — Wed, 01 Jul 2026 14:02:23 +0000

Microsoft Azure Fundamentals (AZ-900) is the on-ramp to every other Azure
certification and the credential most often listed as "nice to have" in
cloud-adjacent job postings. The exam is $99, runs 45 minutes, has roughly
40 to 60 questions, and requires 700 out of 1000 to pass. Most candidates
need 2 to 4 weeks of light study. The questions test whether you can
describe Azure concepts, not configure them, which makes AZ-900 the
easiest real certification in the Microsoft catalog. If you work in IT in
any capacity, you can pass this with a couple of weekends of focused
reading.

The 90-second answer

Take AZ-900 if you're new to cloud, you're about to start an Azure
role, or you need a recognizable credential to put on a resume while you
study for something harder. It's also the right pick if your employer is
moving to Azure and you want shared vocabulary with the people who run it.
At $99 and a 45-minute sitting, the cost-to-credibility ratio is excellent.

Skip AZ-900 if you already have hands-on Azure experience and you're
aiming for an admin or engineering role. In that case go straight to
AZ-104 (Azure Administrator). AZ-900 is a knowledge check, not a skills
check, so experienced practitioners often find it too shallow to bother
with on its own.

What does the AZ-900 actually test?

AZ-900 tests three domains. Microsoft refreshed the objectives on
January 14, 2026, but only with minor wording changes. The weights below
are the current published ranges. Every question maps to one of these.

Domain	Weight	What it covers
Describe cloud concepts	25-30%	Cloud computing, shared responsibility model, public/private/hybrid, IaaS/PaaS/SaaS, consumption-based pricing, serverless
Describe Azure architecture and services	35-40%	Regions, availability zones, resource groups, subscriptions, management groups, VMs, networking, storage, Entra ID, RBAC, Zero Trust
Describe Azure management and governance	30-35%	Cost management, tags, Azure Policy, resource locks, Azure portal, Cloud Shell, Azure Monitor, Advisor, Service Health

Notice the word "describe" in every domain title. That's deliberate. You
are never asked to build a virtual network or write a policy. You're asked
which service solves a stated problem, what the shared responsibility
model means, or why you'd use a resource lock. It is recognition and
recall, not configuration.

The architecture and services domain is the largest at 35 to 40%, so
that's where your study time should concentrate. Most people lose points
there by confusing similar services: Entra ID versus Entra Domain
Services, availability zones versus region pairs, or which storage
redundancy option survives a regional outage.

How hard is the AZ-900?

AZ-900 is a difficulty 1 out of 5. It is the gentlest paid certification
Microsoft offers. There is no scenario you have to architect, no command
syntax to memorize, and no time pressure worth worrying about: 45 minutes
for 40 to 60 questions is comfortable.

The exam is genuinely fair, but a few things still trip people up:

Marketing-sounding answer choices that all "sound right" until you know the exact service definitions
Microsoft renaming things (Azure Active Directory became Microsoft Entra ID, and older study material still uses the old name)
Drag-and-drop and "select all that apply" questions where you need the complete set, not just one correct item
Governance terms that blur together (Azure Policy, resource locks, management groups, and tags all sound like cost or compliance tools)

People who fail AZ-900 almost always studied from outdated free dumps with
wrong service names, or they skipped the management and governance domain
because it sounded boring. That domain is 30 to 35% of the exam. You
cannot afford to skip a third of the test.

How long should you study for AZ-900?

Microsoft positions AZ-900 as having no prerequisites and no required
experience. The study time depends entirely on your starting point:

Working in IT already (any stack): 1 to 2 weeks at 5 to 6 hours per week
New to cloud but technically literate: 3 to 4 weeks at 5 to 6 hours per week
Complete beginner, non-technical background: 4 to 6 weeks at 4 to 5 hours per week
Already using Azure at work: a few days of review to map your hands-on knowledge to the exam's vocabulary

The most efficient path is Microsoft's own free Learn modules, because the
exam questions are written from the same source material. Create a free
Azure account and click through the portal while you read. Seeing a
resource group, a storage account, and the pricing calculator in the
actual portal makes the abstract terms stick far faster than video
courses do.

A realistic week-by-week pace for a 3-week study plan looks like:

Week 1: Cloud concepts (IaaS/PaaS/SaaS, public/private/hybrid, shared responsibility, consumption pricing, serverless)
Week 2: Azure architecture (regions, availability zones, resource groups, subscriptions, VMs, virtual networks, storage tiers and redundancy, Entra ID and RBAC)
Week 3: Management and governance (cost management, tags, Azure Policy, resource locks, the portal, Cloud Shell, Azure Monitor and Advisor), plus practice questions and the free Microsoft practice assessment

Take the official free practice assessment on Microsoft Learn at least
once before exam day. If you score above 80% on it cold, you're ready.

What does the AZ-900 cost?

The exam itself is $99 USD plus any local taxes. Total cost stays low
because the best resources are free:

Component	Range	Notes
Exam fee	$99	One attempt. Retake is another $99 if you fail.
Microsoft Learn modules	$0	Official free training, same source as the exam
Practice questions	$0 to $30	NerdExam has 332 AZ-900 questions if you want a free option
Azure free account	$0	Free tier plus $200 credit for the first 30 days
Official practice assessment	$0	Free on Microsoft Learn, mirrors the real exam style
Total realistic spend	$99 to $130	Cheapest viable path: $99 (exam only)

Microsoft regularly runs free AZ-900 voucher campaigns tied to Virtual
Training Days. If you attend one of those free online events, you often
receive a 100% exam voucher afterward, which drops your total cost to
zero. Check the Microsoft Events page before you pay full price.

What salary can you expect?

AZ-900 is a foundational cert, so be honest about what it does. It rarely
lands a job on its own, but it signals cloud literacy and is a real
resume line for career changers. US salary data for 2026 shows a wide
range that reflects how varied the roles are:

Entry-level cloud-adjacent roles with AZ-900: $65,000 to $90,000
Average across all "Azure Fundamentals" titled roles: $110,000 to $120,000 (skewed by experienced people who happen to hold it)
Typical bump from adding AZ-900 to an existing IT salary: $5,000 to $8,000
With AZ-900 plus AZ-104 and real Azure work: $120,000 to $140,000

The honest read: AZ-900 by itself is worth a few thousand dollars and a
foot in the door, not a six-figure jump. The real money comes from the
role-based certs it leads to (AZ-104, AZ-204, AZ-305) paired with
hands-on experience. Treat AZ-900 as the cheapest way to prove you're
serious about cloud, then keep going.

What study resources actually work?

The candidates who pass on the first attempt keep it simple:

Microsoft Learn AZ-900 learning path (free). It's the primary source the exam is written from. Do not skip the management and governance modules.
A free Azure account so you can click through the portal, the pricing calculator, and a sample resource group while you read
The official Microsoft practice assessment (free), taken at least twice in your final week
John Savill's AZ-900 study cram on YouTube (free), a single recorded session that condenses the whole syllabus for review
At least 200 practice questions to confirm you recognize service names and definitions under exam phrasing

Be careful with free "dump" sites. Many use outdated service names
(Azure Active Directory instead of Microsoft Entra ID) and have wrong
answers that teach you the test incorrectly. Stick to current sources.

For the practice question portion, NerdExam has 332 enriched AZ-900
questions with full explanations. Start practicing AZ-900 questions
to see the exact "describe the service" phrasing before exam day. The free
explanations walk through why each distractor is wrong, which is the
fastest way to stop confusing similar Azure services.

Who should NOT take AZ-900?

The cert is the wrong move for these candidates:

You are	Take instead
An experienced Azure admin	AZ-104 (Azure Administrator Associate)
A developer building on Azure	AZ-204 (Azure Developer Associate)
Targeting a solutions architect role	AZ-305, after AZ-104
A data or AI professional	DP-900 or AI-900 (the matching fundamentals tracks)
Working primarily in AWS or GCP	AWS Cloud Practitioner (CLF-C02) or Google Cloud Digital Leader. Match the cert to your stack.

The only real mistake with AZ-900 is over-investing in it. It's a
two-to-four-week credential, not a multi-month project. If you find
yourself studying it for two months, you're either using bad materials or
you should have started on a role-based cert.

What's next after AZ-900?

AZ-900 is a launching pad, and three paths open up depending on your role:

Administrator track: AZ-104 (Azure Administrator Associate). The most common next step and the one most job postings actually require. Expect a real jump in difficulty: AZ-104 is hands-on and config-heavy.
Developer track: AZ-204 (Azure Developer Associate), for engineers who build and deploy applications on Azure.
Other fundamentals: DP-900 (Data), AI-900 (AI), or SC-900 (Security). These are sibling exams at the same easy level, and stacking two or three fundamentals signals broad cloud literacy cheaply.

Most people move from AZ-900 to AZ-104 within 3 to 6 months. Use that
window to get real hands-on time in the Azure portal, because every cert
above the fundamentals level assumes you've actually built things, not
just read about them.

Ready to start? Practice with real AZ-900 questions on NerdExam
or jump straight into the free per-question explanations.
The official Microsoft study guide is also worth a read first:
see the AZ-900 skills measured here.

What's Actually Tested on AZ-305

NERDEXAM — Wed, 17 Jun 2026 14:02:02 +0000

What Is on the AZ-305 Exam, and How Should You Prepare?

The AZ-305 Designing Microsoft Azure Infrastructure Solutions exam is not a knowledge quiz. It is a scenario-based assessment that asks you to make architectural decisions under constraint - balancing cost, security, performance, and operational maturity across four core domains. Candidates who pass are not just familiar with Azure services; they can reason through trade-offs and justify a design choice against competing options. If you want to calibrate where your gaps actually are before diving into study, practice with free AZ-305 questions on NerdExam and see how you perform against real scenario formats.

The exam targets architects and senior engineers who are expected to translate business requirements into technical designs. The four domains - design infrastructure solutions, design identity, governance, and monitoring solutions, design data storage solutions, and design business continuity solutions - map directly to the decisions a cloud architect makes every day. Here is what each domain tests, and more importantly, how you need to think to answer correctly.

Domain 1: Design Infrastructure Solutions

This domain covers compute, networking, and migration architecture. The core skill is not knowing which Azure services exist - it is knowing when to use one over another, and why.

The decision framework: Every infrastructure question puts a constraint in front of you: lift-and-shift urgency, a specific SLA requirement, a team with no containerization experience, a workload with unpredictable traffic spikes. Your job is to match those constraints to the right architecture tier.

Consider the compute layer. Azure has at minimum four distinct ways to run application code - Virtual Machines, Azure Kubernetes Service, App Service, and Azure Container Apps - and the exam tests your ability to distinguish them by fit, not by definition. The question is never "what is AKS?" The question is "given a team that already manages Helm charts and needs node-level GPU access, which compute option is correct?" That is a different cognitive task.

Worked example: A company needs to migrate a monolithic .NET application with stateful Windows services and a dependency on a third-party COM component. The team wants minimal rearchitecting and a six-week timeline. The answer is Azure Virtual Machines, probably with Azure Migrate to lift the existing workload. App Service would require rearchitecting the COM dependency. AKS would require containerization. The constraint - COM dependency and zero rearchitect budget - makes VM the defensible choice even if containers are the cleaner long-term path.

Networking architecture within this domain is equally scenario-heavy. Hub-and-spoke topology, Azure Virtual WAN, peering versus VPN Gateway, private endpoints versus service endpoints - these all appear in scenarios that require you to reason about traffic flow, latency, and cost at scale, not just recite definitions.

Domain 2: Design Identity, Governance, and Monitoring Solutions

This domain is where many candidates underestimate the complexity. It tests three distinct skill sets that share a single domain bucket: identity and access design, policy and governance architecture, and observability strategy.

The decision framework for identity: Microsoft Entra ID scenarios require you to understand federation, B2B versus B2C, Conditional Access, and Privileged Identity Management at an architectural level. The key discriminator is usually trust boundary - where does the identity originate, and how much control does your tenant have over it?

For governance, the exam consistently tests management group hierarchy design and Azure Policy versus RBAC as enforcement mechanisms. The distinction matters: RBAC controls what a principal can do with a resource after it exists; Azure Policy controls what resources can exist in the first place. An exam scenario that says "the company needs to ensure no storage accounts are created without private endpoints" is testing Policy, not RBAC.

Worked example: A financial services company with three subsidiaries needs each subsidiary to manage its own resources while a central security team enforces encryption-at-rest and approved regions. The correct architecture uses a management group hierarchy with the company root at the top, one management group per subsidiary below it, and policy assignments at the root level for compliance requirements. Subscription-level RBAC then grants each subsidiary team Contributor rights within their own subscriptions. RBAC alone cannot prevent a subsidiary from creating non-compliant resources; only Policy at a parent scope achieves that.

For monitoring, the exam tests the integration between Azure Monitor, Log Analytics workspaces, Diagnostic Settings, and Microsoft Defender for Cloud. The architectural question is typically about workspace design - centralized versus distributed - and the trade-offs between cost (ingestion, egress) and operational simplicity.

Domain 3: Design Data Storage Solutions

This domain covers relational databases, NoSQL, object storage, caching, and data integration. The surface area is large, but the exam focuses tightly on selection criteria and architecture patterns rather than service internals.

The decision framework: Every data storage question has at least one constraint that rules out most options. Query pattern, consistency requirement, data volume, geographic distribution, and team SQL familiarity are the most common discriminators. Learn these as filters, not as a memorization list.

Azure SQL Database, Azure SQL Managed Instance, and SQL Server on VMs form a spectrum. SQL Database is PaaS with the highest abstraction and lowest operational overhead. Managed Instance adds near-full SQL Server compatibility, including SQL Agent, linked servers, and cross-database queries. SQL on VMs is for scenarios where OS-level access, specific SQL Server versions, or third-party integrations require control that PaaS tiers cannot provide.

Worked example: A legacy application uses SQL Server's cross-database queries and SQL Agent jobs extensively. The team wants to reduce patching overhead and move to Azure. Azure SQL Database does not support cross-database queries or SQL Agent. SQL on VMs removes the patching benefit. Azure SQL Managed Instance supports both features and provides managed patching. This is exactly the Managed Instance design sweet spot the exam targets repeatedly.

For NoSQL storage, Cosmos DB questions test partition key selection strategy - the architectural decision with the largest downstream consequence in Cosmos designs. An exam scenario will describe an access pattern and ask you to identify the correct partition key; the right answer minimizes cross-partition queries for the hot path. The AZ-305 study guide on NerdExam covers data storage decision trees in depth and is worth working through alongside official Microsoft documentation.

Domain 4: Design Business Continuity Solutions

This domain is deceptively specific. It does not test general availability concepts - it tests Azure's concrete mechanisms for backup, disaster recovery, and high availability, and when to use which one.

The decision framework: Every business continuity question begins with two numbers: the Recovery Time Objective (RTO) and the Recovery Point Objective (RPO). RTO is how long you can be down; RPO is how much data you can afford to lose. These two constraints drive the entire architecture. A workload with a 4-hour RTO and 1-hour RPO has completely different design requirements than one with a 15-minute RTO and near-zero RPO.

Azure Site Recovery, Azure Backup, geo-redundant storage with failover, and Always On availability groups for SQL are the primary mechanisms. The exam tests your ability to match RTO/RPO requirements to the right mechanism and configuration - not just to name the service, but to defend why it fits while the alternatives do not.

Worked example: A company runs a Tier-1 ERP application on SQL Server in Azure VMs. The business requires a 30-minute RTO and a 5-minute RPO after a regional failure. Azure Backup alone cannot meet either target - restore times for VMs typically exceed 30 minutes, and backup frequency cannot achieve a 5-minute RPO. The correct design uses Azure Site Recovery for VM replication (enabling near-zero RPO and sub-30-minute failover) combined with SQL Always On availability groups with a replica in the secondary region for the database layer specifically. Azure Backup remains appropriate for long-term retention, but it is not the DR mechanism here.

Availability Zones versus regional redundancy is another recurring decision in this domain. Availability Zones protect against datacenter-level failure within a region; they do not protect against regional outages. Exam scenarios that describe a legal requirement to maintain data within a single geography while surviving a datacenter fire are testing Availability Zone design, not geo-redundancy.

Pulling It Together

The AZ-305 rewards architects who think in constraints rather than catalogs. Memorizing Azure services is insufficient - the exam presents realistic scenarios where three different services could all technically work, and your job is to identify which one fits the specific combination of requirements in front of you.

Practical preparation involves working through scenario-based questions that reflect actual exam depth. The full AZ-305 exam catalog on NerdExam gives you a structured view of coverage alongside practice resources aligned to each domain. Study the decision frameworks above, practice applying them under timed conditions, and pay particular attention to scenarios where two options seem equally valid - those are the questions where understanding the trade-offs separates passing candidates from repeaters.

AWS Certified Developer Associate (DVA-C02): What's Actually Tested

NERDEXAM — Mon, 15 Jun 2026 14:02:31 +0000

The AWS Certified Developer Associate (DVA-C02) is the certification for
developers who build and deploy applications on AWS. The exam is $150, runs
130 minutes, has 65 questions, and requires 720 out of 1000 to pass. Most
candidates need 8 to 10 weeks of focused study on top of real development
experience. The questions are almost entirely scenario-based. You are not
reciting API names. You are picking the right Lambda concurrency model, the
right DynamoDB partition key design, or the right CodeDeploy deployment
strategy for a given situation. If you have spent a year writing code that
runs on AWS, you can pass without a course. If you have not, budget the full
10 weeks and build real serverless applications.

The 90-second answer

Take DVA-C02 if you write code for a living and your work runs on AWS.
It is the credential that proves you can build with Lambda, DynamoDB, API
Gateway, SQS, and the AWS SDK, not just click through the console. Hiring
managers at companies running serverless workloads specifically screen for
this cert, and it pairs well with SAA-C03 if you already have that one.

Skip DVA-C02 if you have never deployed a function to Lambda or read
from DynamoDB in production code. Start with AWS Cloud Practitioner
(CLF-C02) to build vocabulary, or work through SAA-C03 first if you want
the architecture angle before the coding angle. Going into DVA-C02 without
hands-on developer experience usually means a failed first attempt and
another $150.

What does the DVA-C02 actually test?

DVA-C02 tests four domains. The weights below are from the official AWS
exam guide and have been stable since the exam launched in 2023. Every
question maps to one of them.

Domain	Weight	What it covers
Development with AWS Services	32%	Lambda, containers, API Gateway, DynamoDB data modeling, SQS, SNS, EventBridge, Step Functions, SDK and CLI usage
Security	26%	IAM roles and policies, Cognito user pools and identity pools, KMS encryption, Secrets Manager, SSM Parameter Store, secure API access patterns
Deployment	24%	CI/CD with CodePipeline, CodeBuild, and CodeDeploy; SAM and CloudFormation; Elastic Beanstalk; canary, blue/green, and rolling deployment strategies
Troubleshooting and Optimization	18%	CloudWatch logs and metrics, X-Ray tracing, caching strategies, Lambda cold start optimization, cost and performance tuning

The exam rewards developers who have actually shipped code to AWS. A typical
question describes a scenario ("a Lambda function is hitting concurrency
limits during peak traffic, and the team needs to handle the overflow without
dropping events") and asks which combination of services and settings to
apply. You are choosing the solution that fits the stated constraints, not
the most sophisticated one.

If you have heard "DVA-C02 is all about knowing when NOT to use a service,"
that captures it well. Questions routinely give you four architectures that
all technically work and ask which one is cheapest, most scalable, or
easiest to maintain for a development team.

How hard is the DVA-C02?

DVA-C02 is a difficulty 3 out of 5. About the same difficulty as SAA-C03,
but the focus shifts from designing infrastructure to writing and deploying
application code. It is harder than AWS Cloud Practitioner (CLF-C02) and
much easier than AWS DevOps Engineer Professional (DOP-C02). Community
surveys suggest first-time pass rates are in the 65% to 75% range for
candidates who studied at least 6 weeks and had real development experience.

The hard parts are specific:

DynamoDB data modeling: partition keys, sort keys, GSIs, LSIs, and access patterns come up constantly, and wrong design decisions at the data layer break everything else
Lambda execution model: cold starts, concurrency limits (reserved vs. provisioned), event source mappings, and retry behavior are tested deeply
Security at the code level: knowing the difference between an IAM role attached to a Lambda, a Cognito identity pool, and a resource-based policy matters, and the exam distinguishes them carefully
"Pick TWO" multi-select questions where partial credit does not exist
Time pressure: 65 questions in 130 minutes is exactly 2 minutes per question, with no buffer for review

The most common failure pattern looks like this: candidate takes a video
course, never deploys a real serverless application, walks into the exam,
hits a DynamoDB access-pattern question at question 20, spends 5 minutes
second-guessing, and then rushes the CI/CD section. Final score: 690.
Build real applications in week 2, not week 9. Deploy a Lambda behind an
API Gateway with a DynamoDB table before you have finished your first week
of study.

How long should you study for DVA-C02?

AWS recommends at least 1 year of hands-on development experience with AWS
services and proficiency in at least one high-level language (Python, Java,
JavaScript, etc.) plus the AWS SDK and CLI. That baseline is baked into the
question difficulty. For actual study time on top of that experience:

With 1+ year AWS developer experience: 4 to 6 weeks at 8 to 10 hours per week
With 6 to 12 months AWS experience: 8 to 10 weeks at 8 to 10 hours per week
No AWS experience: 14 to 16 weeks, and you should take CLF-C02 or SAA-C03 first anyway
Coming from SAA-C03: 4 to 6 weeks; you already know the service landscape, now learn the SDK and coding patterns deeply

The biggest waste of study time is reading documentation without writing
code. Build at least three real projects in your AWS account: a Lambda
function triggered by SQS with a dead-letter queue for failures; an API
Gateway endpoint backed by Lambda with Cognito authorizer protecting it;
and a SAM template that deploys all of the above via CodePipeline. That
hands-on work is what makes the scenario questions click. Reading about
Lambda cold starts is forgettable. Debugging one in a real function is not.

A realistic week-by-week pace for an 8-week study plan looks like:

Week 1: IAM deeply (roles, policies, trust relationships), Lambda fundamentals, function execution model
Week 2: API Gateway (REST and HTTP APIs), Lambda integrations, Cognito user pools and identity pools
Week 3: DynamoDB data modeling (partition keys, GSIs, query vs. scan, DAX caching)
Week 4: SQS, SNS, EventBridge, Step Functions (event-driven patterns)
Week 5: CodePipeline, CodeBuild, CodeDeploy, Elastic Beanstalk (CI/CD and deployment strategies)
Week 6: CloudFormation and SAM, ECS and Fargate basics, S3 events and presigned URLs
Week 7: CloudWatch, X-Ray, KMS, Secrets Manager, SSM Parameter Store, security and observability
Week 8: Practice exams, weak-area cleanup, exam-day pacing drills

Most failures happen because candidates treat this like SAA-C03 and focus
on architecture breadth. DVA-C02 goes narrow and deep on the developer
services. Lambda, DynamoDB, and the CI/CD pipeline together cover well over
half the exam.

What does the DVA-C02 cost?

The exam itself is $150 USD plus any local taxes. Beyond that, real total
cost depends on your study path:

Component	Range	Notes
Exam fee	$150	One attempt. Retake is another $150 if you fail.
Study course	$0 to $150	Stephane Maarek's DVA-C02 course on Udemy at ~$15 during sales
Practice questions	$0 to $50	NerdExam has 803 DVA-C02 questions if you want a free option
AWS lab costs	$20 to $60	Free tier covers most Lambda and DynamoDB usage; watch your API Gateway call counts
Books or whitepapers	$0	AWS Well-Architected Framework and Serverless Application Lens are free
Total realistic spend	$150 to $400	Cheapest viable path: $150 (exam only)

AWS offers a 50% retake voucher if you fail your first attempt, but only if
you book the retake within 14 days. AWS also drops 50% vouchers for
completing Skill Builder learning plans, so check your Skill Builder account
before you pay full price.

What salary can you expect after passing?

DVA-C02 sits in the developer tier, which commands a solid premium over
generalist development roles. Developers who can demonstrate AWS-specific
skills in Lambda, DynamoDB, and CI/CD pipelines routinely close the gap
with their infrastructure-focused peers. 2026 salary estimates from US job
boards show:

Cloud developer or software engineer (cloud): $110,000 to $150,000
Back-end developer with AWS skills: $100,000 to $140,000
DevOps-leaning developer roles: $120,000 to $160,000
With 3+ years and SAA-C03 plus DVA-C02: $160,000 and up at companies running serverless-first workloads

The cert alone does not deliver those numbers. It signals to hiring managers
that you know how to use AWS as a developer, not just as a console user. The
salary lift is most visible at companies running heavily on Lambda and
managed services, where DVA-C02 skills are directly billable.

A practical note on negotiation: if you pass DVA-C02 while currently
employed, bring it up before your next performance cycle, not after. The
cert validates a skill set your employer is already benefiting from. Internal
moves with a fresh DVA-C02 alongside real AWS production work historically
clear 8 to 15% base bumps. External moves with DVA-C02 plus 1 to 2 years of
serverless development experience routinely clear 20 to 30%.

What study resources actually work?

The candidates who pass on the first attempt use a consistent stack:

One video course for breadth. Stephane Maarek's "Ultimate AWS Certified Developer Associate" on Udemy is the community favorite at around $15 on sale. It covers the SDK patterns and DynamoDB modeling in more depth than most alternatives.
The AWS Serverless Application Model (SAM) documentation (free). Read the full developer guide and deploy a real SAM application. SAM questions appear on every sitting.
A free AWS account for hands-on labs (set a $10 billing alert immediately; Lambda and DynamoDB free tiers are generous but API Gateway and X-Ray add up quickly in lab scenarios)
At least 500 practice questions before exam day to build pacing and expose weak areas in DynamoDB and deployment strategies
Two full-length timed practice exams in the final week. Take them on a Saturday morning, treat them like the real exam, score honestly. If you are below 75% on the second one, postpone the real exam.

Skip the brain-dump sites. AWS refreshes DVA-C02 questions regularly, and
the scenario-based format means memorized answers fail in practice anyway.
Reddit's r/AWSCertifications has the most current crowd-sourced advice on
which resources are working this quarter.

For the practice question portion, NerdExam has 803 enriched DVA-C02
questions with full explanations. Start practicing DVA-C02 questions
to see the question style before you commit to a study plan. The free
explanations show you the reasoning pattern the exam expects, especially for
DynamoDB access patterns and Lambda concurrency, which are harder to absorb
from videos than from working through the questions.

Who should NOT take DVA-C02?

The cert is wrong for these candidates:

You are	Take instead
New to cloud entirely	AWS Cloud Practitioner (CLF-C02) first
Focused on cloud architecture and design, not coding	AWS Solutions Architect Associate (SAA-C03)
An infrastructure or ops engineer, not a developer	AWS SysOps Administrator (SOA-C02)
A non-developer who wants a cloud credential	SAA-C03 or CLF-C02 - DVA-C02 assumes you write application code
Already holding SAA-C03 and targeting a senior architecture role	Solutions Architect Professional (SAP-C02) is the higher-leverage move

The path matters more than the individual cert. DVA-C02 is excellent when
your daily work involves writing and deploying application code on AWS. It
is a poor use of 8 weeks if your role lives in Terraform and CloudFormation
templates and you rarely touch the SDK. Hiring managers do not penalize
architects for skipping DVA-C02; they penalize developers who cannot explain
why their Lambda function is timing out.

What's next after DVA-C02?

Once DVA-C02 is in hand, three paths open up depending on where you want
to go:

DevOps and operations track: AWS DevOps Engineer Professional (DOP-C02) is the natural step up. It builds directly on DVA-C02's CI/CD and deployment knowledge and adds infrastructure automation, monitoring at scale, and incident response. Most developers do this 12 to 18 months after DVA-C02.
Architecture breadth track: Add SAA-C03 if you do not already have it, or SOA-C02 for the operations angle. Holding DVA-C02 plus SAA-C03 covers both the build and design sides and makes you competitive for senior cloud engineer roles.
Specialty track: AWS Certified Security (SCS-C02) pairs exceptionally well with DVA-C02. The security domain is 26% of DVA-C02, and SCS-C02 deepens that into a standalone credential for developers working in regulated industries.

Most people take 12 to 24 months between DVA-C02 and their next cert. Use
that time to ship real Lambda and serverless production work. The cert pays
off when hiring managers see it alongside actual shipped applications, not
when it is the only AWS line on your resume.

Ready to start? Practice with real DVA-C02 questions on NerdExam
or jump straight into the free per-question explanations.
The official AWS exam guide is also worth reading first:
AWS Certified Developer Associate exam page.