DEV Community: NERDEXAM

Cisco 350-401 ENCOR (CCNP Enterprise Core): What's Actually Tested

NERDEXAM — Thu, 09 Jul 2026 14:02:24 +0000

The Cisco 350-401 ENCOR (Implementing and Operating Cisco Enterprise Network
Core Technologies) is the core exam for CCNP Enterprise and doubles as the
written qualifying exam for CCIE Enterprise Infrastructure and CCIE Enterprise
Wireless. The exam costs $400, runs 120 minutes, has 90 to 110 questions, and
requires a score of around 825 out of 1000 to pass. Cisco does not publish an
official cut score, but that figure reflects consistent community consensus.
Most experienced engineers need 10 to 14 weeks of focused study. The question
mix is heavily scenario-based multiple choice and drag-and-drop, with far fewer
hands-on simulations than CCNA. If you hold a CCNA and have worked in
enterprise networks, this is the next logical credential. If you are brand new
to Cisco gear, start with CCNA first.

The 90-second answer

Take 350-401 ENCOR if you are an experienced network engineer who wants
to advance from CCNA to CCNP, or if your role already involves enterprise
routing, switching, wireless, SD-WAN, or SD-Access. ENCOR is also the
required qualifier if you are eventually targeting a CCIE lab. The credential
is widely recognized by enterprise employers and represents a real knowledge
step up from associate-level certs.

Skip 350-401 ENCOR if you have not yet passed CCNA 200-301 or built
genuine hands-on networking experience. There are no formal prerequisites,
but Cisco recommends three to five years of enterprise networking experience,
and that recommendation reflects the actual question difficulty. Going in
underprepared costs $400 for the first attempt and $400 again for the
retake, with a five-day wait between attempts.

What does the 350-401 actually test?

ENCOR covers six domains. The current blueprint is version 1.1. Every
question maps to one of these.

Domain	Weight	What it covers
Architecture	15%	Enterprise network design, high availability, wireless deployment models, Cisco SD-WAN and SD-Access fabric design
Virtualization	10%	Device virtualization (VMs, containers), data path virtualization (VRF, GRE, IPsec), network virtualization (LISP, VXLAN)
Infrastructure	30%	Layer 2 (VLANs, trunking, EtherChannel, STP), Layer 3 (OSPF, EIGRP, BGP), wireless (AP modes, WLC, roaming), IP services (NTP, NAT, DHCP, IP SLA, QoS)
Network Assurance	10%	SNMP, syslog, NetFlow/Flexible NetFlow, SPAN/RSPAN, IP SLA, Cisco DNA Center assurance, debugs and show commands
Security	20%	Device access control (AAA, TACACS+, RADIUS), CoPP, ACLs, port security, 802.1X, MACsec, wireless security
Automation	15%	Python basics, JSON, REST APIs, data models and YANG, EEM, Cisco DNA Center APIs, config management (Ansible, Puppet, Chef), SDN concepts

Infrastructure carries the highest weight at 30%, so routing protocol depth
matters more here than on any other Cisco exam below the CCIE. You need to
understand OSPF neighbor adjacencies, BGP path selection, EIGRP metric
calculation, and STP root bridge election, not just recognize the terms.

The Architecture and Automation domains together are 30% of the exam and they
reward candidates who have worked with modern enterprise designs. SD-WAN and
SD-Access questions describe a fabric or a deployment scenario and ask you to
identify the correct component, design decision, or troubleshooting step.
These are not conceptual-only questions. You need to know how SD-WAN control
plane, data plane, and management plane separate, and where Cisco DNA Center
fits in SD-Access fabric design.

The Security domain at 20% is broader than most candidates expect. AAA using
TACACS+ versus RADIUS is a common topic, as is CoPP (Control Plane Policing),
which protects the router control plane itself. 802.1X and MACsec appear in
scenario questions that mix wireless and wired access.

Automation at 15% is not optional studying. Community feedback from recent
exam sittings consistently flags Python, REST APIs, and YANG data models as
live on exam day. You do not need to write production Python, but you do need
to read a short script and understand what it does, parse a JSON payload, and
describe how a RESTCONF or NETCONF call is structured.

How hard is the 350-401?

ENCOR is a difficulty 4 out of 5. Clearly harder than CCNA 200-301, which is
a 3.5, and significantly broader in scope. Cisco does not publish a pass rate,
but community surveys suggest first-time pass rates are lower than CCNA,
largely because the breadth and depth of six domains is genuinely demanding
even for working engineers.

The hard parts are specific:

The Infrastructure domain alone is 30% of the exam and it expects depth on three routing protocols plus wireless and QoS, not just awareness of them
SD-WAN and SD-Access are tested at a design and troubleshooting level that many engineers have not encountered in day-to-day operations, especially those in shops that have not deployed Viptela or Catalyst Center
Automation questions require you to read and reason about code, JSON, and API calls even if you are not primarily a programmer
No back button. Cisco exams lock each question on submission, so a scenario you get stuck on burns time you cannot recover
At 90 to 110 questions in 120 minutes, you average just over one minute per question. Scenario-based items that require you to work through a multi-step design problem will consume two to three minutes each if you are not prepared

The most common failure pattern is candidates who know routing and switching
well but underestimate the Architecture and Automation domains. Solid OSPF
and BGP knowledge is necessary but not sufficient. Someone who scored well
on CCNA by memorizing show commands and protocol theory will struggle with
ENCOR's SD-WAN design and Python-parsing questions.

How long should you study for 350-401?

Cisco recommends three to five years of enterprise networking experience before
sitting the exam. That is not a suggestion to ignore. For actual study time:

With 3+ years enterprise networking and CCNP-level exposure at work: 8 to 10 weeks at 10 to 15 hours per week
With CCNA and 1 to 3 years networking experience: 12 to 14 weeks at 10 to 15 hours per week
With CCNA and less than one year of hands-on work: 16 to 20 weeks, and seriously consider accumulating more lab and production experience before booking
Coming from a different vendor or role type (Juniper, cloud, security): 12 to 16 weeks to ramp on Cisco-specific implementations of shared concepts

A realistic week-by-week pace for a 12-week plan looks like:

Week 1: Enterprise architecture fundamentals, high availability designs, SD-WAN overview (Architecture domain foundation)
Week 2: SD-Access fabric design, overlay and underlay, Catalyst Center role
Week 3: Virtualization - VRF, GRE, IPsec, LISP, VXLAN concepts and use cases
Week 4: Layer 2 deep dive - VLANs, trunking, EtherChannel, STP variants
Week 5: OSPF areas, LSA types, neighbor adjacency troubleshooting
Week 6: EIGRP metrics and tuning, BGP path selection, route redistribution
Week 7: Wireless - AP modes, WLC architecture, roaming, wireless security
Week 8: IP services - QoS, NTP, NAT, DHCP, IP SLA
Week 9: Security - AAA, TACACS+ vs RADIUS, CoPP, 802.1X, MACsec, ACLs
Week 10: Network Assurance - SNMP, NetFlow, SPAN, DNA Center assurance, debug and show command strategy
Week 11: Automation - Python basics, JSON, REST APIs, YANG, DNA Center APIs, Ansible fundamentals, EEM
Week 12: Full timed practice exams, review weak domains, scenario drilling

The biggest waste of study time on ENCOR is focusing almost exclusively on
Infrastructure and ignoring Automation and Architecture. Many experienced
engineers come in strong on routing and switching, then get blindsided by
SD-WAN design questions and Python-parsing items that together account for
nearly a third of the exam.

What does the 350-401 cost?

The exam itself is $400 USD plus any local taxes. That is $100 more than CCNA,
and Cisco does not routinely issue discounted retake vouchers, so a failed
attempt means another $400 after the mandatory five-day wait.

Component	Range	Notes
Exam fee	$400	One attempt. Retake is another $400 with a 5-day wait after a fail.
Study course	$0 to $200	Nick Russo's free materials, Cisco's own dCloud labs, or a paid Udemy course at $15 to $30 on sale
Practice questions	$0 to $60	NerdExam has 1,356 ENCOR questions if you want a free option
Lab access	$0 to $200	Cisco dCloud is free; CML Personal or EVE-NG with IOS-XE images for deeper routing scenarios
Books	$0 to $80	Cisco Press ENCOR Official Cert Guide by Chapple and Lacoste is the standard reference
Total realistic spend	$400 to $700	Cheapest viable path: $400 (exam only, if you leverage free resources)

Given the $400 per-attempt cost, the "do not book until your practice scores
are consistently above 80%" rule matters more here than on almost any other
associate or professional cert. Cisco occasionally runs promotional pricing or
partner voucher bundles through the Cisco Learning Network Store, so check
before you buy.

What salary can you expect after passing?

CCNP-level credentials move you from entry-to-mid into mid-to-senior
compensation territory. ENCOR alone qualifies you for CCNP Enterprise once
you add a concentration exam, and that combination is a recognized signal
for senior-level roles. 2026 US estimates from job boards:

Network Engineer with CCNP Enterprise: $95,000 to $130,000
Senior Network Engineer or Network Architect with CCNP: $130,000 to $175,000
Network Operations lead or consultant with CCNP: $100,000 to $145,000

CCNP holders in enterprise networking consistently out-earn CCNA-only
candidates by a meaningful margin. The gap widens further once CCNP is
combined with three or more years of production enterprise experience. At the
CCIE level, which ENCOR partially qualifies you for, total compensation
packages regularly exceed $175,000 in major markets.

The cert itself is the signal that gets you past resume filters for senior
network engineer and architect roles. The real pay trajectory requires the
cert plus actual work delivering SD-WAN rollouts, BGP policy changes, or
wireless infrastructure at scale.

What study resources actually work?

The candidates who pass ENCOR on the first attempt tend to use a consistent
stack:

One structured course for breadth. Cisco Press's Official Cert Guide is the most thorough single resource; INE and CBT Nuggets both have video courses that are strong on the Infrastructure and Automation domains
A real lab, not just Packet Tracer. ENCOR covers IOS-XE behaviors, SD-WAN control plane, and YANG that Packet Tracer does not model well. Cisco dCloud is free and has pre-built ENCOR topology labs. CML (Cisco Modeling Labs) Personal is worth the cost if you plan to push toward CCIE
Dedicated automation practice. Do not just read about Python and REST APIs. Write a short Python script that calls a DNA Center sandbox API. Cisco DevNet has a free always-on DNA Center sandbox at developer.cisco.com. Parsing JSON by hand in a sandbox makes the automation questions concrete
At least 600 practice questions before exam day, weighted toward Infrastructure and Security, with scenario-based items so design and troubleshooting questions do not surprise you
Two full-length timed practice exams in the final two weeks. Treat them like the real thing. If you are scoring below 80%, postpone the real exam. At $400 an attempt, postponing is almost always the right financial decision

Avoid brain-dump sites. Cisco actively updates ENCOR question pools and brain
dumps go stale quickly. More importantly, ENCOR rewards the ability to reason
through a scenario, not recognize a memorized answer string. The Cisco
Learning Network forums and Reddit's r/ccnp have current, crowdsourced
guidance on which resources are working this quarter.

For practice questions, NerdExam has 1,356 enriched 350-401 ENCOR questions
with full explanations. Start with a free ENCOR practice question
to see the question style and reasoning depth before you commit to a study plan.
Working through explanations for Infrastructure and Automation items shows you
exactly how Cisco frames scenario logic, which is easier to absorb from worked
examples than from video summaries.

Who should NOT take 350-401?

The exam is wrong for these candidates:

You are	Take instead
Brand new to networking with no Cisco experience	CCNA 200-301 first to build the foundation
A pure cloud engineer who never configures Cisco gear	AWS, Azure, or GCP networking certifications
Security-focused and not doing network operations	CCNP Security (SCOR 350-701) or CompTIA Security+
Looking for vendor-neutral fundamentals validation	CompTIA Network+ is broader and cheaper
A network engineer who only needs CCNA-level validation	Stay at CCNA until you have the production experience ENCOR expects

The investment here is not just the $400 exam fee. It is 10 to 14 weeks of
serious study time. That time is well spent for a working network engineer
ready to move into senior roles. It is a poor investment for someone who
wants a cert badge without the underlying experience the badge implies to
hiring managers who actually verify it in interviews.

What's next after 350-401?

Passing ENCOR opens several paths:

Complete CCNP Enterprise: Add one concentration exam. The most common pick is 300-410 ENARSI (Advanced Routing and Services), which deepens OSPF, BGP, EIGRP, and VPN troubleshooting. Other concentration options include 300-415 ENSDWI (SD-WAN) and 300-435 ENAUTO (Automation), depending on where your career is pointing.
CCIE Enterprise lab path: ENCOR satisfies the written/qualifying requirement for both CCIE Enterprise Infrastructure and CCIE Enterprise Wireless. The lab exams are a separate and significantly harder undertaking, but ENCOR is the required gateway. Most engineers spend one to two years in production and focused lab work between passing ENCOR and attempting the CCIE lab.
SD-WAN or Automation specialization: 300-415 ENSDWI and 300-435 ENAUTO are both viable concentration choices if your shop is deep in Viptela SD-WAN or Catalyst Center automation. Either makes a strong resume signal in enterprise sales engineering and network architect roles.
DevNet Professional: If the Automation domain on ENCOR sparked genuine interest in network programmability, the Cisco DevNet Professional path (350-901 DEVCOR) builds directly on those skills.

Note that Cisco certifications expire after three years. ENCOR's three-year
clock starts on your pass date. You can renew by passing any 300-level or
higher Cisco exam, or by passing ENCOR again, or by completing continuing
education credits through the Cisco Learning Network.

Ready to start? Browse all 350-401 ENCOR practice questions on NerdExam
or jump straight into the free per-question explanations.
If you want to explore the official blueprint before you buy study materials,
the current exam topics are published on the
Cisco Learning Network.

Certified Ethical Hacker (CEH v13, 312-50): What's Actually Tested

NERDEXAM — Tue, 07 Jul 2026 14:04:04 +0000

The Certified Ethical Hacker (CEH v13, exam 312-50) is the single most
recognized name in offensive security certification. The exam voucher runs
about $1,199, the clock is 4 hours, and you face 125 multiple-choice
questions across 20 hacking domains. The passing threshold is not a fixed
number - EC-Council uses per-form cut scores that range from 60% to 85%
depending on how the question set is calibrated, often cited around 70%.
Version 13 layers generative AI throughout every module, so expect
questions on using AI to assist each phase of hacking and on securing AI
systems. Most candidates need 6 to 10 weeks of focused prep. If you are
already working in security operations or penetration testing, 4 to 6 weeks
is realistic. If you are coming from a general IT background, budget the
full 10 weeks and go domain by domain.

The 90-second answer

Take CEH v13 if you need the credential for a specific reason: DoD
8570/8140 compliance, a government or defense-contractor role that
explicitly lists it, or an employer whose HR checklist requires it. CEH is
the dominant name-recognition cert in offensive security, and its DoD
approval is the primary reason thousands of candidates pay $1,199 for an
exam that is otherwise considered broad and not deeply technical.

Skip CEH v13 if you want to prove hands-on hacking ability. CEH is
widely described as "a mile wide and an inch deep." It tests whether you
can recognize tools, phases, and terminology, not whether you can exploit a
live target. If your goal is to impress a hands-on hiring team, OSCP
carries far more weight. If budget is the constraint, CompTIA PenTest+
(PT0-003) covers similar ground for roughly a third of the price.

What does the CEH v13 actually test?

CEH v13 spans 20 hacking modules mapped to nine broad domain groups. The
blueprint weights below are approximate and established across recent
versions. Version 13's headline change is that generative AI appears across
all 20 modules - questions cover AI-assisted recon, malware that leverages
AI techniques, and defending AI infrastructure, so do not ignore those additions.

Domain	Approx. Weight	What it covers
Information Security and Ethical Hacking Overview	~6%	Hacking concepts, attack phases, the cyber kill chain, ethics, laws and standards
Reconnaissance Techniques	~21%	Footprinting, OSINT, scanning networks (Nmap), enumeration
System Hacking Phases and Attack Techniques	~17%	Vulnerability analysis, system hacking, privilege escalation, malware (trojans, viruses, worms, fileless)
Network and Perimeter Hacking	~14%	Sniffing, social engineering, denial of service, session hijacking, evading IDS/firewalls/honeypots
Web Application Hacking	~16%	Hacking web servers and web apps, SQL injection, OWASP-style flaws
Wireless Network Hacking	~6%	Wireless encryption, wireless attacks, and tools
Mobile, IoT, and OT Hacking	~8%	Mobile platform attacks, IoT and operational-technology threats
Cloud Computing	~6%	Cloud concepts, container and serverless security, cloud attack vectors
Cryptography	~6%	Ciphers, PKI, encryption tools, cryptanalysis attacks

Reconnaissance is the heaviest single area at roughly 21%, which reflects
how much of real-world offensive work starts with Nmap scans, OSINT
gathering, and enumeration before anything touches an exploit. Web
application hacking at ~16% is the second-heaviest block, and SQL injection
appears repeatedly across multiple question styles there.

The exam rewards breadth over depth. A typical question presents a scenario
and a list of tools, then asks which tool fits the described technique, or
which phase of hacking the described activity belongs to. You will see
Nmap, Metasploit, Wireshark, John the Ripper, Aircrack-ng, SQLmap, and
several dozen other tools referenced by name. Knowing what each tool does
and which phase it maps to is more important than knowing how to run them
in a live shell.

How hard is the CEH v13?

CEH v13 is a difficulty 3 out of 5. It is broader than Security+, but the
questions are more recall-oriented than the deep analysis that OSCP or even
CASP+ requires. The "mile wide, inch deep" criticism is accurate and worth
taking seriously when you plan your prep strategy.

The genuinely hard parts are:

The sheer volume of tools, techniques, and acronyms across 20 domains. There are hundreds of named tools in the blueprint and you need to know roughly what each one does.
The AI additions in v13 are newer, so practice materials for those topics are thinner than for the core domains. Budget extra time for AI-assisted attack and defense content.
The variable cut score. You do not know whether you landed a 60%-cut or an 85%-cut form until you sit down. Scoring in the high 70s on practice exams is not a safe buffer.
The eligibility barrier before you even book the exam. You either complete official EC-Council training (which bundles the voucher and typically costs $2,000 or more) or you pay a $100 non-refundable application fee and document at least 2 years of information-security work experience. No shortcut around that gate.

The most common failure pattern is underestimating the tool and technique
volume. Candidates who consume a single video course and skip the tool
flashcard work tend to blank on the scenario questions that ask "which of
these tools performs passive fingerprinting" or "which malware type
self-replicates without user interaction." The breadth is the difficulty,
not the depth of any single topic.

How long should you study for CEH v13?

EC-Council recommends candidates have a background in information security
before attempting the exam. That recommendation is real - the domains
assume you already know networking basics and general security concepts.
For actual study time:

With 2+ years of security operations or pen testing experience: 4 to 6 weeks at 8 to 10 hours per week
With a general IT or networking background and Security+: 6 to 8 weeks at 8 to 12 hours per week
New to security but with solid IT fundamentals: 10 weeks, and consider CompTIA Security+ first to build the foundational vocabulary
Switching from a purely defensive (blue team) background: 6 to 8 weeks, focused on offensive phases, tools, and the attack-centric framing the exam uses

The biggest study mistake is drilling only the domains you already know.
Reconnaissance is ~21% of the exam and most security practitioners have
gaps in wireless (~6%), IoT/OT (~8%), or the specific cryptanalysis
vocabulary. Map your weak domains in week 1 and weight your time there.

A realistic week-by-week pace for an 8-week plan looks like:

Week 1: Hacking overview, attack phases, kill chain, laws and ethics; begin tool inventory flashcards
Week 2: Footprinting, OSINT tools, Nmap scanning, enumeration techniques
Week 3: Vulnerability analysis, system hacking phases, privilege escalation methods
Week 4: Malware types, sniffing, social engineering, DoS/DDoS, session hijacking
Week 5: IDS/firewall/honeypot evasion, web server and web app hacking, SQL injection, OWASP flaws
Week 6: Wireless attacks, mobile hacking, IoT and OT threats
Week 7: Cloud security, cryptography, and the AI-assisted techniques added in v13
Week 8: Full timed practice exams, tool and phase flashcard review, weak-domain sweep

Most shortfalls trace back to the tool-recognition questions in week 2 and
3 content. Reconnaissance and system hacking together account for nearly
40% of the exam. If your flashcards are not covering named tools per phase
by week 3, the timed practice exams in week 8 will feel thin.

What does the CEH v13 cost?

The exam voucher alone is about $1,199. That is one of the most expensive
single-exam vouchers in the certification market, and the total cost depends
heavily on which eligibility path you take.

Component	Range	Notes
Exam voucher (remote proctored)	~$1,199	One attempt via EC-Council's ECC Exam platform
Official EC-Council training	$2,000+	Bundles the voucher; required unless you apply via experience path
Experience-path application fee	$100 non-refundable	Requires 2+ years documented infosec experience; no training required
Study course (third-party)	$30 to $200	Matt Walker, Total Seminars, or Pluralsight if you go the experience path
Practice questions	$0 to $60	NerdExam has 627 CEH questions; official iLabs is a separate paid add-on
Total via official training path	$2,000 to $3,000+	Voucher typically bundled but training cost dominates
Total via experience path	$1,300 to $1,600	$100 app fee + $1,199 voucher + third-party study materials

The price is the most common reason candidates hesitate. CompTIA PenTest+
(PT0-003) covers much of the same conceptual ground for roughly $404. The
reason CEH stays popular despite the cost is its DoD 8570 approval and its
presence on HR job-requirement checklists for government and contractor
roles. For those specific roles, the premium is often unavoidable.

EC-Council also charges an annual ECE membership fee during the 3-year
cert validity period. Factor that in if you are calculating total cost of
ownership. Retake policy and fees vary; check the EC-Council site before
you book.

What salary can you expect after passing?

CEH is primarily a compliance and name-recognition cert, so the salary
ranges reflect the roles it unlocks rather than a direct premium for the
cert itself. 2026 US data from job boards shows:

SOC analyst or security analyst with CEH: $75,000 to $110,000
Vulnerability analyst or assessor with CEH: $90,000 to $125,000
Penetration tester with CEH: $95,000 to $140,000
Senior offensive security roles with CEH plus 5+ years: $130,000 to $170,000

A realistic note on what the cert does and does not do: CEH functions
largely as a hiring filter and a compliance checkbox, especially in
government and defense-contractor environments that require DoD 8570/8140
alignment. You will often see it listed as required for roles where the
actual work is more audit-style than active exploitation. For hands-on
penetration testing teams, OSCP carries significantly more weight with
technical hiring managers. CEH gets you past the HR screen; OSCP gets you
respect in the room. Many candidates hold both.

What study resources actually work?

The candidates who pass on the first attempt tend to use a consistent stack
built around breadth and tool recognition:

One structured course covering all 20 modules. Matt Walker's CEH study guides are the community standard for the experience-path self- study approach. Total Seminars and Pluralsight both offer solid video-based coverage.
A dedicated tool inventory. Build a flashcard deck mapping every named tool to its phase (recon, exploitation, post-exploitation, etc.) and its category (network scanner, password cracker, packet sniffer, wireless cracker, web app scanner). The exam uses tool names constantly.
Phase mapping practice. Know the five phases of hacking (recon, scanning, gaining access, maintaining access, covering tracks) and map every domain activity to one of those phases. Many questions are just "which phase does this describe."
At least 500 practice questions before exam day. Include questions that test tool recognition and attack/defense framing, not just definitions. Practice under time pressure: 125 questions in 4 hours is about 115 seconds per question, which is tighter than it sounds when long scenarios are involved.
Two full-length timed practice exams in the final two weeks. If your score is below the 75% mark on both, push the exam date and work the weak domains. The variable cut score means you want a real buffer.

Skip brain-dump sites. EC-Council actively pursues cert fraud, and more
practically, the questions on the actual exam are scenario-based in ways
that brain dumps do not prepare you for. You will recognize a question's
answer without understanding why, which leaves you flat when the scenario
twists slightly.

For the practice question portion, NerdExam has 627 enriched CEH 312-50
questions with full explanations. Start practicing CEH v13 questions
to see the tool-recognition and scenario framing before you commit to a
study plan. The explanations map answers back to the five hacking phases
and the relevant domain, which is exactly the mental model the exam tests.

Who should NOT take the CEH v13?

The cert is the wrong fit for several common candidate profiles:

You are	Take instead
On a budget and want hands-on proof of offensive skill	OSCP or CompTIA PenTest+ (PT0-003) at roughly one-third the cost
Brand new to security entirely	CompTIA Security+ first to build the foundational vocabulary
A blue-team defender who has no offensive requirement	CySA+ or GIAC GCIH, which are purpose-built for detection and response
A cloud security specialist	A cloud security cert (AWS Security Specialty, Google PCSE, or CCSP)
Someone who needs pen test credibility with technical teams	OSCP; CEH is a box-check, OSCP is a proof of work

The price-to-value calculation is honest: if you do not need CEH for a
specific role requirement or DoD compliance, you can cover the same
conceptual material for far less money and earn more hands-on credibility
with OSCP or PenTest+. CEH's value is real but narrow. It is the standard
HR filter for government and contractor offensive security roles, and that
is the use case it is optimized for.

What's next after CEH v13?

Once CEH is in hand, several paths branch depending on your goal:

Hands-on credibility track: CEH Practical (the lab-based companion exam) is the natural next step. Pass CEH Practical alongside CEH ANSI and you become a CEH Master, which signals hands-on ability that the multiple- choice exam alone cannot prove. After that, OSCP is the gold standard for offensive security credibility with technical teams.
Broader pen testing track: CompTIA PenTest+ (PT0-003) or GIAC GPEN if you want more structured coverage of the pen testing lifecycle beyond CEH's breadth-over-depth approach.
Defense and detection track: If you discover that your work is more detection and response than offensive, pivot to CompTIA CySA+ or GIAC GCIH. Many CEH holders end up in hybrid roles where both views matter.
Cloud offensive track: CCSP or AWS Security Specialty if your environment is heavily cloud-based and the Cloud Computing domain was the area where you felt most engaged.

Most people take 6 to 12 months between CEH and their next cert. Use that
window to put the domains into practice - run a home lab, work through a
CTF platform, or move into a role where you are doing actual vulnerability
assessments. CEH on a resume paired with real work experience is a strong
combination. CEH alone, without applied experience, gets you past the
filter but not much further.

Ready to start? Browse the full CEH 312-50 question bank on NerdExam
or jump straight into the free per-question explanations.
If you are still weighing whether CEH is the right cert for your situation,
the official EC-Council program page at
eccouncil.org/programs/certified-ethical-hacker-ceh
has the current eligibility requirements, approved training providers, and
the official blueprint mapped to each domain.

Cisco Certified Network Associate (CCNA 200-301): What's Actually Tested

NERDEXAM — Mon, 06 Jul 2026 14:01:52 +0000

The Cisco Certified Network Associate (CCNA 200-301) is the single most
recognized entry credential in networking. The exam is $300, runs 120
minutes, has roughly 100 questions, and requires about 825 out of 1000 to
pass. Most candidates need 10 to 16 weeks of focused study. The questions
mix multiple choice with drag-and-drop and live router/switch simulations,
so pure memorization does not cut it. If you already configure Cisco gear
at work, you can pass in a couple of months. If you are new to networking,
budget the full 16 weeks and spend real time in a lab.

The 90-second answer

Take CCNA 200-301 if you want a networking career and you are willing
to learn subnetting, routing, and switching by actually configuring
devices. It is the credential that gets your resume past the filter for
network technician, NOC, help desk, and junior network engineer roles. No
single cert is more widely requested in networking job postings.

Skip CCNA 200-301 if you have zero interest in command-line device
configuration or you are chasing cloud or security roles that do not touch
Cisco gear. If you only want to validate general IT fundamentals, CompTIA
Network+ is a gentler, vendor-neutral starting point. Going straight to
CCNA with no networking exposure usually ends in a failed first attempt
and another $300.

What does the CCNA 200-301 actually test?

CCNA 200-301 covers six domains. The blueprint has been stable since the
exam consolidated to a single test in 2020, with minor refreshes. Every
question maps to one of these.

Domain	Weight	What it covers
Network Fundamentals	20%	OSI/TCP-IP models, cabling, IPv4/IPv6 addressing, subnetting, switches vs routers
Network Access	20%	VLANs, trunking, EtherChannel, STP, wireless LAN concepts, WLC config
IP Connectivity	25%	Routing tables, static routing, OSPFv2, default gateways, FHRP basics
IP Services	10%	DHCP, DNS, NAT, NTP, SNMP, syslog, QoS concepts
Security Fundamentals	15%	Access control, port security, ACLs, VPN concepts, WPA, layer 2 threats
Automation and Programmability	10%	REST APIs, JSON, controller-based networking, Ansible/Puppet/Chef concepts, SDN

The exam rewards hands-on muscle memory. A simulation question may drop
you into a router CLI and ask you to configure OSPF or fix a VLAN trunk,
then grade your actual configuration. Subnetting shows up everywhere, and
you have to do it fast and in your head, because there is no calculator.

If you have heard "CCNA is the cert that finally makes subnetting click,"
that is because the exam forces it.

How hard is the CCNA 200-301?

CCNA 200-301 is a difficulty 3.5 out of 5. Harder than CompTIA Network+,
much easier than CCNP Enterprise (ENCOR 350-401). Cisco does not publish a
pass rate, but community surveys put first-time pass rates in the 60% to
70% range for people who studied at least 10 weeks and did real labs.

The hard parts are specific:

Subnetting under time pressure, including VLSM, with no calculator
Live simulation questions that grade your actual device configuration, not a multiple-choice guess
The breadth: six domains spanning switching, routing, services, security, and automation, so you cannot specialize your way through
No back button. Cisco exams do not let you flag and return to questions, so a simulation you get stuck on burns time you cannot recover

People who fail CCNA usually fail on pacing and subnetting speed, not on
concepts they never saw. The simulation questions early in the exam are
the classic trap.

The most common failure pattern looks like this: candidate watches an
entire video course, never racks up real CLI hours, walks in, hits an OSPF
simulation at question 12, spends 18 minutes on it, then rushes the rest
and runs out of time. Final result: fail. Build CLI fluency in week 4,
not week 12, and drill subnetting until you can do a /26 split in under 30
seconds.

How long should you study for CCNA 200-301?

Cisco lists no formal prerequisites, but recommends roughly one year of
networking experience. That assumption is baked into the question
difficulty. For actual study time:

With 1+ year hands-on networking experience: 8 to 10 weeks at 8 to 12 hours per week
With CompTIA Network+ or some IT background: 12 to 14 weeks at 8 to 12 hours per week
Brand new to networking: 16 to 20 weeks, and consider Network+ first to build vocabulary
Switching from another vendor (Juniper, Aruba): 8 to 10 weeks, mostly to learn Cisco IOS syntax and the CCNA blueprint's edges

The biggest waste of study time is watching videos without touching a CLI.
Build a lab. Cisco Packet Tracer is free and covers most of the blueprint;
GNS3 or EVE-NG with real IOS images go further. Configure VLANs and
trunks, stand up OSPF between three routers, break STP on purpose and fix
it. That hands-on work is what makes simulation questions painless.

A realistic week-by-week pace for a 12-week plan looks like:

Week 1: OSI/TCP-IP models, cabling, switch vs router basics
Week 2: IPv4 addressing and subnetting (start drilling now)
Week 3: VLSM, IPv6 addressing, subnetting speed drills
Week 4: Switch configuration, VLANs, access vs trunk ports
Week 5: Spanning Tree Protocol, EtherChannel, port security
Week 6: Static routing, routing tables, default gateways
Week 7: OSPFv2 single-area, neighbor adjacencies, troubleshooting
Week 8: Wireless LAN concepts, WLC configuration, AP modes
Week 9: IP services (DHCP, DNS, NAT, NTP, SNMP, syslog)
Week 10: Security (ACLs, VPN concepts, layer 2 threats, WPA)
Week 11: Automation and programmability (REST, JSON, SDN, Ansible)
Week 12: Full timed practice exams, simulation drills, subnetting speed

Most failures trace back to skipping the subnetting reps in weeks 2 and 3.
Subnetting touches Network Fundamentals, IP Connectivity, and IP Services,
which together are well over half the exam.

What does the CCNA 200-301 cost?

The exam itself is $300 USD plus any local taxes. Beyond that, total cost
depends on your study path:

Component	Range	Notes
Exam fee	$300	One attempt. Retake is another $300, with a 5-day wait after a fail.
Study course	$0 to $150	Jeremy's IT Lab (free on YouTube) or a paid Udemy course at ~$15 on sale
Practice questions	$0 to $60	NerdExam has 1794 CCNA questions if you want a free option
Lab software	$0	Cisco Packet Tracer is free; GNS3 and EVE-NG are free too
Books	$0 to $60	Wendell Odom's Official Cert Guide library is the standard reference
Total realistic spend	$300 to $500	Cheapest viable path: $300 (exam only)

Unlike some vendors, Cisco does not routinely hand out 50% retake
vouchers, so a failed attempt costs the full $300 again. That makes the
"do not book until your practice scores are solid" rule more important here
than on cheaper exams. Cisco does occasionally run promotional pricing or
voucher bundles through partners and the Cisco Learning Network Store, so
check before you buy.

What salary can you expect after passing?

CCNA is an entry-to-mid credential, so the salary range is wide and
depends heavily on the role and your experience. 2026 US data from job
boards shows:

Help desk or NOC technician with CCNA: $50,000 to $70,000
Network administrator with CCNA: $70,000 to $95,000
Network engineer with CCNA: $90,000 to $130,000
Senior network engineer with CCNA plus 3+ years: $120,000 to $150,000, often on the path to CCNP

The cert alone does not deliver the top numbers. CCNA opens the door; the
pay jumps come from production experience and, usually, a follow-on cert
like CCNP. Where you see CCNA pay $60K, the holder is early-career. Where
you see $130K, the holder has years of real network operations behind the
cert.

A practical note: CCNA is most valuable as a hiring filter. Many network
engineer and NOC postings list it as required or strongly preferred, which
means not having it quietly removes you from the pile before a human reads
your resume. The salary lift is real but indirect. It comes from getting
access to roles you could not apply for without it.

What study resources actually work?

The candidates who pass on the first attempt use a consistent stack:

One structured course for breadth. Jeremy's IT Lab on YouTube is the community favorite and completely free; Wendell Odom's Official Cert Guide pair is the gold-standard book set if you prefer reading
A lab, used daily. Cisco Packet Tracer (free) covers most of the blueprint. GNS3 or EVE-NG with real IOS images go deeper for OSPF and automation topics
A dedicated subnetting drill. subnettingpractice.com or a flashcard app, every day, until a /26 or /28 split is automatic
At least 500 practice questions before exam day, including simulation-style questions so the live labs do not surprise you
Two full-length timed practice exams in the final two weeks. Treat them like the real thing, no breaks, and score honestly. If you are below 80% on the second one, postpone the real exam

Skip the brain-dump sites that sell "real exam questions." They are
against Cisco policy, frequently wrong, and they teach you to recognize
answers instead of configure devices, which is exactly what the
simulations punish. Reddit's r/ccna has the most current crowd-sourced
advice on which resources are working this quarter.

For the practice question portion, NerdExam has 1794 enriched CCNA 200-301
questions with full explanations. Start practicing CCNA 200-301 questions
to see the question style before you commit to a study plan. The free
question explanations alone show you the reasoning the exam expects,
especially for subnetting and routing logic that is hard to absorb from
videos.

Who should NOT take CCNA 200-301?

The cert is wrong for these candidates:

You are	Take instead
Brand new to IT entirely	CompTIA Network+ (or A+) first to build fundamentals
Focused on cybersecurity, not networking	CompTIA Security+ or the Cisco CyberOps Associate path
A cloud engineer who never touches Cisco gear	AWS, Azure, or GCP networking certs
An experienced network engineer with CCNP-level skills	Skip CCNA, go straight to CCNP Enterprise (ENCOR 350-401)
Only validating general IT for a help desk role	CompTIA A+ plus Network+ is a cheaper, broader fit

The path matters more than the badge. CCNA is excellent when networking is
your career direction. It is a poor use of three months if your role lives
in the cloud console and never opens an IOS prompt. Hiring managers do not
penalize cloud or security candidates for lacking CCNA; they penalize
networking candidates who cannot subnet.

What's next after CCNA 200-301?

Once CCNA is in hand, a few paths open depending on where you want to go:

Enterprise track: CCNP Enterprise (ENCOR 350-401 plus a concentration exam). The natural follow-on for network engineers, and where the real salary jumps live. Most people do this 12 to 24 months after CCNA.
Security track: CCNP Security, or pivot toward Cisco CyberOps and CompTIA Security+ if you want to move into a SOC.
Automation track: Cisco DevNet Associate (200-901). Pairs well with CCNA as networking shifts toward automation and infrastructure-as-code.
Data center or service provider track: CCNP Data Center or CCNP Service Provider, if your employer runs that kind of environment.

Most people take 12 to 24 months between CCNA and CCNP. Use that window to
ship real network operations work. CCNA pays off when a hiring manager
sees it next to actual experience, not when it is the only line on your
resume. Note that Cisco certifications expire after three years, so plan to
recertify or move up to CCNP before then.

Ready to start? Practice with real CCNA 200-301 questions on NerdExam
or jump straight into the free per-question explanations.
If you are still building fundamentals first, download Cisco Packet Tracer
from the Cisco Networking Academy
and start configuring before you spend a dollar on the exam.

What's Actually Tested on CAS-005

NERDEXAM — Sun, 05 Jul 2026 14:01:09 +0000

What the CompTIA SecurityX (CAS-005) Exam Actually Tests

The CAS-005 is CompTIA's advanced-level security certification, replacing CAS-004 and rebranded under the SecurityX name. It targets practitioners with at least ten years of IT experience, including five or more in hands-on security roles. This is not a memorization exam. It tests your ability to analyze scenarios, synthesize competing priorities, and make defensible security decisions in complex enterprise environments.

If you are preparing, start by reviewing the CAS-005 study guide to map your existing knowledge against the domains before you commit to a study schedule.

The four domain areas below represent the actual content the exam covers. Each section describes what skills are tested, what conceptual depth is expected, and where candidates typically struggle.

Governance, Risk, and Compliance

This domain is broader than it sounds. CAS-005 does not test whether you can define risk terminology. It tests whether you can apply risk frameworks to real enterprise scenarios and make trade-off decisions under constraints.

What is actually tested:

Selecting and integrating risk frameworks (NIST RMF, ISO 27001, COBIT) in context. You need to know not just what each framework contains but when to use one over another, and how to reconcile conflicting requirements when an organization spans multiple regulatory jurisdictions.
Third-party and supply chain risk. This includes vendor risk assessment, contractual controls, and evaluating the security posture of partners who have access to your environment or data. Expect scenario-based questions where a supplier introduces risk and you have to determine the appropriate control or response.
Compliance mapping across overlapping frameworks. Many organizations must satisfy PCI-DSS, HIPAA, SOC 2, and state-level privacy laws simultaneously. The exam tests your ability to identify gaps, avoid duplicating controls, and prioritize remediation based on risk exposure.
Policy development and enforcement mechanisms. You will be expected to understand how policies cascade from governance documents into technical controls, and how to evaluate whether a policy is enforceable or merely aspirational.
Risk appetite and risk tolerance. These are not interchangeable terms on this exam. Expect questions that require you to distinguish between the two and justify a security investment or exception decision based on organizational risk appetite.

Where candidates struggle:

Most test-takers underestimate this domain because they treat it as soft knowledge. The harder questions here involve multi-part scenarios where legal, operational, and security requirements are in tension. You must be able to articulate why one control satisfies a compliance requirement better than another in a specific context, not just generically.

Security Architecture

This is one of the highest-weighted domains on CAS-005 and the area where the exam demands the most systems-level thinking. Architecture questions require you to design, evaluate, and improve security controls across complex, heterogeneous environments.

What is actually tested:

Zero Trust architecture principles. This goes well beyond the buzzword. You are expected to understand identity-centric access, micro-segmentation, continuous verification, and how to transition a legacy perimeter-based network toward a Zero Trust model without breaking operations.
Cloud and hybrid environment design. Questions cover multi-cloud security architecture, workload isolation, cloud-native controls versus third-party solutions, and shared responsibility boundaries. You need to understand how security architecture decisions differ between IaaS, PaaS, and SaaS deployments.
Secure network design. This includes defense-in-depth segmentation, secure remote access architectures (ZTNA versus traditional VPN), and how to architect networks that support both operational technology (OT) and information technology (IT) environments.
Cryptographic architecture. Expect questions on key management at scale, public key infrastructure design, certificate lifecycle management, and the architectural implications of algorithm deprecation (including post-quantum considerations).
Resilience and redundancy. Architecture is not just about preventing attacks. The exam tests your understanding of high availability design, failover strategies, backup architecture, and disaster recovery planning from a security perspective.

Where candidates struggle:

Candidates with strong hands-on backgrounds sometimes answer these questions too tactically. When the exam asks what architecture best supports a given requirement, it is looking for design rationale, not a list of specific tools. Practice thinking in terms of trust boundaries, data flows, and control placement.

The CAS-005 practice questions on NerdExam include scenario-based architecture items that help you develop this kind of structured reasoning.

Security Engineering

Security engineering tests your ability to implement and evaluate technical security controls. The difference from architecture is the level of specificity - engineering questions get into the mechanics of how controls work, not just where they fit in a design.

What is actually tested:

Identity and access management implementation. This includes federated identity, SAML, OAuth, OIDC, privileged access management (PAM), and how to evaluate IAM implementations for weaknesses. You need to understand not just how these protocols work but what attack vectors they introduce when misconfigured.
Endpoint and application hardening. Secure baseline configurations, application control, firmware security, and OS-level hardening are all in scope. The exam often presents a scenario where a system is partially hardened and asks you to identify the remaining gaps.
Vulnerability management at scale. This covers the full cycle from discovery to remediation prioritization. Expect questions on CVSS scoring interpretation, exploitability context, compensating controls, and how to communicate risk from vulnerability findings to non-technical stakeholders.
Security automation and orchestration. SOAR platforms, scripting for security tasks, and integrating disparate security tools into a cohesive workflow are tested. You do not need to write production code, but you do need to understand how automation changes detection and response timelines.
Secure development and DevSecOps. The exam covers how to integrate security into CI/CD pipelines, including static analysis, software composition analysis, container security, and secrets management in development workflows.

Where candidates struggle:

Engineering questions reward depth. Candidates who know a topic at a conceptual level often lose points here because they cannot distinguish between two technically valid answers that are appropriate in different contexts. Precision matters.

Security Operations

This domain tests your ability to respond to threats, investigate incidents, and operate security programs in a sustained way. It is not just about incident response process - it emphasizes analytical judgment and operational decision-making.

What is actually tested:

Threat intelligence integration. Consuming, evaluating, and acting on threat intelligence is a core skill. This includes understanding threat actor taxonomy, campaign attribution, indicator management, and how to operationalize intelligence in detection and hunting workflows.
Incident response and forensics. Expect scenarios that test your ability to prioritize containment versus evidence preservation, scope an incident from initial indicators, and determine appropriate escalation paths. Digital forensics questions cover memory acquisition, log analysis, and chain of custody.
Detection engineering. Writing and tuning detection logic, reducing false positives, and aligning detections to frameworks like MITRE ATT&CK are all tested. The exam expects you to evaluate detection coverage, not just describe how SIEM tools work.
Threat hunting. You will be expected to describe a hypothesis-driven hunting approach, identify data sources required for specific hunts, and evaluate the results of a hunt against a known threat model.
Monitoring and logging architecture. Centralized logging, log retention requirements, and the trade-offs between log fidelity and storage cost are fair game. Expect questions where you must select the most relevant data sources for a given investigation.

Where candidates struggle:

Operations candidates who are strong practitioners sometimes rely on experience rather than framework knowledge. This exam rewards candidates who can articulate their operational decisions in structured terms. If you know what you would do in an incident but cannot explain why it aligns with a specific phase of the NIST incident response lifecycle or a comparable framework, you will leave points on the table.

How to Use This Structure in Your Prep

The four domains are not equal in weight, and your study plan should reflect that. Start with your weakest area based on an honest self-assessment, then use structured practice to identify specific gaps rather than broad topic review.

The CAS-005 exam catalog page has the current domain weightings and exam logistics you need before you register.

Focus especially on scenario-based practice. The CAS-005 uses performance-based and scenario-anchored questions heavily. Drilling isolated facts will not prepare you for questions that require you to synthesize information across multiple domains and justify a course of action. Practice making decisions, not just recalling definitions.

Microsoft Azure DevOps Engineer (AZ-400): What's Actually Tested

NERDEXAM — Fri, 03 Jul 2026 14:01:51 +0000

The Microsoft AZ-400 is the exam that earns you the Azure DevOps Engineer
Expert certification. It runs 100 minutes, costs $165, has roughly 40 to
60 questions, and requires 700 out of 1000 to pass. One critical detail
before you register: passing AZ-400 alone does not award the Expert cert.
You must also hold either AZ-104 (Azure Administrator Associate) or AZ-204
(Azure Developer Associate). If you do not have one of those already, earn
it first. The exam questions assume you are already comfortable operating
Azure at associate level. Most candidates with that foundation need 8 to
12 weeks of focused study to pass.

The 90-second answer

Take AZ-400 if you are already an AZ-104 or AZ-204 holder and you
work in, or want to move into, a DevOps or platform engineering role on
Azure. The exam is heavy on Azure Pipelines and GitHub Actions, Git
strategy, Infrastructure as Code, and pipeline security. It validates
exactly the skills those job postings ask for, and it is the only
Microsoft cert that explicitly owns the DevOps Engineer Expert title.

Skip AZ-400 if you do not yet have AZ-104 or AZ-204. Go earn one of
those first because you need it anyway. If you are new to Azure entirely,
start with AZ-900 then work toward AZ-104 or AZ-204 before touching this
exam. If your DevOps focus is on AWS, the AWS DevOps Engineer Professional
(DOP-C02) is the better match for your stack.

What does the AZ-400 actually test?

AZ-400 covers five domains. The build-and-release-pipeline domain is
enormous and dominates the exam. Everything else is real but secondary
to pipeline fluency.

Domain	Weight	What it covers
Design and implement processes and communications	10 to 15%	Agile and DevOps practices, work traceability, metrics and dashboards, notifications, Azure Boards and GitHub integration with Teams
Design and implement a source control strategy	15 to 20%	Git branching models, repository structure, monorepos, Git LFS, pull-request workflows, code review policies
Design and implement build and release pipelines	40 to 45%	Azure Pipelines and GitHub Actions, YAML pipelines, self-hosted and Microsoft-hosted agents, deployment patterns (blue/green, canary, rings), ARM/Bicep/Terraform IaC, Azure Artifacts package management, secrets and quality gates
Develop a security and compliance plan	10 to 15%	Securing pipelines and secrets via Key Vault, dependency and code scanning, GitHub Advanced Security, least-privilege service connections
Implement an instrumentation strategy	5 to 10%	Application Insights and Azure Monitor telemetry, log queries and alerts, feedback loops, site reliability practices

The pipeline domain is nearly half the exam on its own. If you are not
comfortable writing YAML pipelines from scratch, fixing broken stage
dependencies, and wiring in Key Vault secret references, that gap will
show on exam day. The exam tests pipeline mechanics at a real depth, not
just conceptual awareness.

Case-study sections appear in many AZ-400 sittings. Once you submit answers
inside a case-study and move on, Microsoft does not let you return to those
questions. Read each case-study scenario carefully before answering anything
in it.

The branching strategy questions go deeper than most candidates expect.
You should understand trunk-based development, Gitflow, GitHub Flow, and
the tradeoffs for large teams and release-train models. Monorepo design
and Git LFS also show up, especially in the source control domain.

How hard is the AZ-400?

AZ-400 is a difficulty 4 out of 5. It is an expert-level cert by design,
and Microsoft positions it above all Associate certs. The breadth is the
main challenge: you need real fluency across culture and process, source
control, CI/CD pipelines, infrastructure as code, pipeline security, and
monitoring, all within one exam. Community surveys suggest first-time pass
rates for candidates who studied 8 or more weeks sit somewhere in the 55%
to 70% range, though Microsoft does not publish official figures.

The hard parts are specific:

YAML pipeline syntax at depth. Multi-stage pipelines with environments, approvals, variable groups, and Key Vault linkage are common question territory. You cannot bluff YAML mechanics with conceptual understanding.
Infrastructure as Code scope. ARM, Bicep, and Terraform all appear. You do not need to be an expert in all three, but you need to recognize correct syntax and understand the deployment model for each.
Case-study no-return rule. Once you advance past a case-study section you cannot go back, so misreading the scenario burns points you cannot recover.
The security domain is narrower than a dedicated security cert but tricky. Questions on GitHub Advanced Security features, service connection permissions, and Key Vault secret scoping are easy to confuse if you lack hands-on time with them.

The most common failure pattern is candidates who know Azure Pipelines from
using it but have never written a YAML pipeline from a blank file, managed
a variable group with Key Vault linkage, or configured an environment with
approval gates. Knowing how a CI/CD tool works at a user level is not the
same as knowing how to design and secure one. Build that gap in your study
plan before you book the exam.

How long should you study for AZ-400?

Microsoft recommends having the AZ-104 or AZ-204 associate cert plus
practical experience with Azure DevOps and GitHub before sitting this exam.
That is the right baseline. For actual study time from that starting point:

With daily hands-on Azure Pipelines and GitHub Actions work: 6 to 8 weeks at 8 to 10 hours per week
With AZ-104 or AZ-204 but limited pipeline experience: 10 to 12 weeks at 8 to 12 hours per week
With an associate cert and some pipeline exposure but not deep YAML experience: 12 weeks, weighted toward the pipeline domain in weeks 4 through 9
Switching from AWS DevOps or another cloud's CI/CD tooling: 8 to 10 weeks, mostly to learn Azure-specific pipeline mechanics and IaC tooling

The single biggest study mistake is treating this as a read-heavy cert.
Azure Pipelines and GitHub Actions reward hands-on reps. Create a free
Azure DevOps organization, build multi-stage YAML pipelines, deploy to
environments with approval gates, link a variable group to Key Vault, and
run a Bicep or Terraform deployment from a pipeline stage. These tasks take
an hour each to set up, and they make the exam questions feel concrete
rather than abstract.

A realistic week-by-week pace for a 10-week plan looks like:

Week 1: DevOps culture, Agile practices, Azure Boards and GitHub integration, work traceability and metrics
Week 2: Git fundamentals review, branching strategies (trunk-based, Gitflow, GitHub Flow), pull-request policies, code review configuration
Week 3: Monorepo design, Git LFS, repository scaling approaches
Week 4: Azure Pipelines foundations, classic vs YAML, agents, triggers
Week 5: Multi-stage YAML pipelines, environments, approvals, gates
Week 6: GitHub Actions, reusable workflows, secrets, runner types, comparison with Azure Pipelines
Week 7: IaC with ARM, Bicep, and Terraform; pipeline-driven deployments; deployment patterns (blue/green, canary, rings)
Week 8: Azure Artifacts, package management, upstream sources, feed permissions; quality gates and test result integration
Week 9: Pipeline security, Key Vault integration, service connections, GitHub Advanced Security, dependency scanning
Week 10: Application Insights, Azure Monitor, log alerts, feedback loops; full timed practice exams and case-study drills

Most failures trace to weeks 4 through 7. If your YAML pipeline skills are
weak, double the time there and cut from the monitoring week, which is the
lightest domain on the exam.

What does the AZ-400 cost?

The exam itself is $165 USD plus any applicable local taxes. Total cost
depends on how you study:

Component	Range	Notes
Exam fee	$165	One attempt. Retake requires a 24-hour wait after a fail.
Microsoft Learn	$0	The official AZ-400 learning path is free and covers all five domains
Study course	$0 to $50	Many instructors publish AZ-400 courses on Udemy at $12 to $15 on sale
Practice questions	$0 to $40	NerdExam has 619 AZ-400 questions if you want a structured practice option
Azure DevOps org	$0	Free Azure DevOps organization with Basic plan for labs; Azure free tier for resource deployments
Total realistic spend	$165 to $250	Cheapest viable path: $165 (exam only, using free Microsoft Learn content and free Azure DevOps)

Microsoft certification prices vary by country. The $165 figure is the US
price; check the Microsoft Learn certification page for your region before
registering. Microsoft occasionally offers exam vouchers through partners,
learning challenges, and Microsoft events such as Ignite and Build, so
watch for promotions before paying full price.

One cost that is easy to forget: the annual renewal. Unlike CompTIA or
Cisco certifications with multi-year cycles, Microsoft role-based
certifications expire after one year. Renewal is free and unproctored via
a short online assessment on Microsoft Learn, available within 6 months of
your cert expiry date. Set a calendar reminder. A lapsed cert means the
Expert badge disappears from your transcript until you renew it.

What salary can you expect after passing?

AZ-400 is an expert-level cert, and the associated roles sit at mid to
senior levels. 2026 US salary estimates from job boards show:

DevOps Engineer with AZ-400: $115,000 to $155,000
Azure DevOps / Release Engineer with AZ-400: $110,000 to $150,000
Senior DevOps or Platform Engineer: $145,000 to $185,000
Cloud Engineer with DevOps focus: $120,000 to $160,000

The cert is a hiring signal for roles that already pay well. It will not
turn a junior engineer into a senior one overnight, but it removes you from
the automatic screen-out pile for mid-level DevOps roles, and it gives you
a credible answer when a hiring manager asks how you know Azure pipelines.
The salary impact is clearest when the cert is combined with two or more
years of hands-on Azure DevOps or GitHub Actions work. On a resume with
real project experience behind it, AZ-400 is a genuine differentiator for
Azure-heavy employers.

What study resources actually work?

The candidates who pass on the first attempt tend to use a similar stack:

Microsoft Learn AZ-400 learning path for breadth. It is official, free, and maps to every exam domain. Treat it as your outline, not your only resource. The hands-on exercises in the labs are more valuable than the reading.
A personal Azure DevOps organization, used daily. Free to create. Build pipelines that fail, fix them, add environments and approvals, link Key Vault. Passive reading about YAML pipelines does not prepare you for writing one under exam conditions.
GitHub Actions practice. Create a free GitHub repository and replicate your Azure Pipelines workflows as Actions. The comparison between the two tools is a recurring exam theme, and hands-on experience with both makes those questions easy.
An IaC lab. Deploy a simple Azure resource via Bicep and via Terraform from a pipeline stage each. You do not need to be an IaC expert; you need to know how pipelines consume templates and what the deployment flow looks like for each.
At least 400 to 600 practice questions before exam day, including questions on pipeline security and case-study formats.
Two full timed practice exams in the final two weeks. If you are below 75% on the second one, postpone the real exam and spend the extra time in the pipeline domain.

Skip any site that claims to sell "real exam questions." Beyond the ethical
issue, those dumps train you to recognize memorized answers, not to reason
through a scenario you have never seen, which is exactly what AZ-400's
case-study and design questions require.

For the practice question portion, NerdExam has 619 enriched AZ-400
questions with full explanations. Start practicing AZ-400 questions
to see the question style and the reasoning the exam expects, particularly
for pipeline design and IaC scenarios where the right answer hinges on a
detail you can only internalize from doing the work.

Who should NOT take AZ-400?

The cert is wrong for these candidates:

You are	Take instead
No Azure associate cert yet	AZ-104 or AZ-204 first (you need one to earn the Expert cert anyway)
Brand new to Azure entirely	AZ-900 then AZ-104 or AZ-204 before AZ-400
AWS-focused DevOps engineer	AWS DevOps Engineer Professional (DOP-C02)
Only want CI/CD basics, no cert needed	Skip and learn Azure Pipelines or GitHub Actions directly on the job
Targeting Azure architecture, not DevOps	AZ-305 (Azure Solutions Architect Expert) is the better path

The prerequisite structure matters here more than on most exams. If you sit
AZ-400 without an associate cert and somehow pass, you still do not earn
the Expert certification. The badge requires both. That makes attempting
AZ-400 without AZ-104 or AZ-204 a pure waste of a $165 exam fee. Get the
associate cert first. It also ensures your Azure fundamentals are solid
enough that the exam questions on resource configuration and access control
do not slow you down.

What's next after AZ-400?

AZ-400 is already an expert-level cert, so there is no natural "next rung"
on the same ladder. The paths from here depend on where you want to grow:

Architecture track: AZ-305 (Azure Solutions Architect Expert) pairs naturally with a DevOps background. The overlap in IaC, networking, and security design is real, and many senior platform engineers hold both.
Security specialization: the Microsoft Cybersecurity Architect (SC-100) or the AZ-500 (Azure Security Engineer Associate) if you want to deepen the pipeline security and identity work from AZ-400 into a dedicated security credential.
Lateral depth: AI-900 or AI-102 if your team is adding AI workloads to the pipelines you already own. Not a deep technical extension, but useful for teams building ML deployment pipelines.
Renewal, annually. Set the reminder now. Microsoft role-based certs expire after one year. The renewal assessment is free and unproctored on Microsoft Learn, but you have to do it. A lapsed Expert cert is surprisingly common and looks careless to hiring managers who check transcript dates.

The most direct value from AZ-400 comes from the 12 to 24 months after
passing, when you are operating Azure DevOps environments at scale and the
cert maps directly to what you do every day. The Expert badge earns its
keep when a job posting lists it as preferred and you can click through on
your Microsoft Learn transcript to prove it.

Ready to start? Browse AZ-400 practice questions on NerdExam
or jump straight into the
free per-question explanations.
If you want the official exam outline before you plan your study path, the
Microsoft AZ-400 certification page
has the current skills-measured document and a link to register.

Microsoft Azure Fundamentals (AZ-900): What's Actually Tested

NERDEXAM — Wed, 01 Jul 2026 14:02:23 +0000

Microsoft Azure Fundamentals (AZ-900) is the on-ramp to every other Azure
certification and the credential most often listed as "nice to have" in
cloud-adjacent job postings. The exam is $99, runs 45 minutes, has roughly
40 to 60 questions, and requires 700 out of 1000 to pass. Most candidates
need 2 to 4 weeks of light study. The questions test whether you can
describe Azure concepts, not configure them, which makes AZ-900 the
easiest real certification in the Microsoft catalog. If you work in IT in
any capacity, you can pass this with a couple of weekends of focused
reading.

The 90-second answer

Take AZ-900 if you're new to cloud, you're about to start an Azure
role, or you need a recognizable credential to put on a resume while you
study for something harder. It's also the right pick if your employer is
moving to Azure and you want shared vocabulary with the people who run it.
At $99 and a 45-minute sitting, the cost-to-credibility ratio is excellent.

Skip AZ-900 if you already have hands-on Azure experience and you're
aiming for an admin or engineering role. In that case go straight to
AZ-104 (Azure Administrator). AZ-900 is a knowledge check, not a skills
check, so experienced practitioners often find it too shallow to bother
with on its own.

What does the AZ-900 actually test?

AZ-900 tests three domains. Microsoft refreshed the objectives on
January 14, 2026, but only with minor wording changes. The weights below
are the current published ranges. Every question maps to one of these.

Domain	Weight	What it covers
Describe cloud concepts	25-30%	Cloud computing, shared responsibility model, public/private/hybrid, IaaS/PaaS/SaaS, consumption-based pricing, serverless
Describe Azure architecture and services	35-40%	Regions, availability zones, resource groups, subscriptions, management groups, VMs, networking, storage, Entra ID, RBAC, Zero Trust
Describe Azure management and governance	30-35%	Cost management, tags, Azure Policy, resource locks, Azure portal, Cloud Shell, Azure Monitor, Advisor, Service Health

Notice the word "describe" in every domain title. That's deliberate. You
are never asked to build a virtual network or write a policy. You're asked
which service solves a stated problem, what the shared responsibility
model means, or why you'd use a resource lock. It is recognition and
recall, not configuration.

The architecture and services domain is the largest at 35 to 40%, so
that's where your study time should concentrate. Most people lose points
there by confusing similar services: Entra ID versus Entra Domain
Services, availability zones versus region pairs, or which storage
redundancy option survives a regional outage.

How hard is the AZ-900?

AZ-900 is a difficulty 1 out of 5. It is the gentlest paid certification
Microsoft offers. There is no scenario you have to architect, no command
syntax to memorize, and no time pressure worth worrying about: 45 minutes
for 40 to 60 questions is comfortable.

The exam is genuinely fair, but a few things still trip people up:

Marketing-sounding answer choices that all "sound right" until you know the exact service definitions
Microsoft renaming things (Azure Active Directory became Microsoft Entra ID, and older study material still uses the old name)
Drag-and-drop and "select all that apply" questions where you need the complete set, not just one correct item
Governance terms that blur together (Azure Policy, resource locks, management groups, and tags all sound like cost or compliance tools)

People who fail AZ-900 almost always studied from outdated free dumps with
wrong service names, or they skipped the management and governance domain
because it sounded boring. That domain is 30 to 35% of the exam. You
cannot afford to skip a third of the test.

How long should you study for AZ-900?

Microsoft positions AZ-900 as having no prerequisites and no required
experience. The study time depends entirely on your starting point:

Working in IT already (any stack): 1 to 2 weeks at 5 to 6 hours per week
New to cloud but technically literate: 3 to 4 weeks at 5 to 6 hours per week
Complete beginner, non-technical background: 4 to 6 weeks at 4 to 5 hours per week
Already using Azure at work: a few days of review to map your hands-on knowledge to the exam's vocabulary

The most efficient path is Microsoft's own free Learn modules, because the
exam questions are written from the same source material. Create a free
Azure account and click through the portal while you read. Seeing a
resource group, a storage account, and the pricing calculator in the
actual portal makes the abstract terms stick far faster than video
courses do.

A realistic week-by-week pace for a 3-week study plan looks like:

Week 1: Cloud concepts (IaaS/PaaS/SaaS, public/private/hybrid, shared responsibility, consumption pricing, serverless)
Week 2: Azure architecture (regions, availability zones, resource groups, subscriptions, VMs, virtual networks, storage tiers and redundancy, Entra ID and RBAC)
Week 3: Management and governance (cost management, tags, Azure Policy, resource locks, the portal, Cloud Shell, Azure Monitor and Advisor), plus practice questions and the free Microsoft practice assessment

Take the official free practice assessment on Microsoft Learn at least
once before exam day. If you score above 80% on it cold, you're ready.

What does the AZ-900 cost?

The exam itself is $99 USD plus any local taxes. Total cost stays low
because the best resources are free:

Component	Range	Notes
Exam fee	$99	One attempt. Retake is another $99 if you fail.
Microsoft Learn modules	$0	Official free training, same source as the exam
Practice questions	$0 to $30	NerdExam has 332 AZ-900 questions if you want a free option
Azure free account	$0	Free tier plus $200 credit for the first 30 days
Official practice assessment	$0	Free on Microsoft Learn, mirrors the real exam style
Total realistic spend	$99 to $130	Cheapest viable path: $99 (exam only)

Microsoft regularly runs free AZ-900 voucher campaigns tied to Virtual
Training Days. If you attend one of those free online events, you often
receive a 100% exam voucher afterward, which drops your total cost to
zero. Check the Microsoft Events page before you pay full price.

What salary can you expect?

AZ-900 is a foundational cert, so be honest about what it does. It rarely
lands a job on its own, but it signals cloud literacy and is a real
resume line for career changers. US salary data for 2026 shows a wide
range that reflects how varied the roles are:

Entry-level cloud-adjacent roles with AZ-900: $65,000 to $90,000
Average across all "Azure Fundamentals" titled roles: $110,000 to $120,000 (skewed by experienced people who happen to hold it)
Typical bump from adding AZ-900 to an existing IT salary: $5,000 to $8,000
With AZ-900 plus AZ-104 and real Azure work: $120,000 to $140,000

The honest read: AZ-900 by itself is worth a few thousand dollars and a
foot in the door, not a six-figure jump. The real money comes from the
role-based certs it leads to (AZ-104, AZ-204, AZ-305) paired with
hands-on experience. Treat AZ-900 as the cheapest way to prove you're
serious about cloud, then keep going.

What study resources actually work?

The candidates who pass on the first attempt keep it simple:

Microsoft Learn AZ-900 learning path (free). It's the primary source the exam is written from. Do not skip the management and governance modules.
A free Azure account so you can click through the portal, the pricing calculator, and a sample resource group while you read
The official Microsoft practice assessment (free), taken at least twice in your final week
John Savill's AZ-900 study cram on YouTube (free), a single recorded session that condenses the whole syllabus for review
At least 200 practice questions to confirm you recognize service names and definitions under exam phrasing

Be careful with free "dump" sites. Many use outdated service names
(Azure Active Directory instead of Microsoft Entra ID) and have wrong
answers that teach you the test incorrectly. Stick to current sources.

For the practice question portion, NerdExam has 332 enriched AZ-900
questions with full explanations. Start practicing AZ-900 questions
to see the exact "describe the service" phrasing before exam day. The free
explanations walk through why each distractor is wrong, which is the
fastest way to stop confusing similar Azure services.

Who should NOT take AZ-900?

The cert is the wrong move for these candidates:

You are	Take instead
An experienced Azure admin	AZ-104 (Azure Administrator Associate)
A developer building on Azure	AZ-204 (Azure Developer Associate)
Targeting a solutions architect role	AZ-305, after AZ-104
A data or AI professional	DP-900 or AI-900 (the matching fundamentals tracks)
Working primarily in AWS or GCP	AWS Cloud Practitioner (CLF-C02) or Google Cloud Digital Leader. Match the cert to your stack.

The only real mistake with AZ-900 is over-investing in it. It's a
two-to-four-week credential, not a multi-month project. If you find
yourself studying it for two months, you're either using bad materials or
you should have started on a role-based cert.

What's next after AZ-900?

AZ-900 is a launching pad, and three paths open up depending on your role:

Administrator track: AZ-104 (Azure Administrator Associate). The most common next step and the one most job postings actually require. Expect a real jump in difficulty: AZ-104 is hands-on and config-heavy.
Developer track: AZ-204 (Azure Developer Associate), for engineers who build and deploy applications on Azure.
Other fundamentals: DP-900 (Data), AI-900 (AI), or SC-900 (Security). These are sibling exams at the same easy level, and stacking two or three fundamentals signals broad cloud literacy cheaply.

Most people move from AZ-900 to AZ-104 within 3 to 6 months. Use that
window to get real hands-on time in the Azure portal, because every cert
above the fundamentals level assumes you've actually built things, not
just read about them.

Ready to start? Practice with real AZ-900 questions on NerdExam
or jump straight into the free per-question explanations.
The official Microsoft study guide is also worth a read first:
see the AZ-900 skills measured here.

What's Actually Tested on AZ-305

NERDEXAM — Wed, 17 Jun 2026 14:02:02 +0000

What Is on the AZ-305 Exam, and How Should You Prepare?

The AZ-305 Designing Microsoft Azure Infrastructure Solutions exam is not a knowledge quiz. It is a scenario-based assessment that asks you to make architectural decisions under constraint - balancing cost, security, performance, and operational maturity across four core domains. Candidates who pass are not just familiar with Azure services; they can reason through trade-offs and justify a design choice against competing options. If you want to calibrate where your gaps actually are before diving into study, practice with free AZ-305 questions on NerdExam and see how you perform against real scenario formats.

The exam targets architects and senior engineers who are expected to translate business requirements into technical designs. The four domains - design infrastructure solutions, design identity, governance, and monitoring solutions, design data storage solutions, and design business continuity solutions - map directly to the decisions a cloud architect makes every day. Here is what each domain tests, and more importantly, how you need to think to answer correctly.

Domain 1: Design Infrastructure Solutions

This domain covers compute, networking, and migration architecture. The core skill is not knowing which Azure services exist - it is knowing when to use one over another, and why.

The decision framework: Every infrastructure question puts a constraint in front of you: lift-and-shift urgency, a specific SLA requirement, a team with no containerization experience, a workload with unpredictable traffic spikes. Your job is to match those constraints to the right architecture tier.

Consider the compute layer. Azure has at minimum four distinct ways to run application code - Virtual Machines, Azure Kubernetes Service, App Service, and Azure Container Apps - and the exam tests your ability to distinguish them by fit, not by definition. The question is never "what is AKS?" The question is "given a team that already manages Helm charts and needs node-level GPU access, which compute option is correct?" That is a different cognitive task.

Worked example: A company needs to migrate a monolithic .NET application with stateful Windows services and a dependency on a third-party COM component. The team wants minimal rearchitecting and a six-week timeline. The answer is Azure Virtual Machines, probably with Azure Migrate to lift the existing workload. App Service would require rearchitecting the COM dependency. AKS would require containerization. The constraint - COM dependency and zero rearchitect budget - makes VM the defensible choice even if containers are the cleaner long-term path.

Networking architecture within this domain is equally scenario-heavy. Hub-and-spoke topology, Azure Virtual WAN, peering versus VPN Gateway, private endpoints versus service endpoints - these all appear in scenarios that require you to reason about traffic flow, latency, and cost at scale, not just recite definitions.

Domain 2: Design Identity, Governance, and Monitoring Solutions

This domain is where many candidates underestimate the complexity. It tests three distinct skill sets that share a single domain bucket: identity and access design, policy and governance architecture, and observability strategy.

The decision framework for identity: Microsoft Entra ID scenarios require you to understand federation, B2B versus B2C, Conditional Access, and Privileged Identity Management at an architectural level. The key discriminator is usually trust boundary - where does the identity originate, and how much control does your tenant have over it?

For governance, the exam consistently tests management group hierarchy design and Azure Policy versus RBAC as enforcement mechanisms. The distinction matters: RBAC controls what a principal can do with a resource after it exists; Azure Policy controls what resources can exist in the first place. An exam scenario that says "the company needs to ensure no storage accounts are created without private endpoints" is testing Policy, not RBAC.

Worked example: A financial services company with three subsidiaries needs each subsidiary to manage its own resources while a central security team enforces encryption-at-rest and approved regions. The correct architecture uses a management group hierarchy with the company root at the top, one management group per subsidiary below it, and policy assignments at the root level for compliance requirements. Subscription-level RBAC then grants each subsidiary team Contributor rights within their own subscriptions. RBAC alone cannot prevent a subsidiary from creating non-compliant resources; only Policy at a parent scope achieves that.

For monitoring, the exam tests the integration between Azure Monitor, Log Analytics workspaces, Diagnostic Settings, and Microsoft Defender for Cloud. The architectural question is typically about workspace design - centralized versus distributed - and the trade-offs between cost (ingestion, egress) and operational simplicity.

Domain 3: Design Data Storage Solutions

This domain covers relational databases, NoSQL, object storage, caching, and data integration. The surface area is large, but the exam focuses tightly on selection criteria and architecture patterns rather than service internals.

The decision framework: Every data storage question has at least one constraint that rules out most options. Query pattern, consistency requirement, data volume, geographic distribution, and team SQL familiarity are the most common discriminators. Learn these as filters, not as a memorization list.

Azure SQL Database, Azure SQL Managed Instance, and SQL Server on VMs form a spectrum. SQL Database is PaaS with the highest abstraction and lowest operational overhead. Managed Instance adds near-full SQL Server compatibility, including SQL Agent, linked servers, and cross-database queries. SQL on VMs is for scenarios where OS-level access, specific SQL Server versions, or third-party integrations require control that PaaS tiers cannot provide.

Worked example: A legacy application uses SQL Server's cross-database queries and SQL Agent jobs extensively. The team wants to reduce patching overhead and move to Azure. Azure SQL Database does not support cross-database queries or SQL Agent. SQL on VMs removes the patching benefit. Azure SQL Managed Instance supports both features and provides managed patching. This is exactly the Managed Instance design sweet spot the exam targets repeatedly.

For NoSQL storage, Cosmos DB questions test partition key selection strategy - the architectural decision with the largest downstream consequence in Cosmos designs. An exam scenario will describe an access pattern and ask you to identify the correct partition key; the right answer minimizes cross-partition queries for the hot path. The AZ-305 study guide on NerdExam covers data storage decision trees in depth and is worth working through alongside official Microsoft documentation.

Domain 4: Design Business Continuity Solutions

This domain is deceptively specific. It does not test general availability concepts - it tests Azure's concrete mechanisms for backup, disaster recovery, and high availability, and when to use which one.

The decision framework: Every business continuity question begins with two numbers: the Recovery Time Objective (RTO) and the Recovery Point Objective (RPO). RTO is how long you can be down; RPO is how much data you can afford to lose. These two constraints drive the entire architecture. A workload with a 4-hour RTO and 1-hour RPO has completely different design requirements than one with a 15-minute RTO and near-zero RPO.

Azure Site Recovery, Azure Backup, geo-redundant storage with failover, and Always On availability groups for SQL are the primary mechanisms. The exam tests your ability to match RTO/RPO requirements to the right mechanism and configuration - not just to name the service, but to defend why it fits while the alternatives do not.

Worked example: A company runs a Tier-1 ERP application on SQL Server in Azure VMs. The business requires a 30-minute RTO and a 5-minute RPO after a regional failure. Azure Backup alone cannot meet either target - restore times for VMs typically exceed 30 minutes, and backup frequency cannot achieve a 5-minute RPO. The correct design uses Azure Site Recovery for VM replication (enabling near-zero RPO and sub-30-minute failover) combined with SQL Always On availability groups with a replica in the secondary region for the database layer specifically. Azure Backup remains appropriate for long-term retention, but it is not the DR mechanism here.

Availability Zones versus regional redundancy is another recurring decision in this domain. Availability Zones protect against datacenter-level failure within a region; they do not protect against regional outages. Exam scenarios that describe a legal requirement to maintain data within a single geography while surviving a datacenter fire are testing Availability Zone design, not geo-redundancy.

Pulling It Together

The AZ-305 rewards architects who think in constraints rather than catalogs. Memorizing Azure services is insufficient - the exam presents realistic scenarios where three different services could all technically work, and your job is to identify which one fits the specific combination of requirements in front of you.

Practical preparation involves working through scenario-based questions that reflect actual exam depth. The full AZ-305 exam catalog on NerdExam gives you a structured view of coverage alongside practice resources aligned to each domain. Study the decision frameworks above, practice applying them under timed conditions, and pay particular attention to scenarios where two options seem equally valid - those are the questions where understanding the trade-offs separates passing candidates from repeaters.

AWS Certified Developer Associate (DVA-C02): What's Actually Tested

NERDEXAM — Mon, 15 Jun 2026 14:02:31 +0000

The AWS Certified Developer Associate (DVA-C02) is the certification for
developers who build and deploy applications on AWS. The exam is $150, runs
130 minutes, has 65 questions, and requires 720 out of 1000 to pass. Most
candidates need 8 to 10 weeks of focused study on top of real development
experience. The questions are almost entirely scenario-based. You are not
reciting API names. You are picking the right Lambda concurrency model, the
right DynamoDB partition key design, or the right CodeDeploy deployment
strategy for a given situation. If you have spent a year writing code that
runs on AWS, you can pass without a course. If you have not, budget the full
10 weeks and build real serverless applications.

The 90-second answer

Take DVA-C02 if you write code for a living and your work runs on AWS.
It is the credential that proves you can build with Lambda, DynamoDB, API
Gateway, SQS, and the AWS SDK, not just click through the console. Hiring
managers at companies running serverless workloads specifically screen for
this cert, and it pairs well with SAA-C03 if you already have that one.

Skip DVA-C02 if you have never deployed a function to Lambda or read
from DynamoDB in production code. Start with AWS Cloud Practitioner
(CLF-C02) to build vocabulary, or work through SAA-C03 first if you want
the architecture angle before the coding angle. Going into DVA-C02 without
hands-on developer experience usually means a failed first attempt and
another $150.

What does the DVA-C02 actually test?

DVA-C02 tests four domains. The weights below are from the official AWS
exam guide and have been stable since the exam launched in 2023. Every
question maps to one of them.

Domain	Weight	What it covers
Development with AWS Services	32%	Lambda, containers, API Gateway, DynamoDB data modeling, SQS, SNS, EventBridge, Step Functions, SDK and CLI usage
Security	26%	IAM roles and policies, Cognito user pools and identity pools, KMS encryption, Secrets Manager, SSM Parameter Store, secure API access patterns
Deployment	24%	CI/CD with CodePipeline, CodeBuild, and CodeDeploy; SAM and CloudFormation; Elastic Beanstalk; canary, blue/green, and rolling deployment strategies
Troubleshooting and Optimization	18%	CloudWatch logs and metrics, X-Ray tracing, caching strategies, Lambda cold start optimization, cost and performance tuning

The exam rewards developers who have actually shipped code to AWS. A typical
question describes a scenario ("a Lambda function is hitting concurrency
limits during peak traffic, and the team needs to handle the overflow without
dropping events") and asks which combination of services and settings to
apply. You are choosing the solution that fits the stated constraints, not
the most sophisticated one.

If you have heard "DVA-C02 is all about knowing when NOT to use a service,"
that captures it well. Questions routinely give you four architectures that
all technically work and ask which one is cheapest, most scalable, or
easiest to maintain for a development team.

How hard is the DVA-C02?

DVA-C02 is a difficulty 3 out of 5. About the same difficulty as SAA-C03,
but the focus shifts from designing infrastructure to writing and deploying
application code. It is harder than AWS Cloud Practitioner (CLF-C02) and
much easier than AWS DevOps Engineer Professional (DOP-C02). Community
surveys suggest first-time pass rates are in the 65% to 75% range for
candidates who studied at least 6 weeks and had real development experience.

The hard parts are specific:

DynamoDB data modeling: partition keys, sort keys, GSIs, LSIs, and access patterns come up constantly, and wrong design decisions at the data layer break everything else
Lambda execution model: cold starts, concurrency limits (reserved vs. provisioned), event source mappings, and retry behavior are tested deeply
Security at the code level: knowing the difference between an IAM role attached to a Lambda, a Cognito identity pool, and a resource-based policy matters, and the exam distinguishes them carefully
"Pick TWO" multi-select questions where partial credit does not exist
Time pressure: 65 questions in 130 minutes is exactly 2 minutes per question, with no buffer for review

The most common failure pattern looks like this: candidate takes a video
course, never deploys a real serverless application, walks into the exam,
hits a DynamoDB access-pattern question at question 20, spends 5 minutes
second-guessing, and then rushes the CI/CD section. Final score: 690.
Build real applications in week 2, not week 9. Deploy a Lambda behind an
API Gateway with a DynamoDB table before you have finished your first week
of study.

How long should you study for DVA-C02?

AWS recommends at least 1 year of hands-on development experience with AWS
services and proficiency in at least one high-level language (Python, Java,
JavaScript, etc.) plus the AWS SDK and CLI. That baseline is baked into the
question difficulty. For actual study time on top of that experience:

With 1+ year AWS developer experience: 4 to 6 weeks at 8 to 10 hours per week
With 6 to 12 months AWS experience: 8 to 10 weeks at 8 to 10 hours per week
No AWS experience: 14 to 16 weeks, and you should take CLF-C02 or SAA-C03 first anyway
Coming from SAA-C03: 4 to 6 weeks; you already know the service landscape, now learn the SDK and coding patterns deeply

The biggest waste of study time is reading documentation without writing
code. Build at least three real projects in your AWS account: a Lambda
function triggered by SQS with a dead-letter queue for failures; an API
Gateway endpoint backed by Lambda with Cognito authorizer protecting it;
and a SAM template that deploys all of the above via CodePipeline. That
hands-on work is what makes the scenario questions click. Reading about
Lambda cold starts is forgettable. Debugging one in a real function is not.

A realistic week-by-week pace for an 8-week study plan looks like:

Week 1: IAM deeply (roles, policies, trust relationships), Lambda fundamentals, function execution model
Week 2: API Gateway (REST and HTTP APIs), Lambda integrations, Cognito user pools and identity pools
Week 3: DynamoDB data modeling (partition keys, GSIs, query vs. scan, DAX caching)
Week 4: SQS, SNS, EventBridge, Step Functions (event-driven patterns)
Week 5: CodePipeline, CodeBuild, CodeDeploy, Elastic Beanstalk (CI/CD and deployment strategies)
Week 6: CloudFormation and SAM, ECS and Fargate basics, S3 events and presigned URLs
Week 7: CloudWatch, X-Ray, KMS, Secrets Manager, SSM Parameter Store, security and observability
Week 8: Practice exams, weak-area cleanup, exam-day pacing drills

Most failures happen because candidates treat this like SAA-C03 and focus
on architecture breadth. DVA-C02 goes narrow and deep on the developer
services. Lambda, DynamoDB, and the CI/CD pipeline together cover well over
half the exam.

What does the DVA-C02 cost?

The exam itself is $150 USD plus any local taxes. Beyond that, real total
cost depends on your study path:

Component	Range	Notes
Exam fee	$150	One attempt. Retake is another $150 if you fail.
Study course	$0 to $150	Stephane Maarek's DVA-C02 course on Udemy at ~$15 during sales
Practice questions	$0 to $50	NerdExam has 803 DVA-C02 questions if you want a free option
AWS lab costs	$20 to $60	Free tier covers most Lambda and DynamoDB usage; watch your API Gateway call counts
Books or whitepapers	$0	AWS Well-Architected Framework and Serverless Application Lens are free
Total realistic spend	$150 to $400	Cheapest viable path: $150 (exam only)

AWS offers a 50% retake voucher if you fail your first attempt, but only if
you book the retake within 14 days. AWS also drops 50% vouchers for
completing Skill Builder learning plans, so check your Skill Builder account
before you pay full price.

What salary can you expect after passing?

DVA-C02 sits in the developer tier, which commands a solid premium over
generalist development roles. Developers who can demonstrate AWS-specific
skills in Lambda, DynamoDB, and CI/CD pipelines routinely close the gap
with their infrastructure-focused peers. 2026 salary estimates from US job
boards show:

Cloud developer or software engineer (cloud): $110,000 to $150,000
Back-end developer with AWS skills: $100,000 to $140,000
DevOps-leaning developer roles: $120,000 to $160,000
With 3+ years and SAA-C03 plus DVA-C02: $160,000 and up at companies running serverless-first workloads

The cert alone does not deliver those numbers. It signals to hiring managers
that you know how to use AWS as a developer, not just as a console user. The
salary lift is most visible at companies running heavily on Lambda and
managed services, where DVA-C02 skills are directly billable.

A practical note on negotiation: if you pass DVA-C02 while currently
employed, bring it up before your next performance cycle, not after. The
cert validates a skill set your employer is already benefiting from. Internal
moves with a fresh DVA-C02 alongside real AWS production work historically
clear 8 to 15% base bumps. External moves with DVA-C02 plus 1 to 2 years of
serverless development experience routinely clear 20 to 30%.

What study resources actually work?

The candidates who pass on the first attempt use a consistent stack:

One video course for breadth. Stephane Maarek's "Ultimate AWS Certified Developer Associate" on Udemy is the community favorite at around $15 on sale. It covers the SDK patterns and DynamoDB modeling in more depth than most alternatives.
The AWS Serverless Application Model (SAM) documentation (free). Read the full developer guide and deploy a real SAM application. SAM questions appear on every sitting.
A free AWS account for hands-on labs (set a $10 billing alert immediately; Lambda and DynamoDB free tiers are generous but API Gateway and X-Ray add up quickly in lab scenarios)
At least 500 practice questions before exam day to build pacing and expose weak areas in DynamoDB and deployment strategies
Two full-length timed practice exams in the final week. Take them on a Saturday morning, treat them like the real exam, score honestly. If you are below 75% on the second one, postpone the real exam.

Skip the brain-dump sites. AWS refreshes DVA-C02 questions regularly, and
the scenario-based format means memorized answers fail in practice anyway.
Reddit's r/AWSCertifications has the most current crowd-sourced advice on
which resources are working this quarter.

For the practice question portion, NerdExam has 803 enriched DVA-C02
questions with full explanations. Start practicing DVA-C02 questions
to see the question style before you commit to a study plan. The free
explanations show you the reasoning pattern the exam expects, especially for
DynamoDB access patterns and Lambda concurrency, which are harder to absorb
from videos than from working through the questions.

Who should NOT take DVA-C02?

The cert is wrong for these candidates:

You are	Take instead
New to cloud entirely	AWS Cloud Practitioner (CLF-C02) first
Focused on cloud architecture and design, not coding	AWS Solutions Architect Associate (SAA-C03)
An infrastructure or ops engineer, not a developer	AWS SysOps Administrator (SOA-C02)
A non-developer who wants a cloud credential	SAA-C03 or CLF-C02 - DVA-C02 assumes you write application code
Already holding SAA-C03 and targeting a senior architecture role	Solutions Architect Professional (SAP-C02) is the higher-leverage move

The path matters more than the individual cert. DVA-C02 is excellent when
your daily work involves writing and deploying application code on AWS. It
is a poor use of 8 weeks if your role lives in Terraform and CloudFormation
templates and you rarely touch the SDK. Hiring managers do not penalize
architects for skipping DVA-C02; they penalize developers who cannot explain
why their Lambda function is timing out.

What's next after DVA-C02?

Once DVA-C02 is in hand, three paths open up depending on where you want
to go:

DevOps and operations track: AWS DevOps Engineer Professional (DOP-C02) is the natural step up. It builds directly on DVA-C02's CI/CD and deployment knowledge and adds infrastructure automation, monitoring at scale, and incident response. Most developers do this 12 to 18 months after DVA-C02.
Architecture breadth track: Add SAA-C03 if you do not already have it, or SOA-C02 for the operations angle. Holding DVA-C02 plus SAA-C03 covers both the build and design sides and makes you competitive for senior cloud engineer roles.
Specialty track: AWS Certified Security (SCS-C02) pairs exceptionally well with DVA-C02. The security domain is 26% of DVA-C02, and SCS-C02 deepens that into a standalone credential for developers working in regulated industries.

Most people take 12 to 24 months between DVA-C02 and their next cert. Use
that time to ship real Lambda and serverless production work. The cert pays
off when hiring managers see it alongside actual shipped applications, not
when it is the only AWS line on your resume.

Ready to start? Practice with real DVA-C02 questions on NerdExam
or jump straight into the free per-question explanations.
The official AWS exam guide is also worth reading first:
AWS Certified Developer Associate exam page.

AWS Certified Cloud Practitioner (CLF-C02): What's Actually Tested

NERDEXAM — Sun, 14 Jun 2026 14:01:52 +0000

The AWS Certified Cloud Practitioner (CLF-C02) is the foundational AWS cert and
the most common first step into cloud careers. The exam is $100, runs 90
minutes, has 65 questions, and requires 700 out of 1000 to pass. Most
candidates need 2 to 6 weeks of part-time study. The questions are mostly
definitional and conceptual, not deeply technical. If you already work near
cloud or IT, you can pass in a couple of weekends. If you're brand new to
technology entirely, budget the full 6 weeks and watch a full course.

The 90-second answer

Take CLF-C02 if you're new to cloud and want a recognized credential that
proves you understand the AWS vocabulary, the shared responsibility model, and
how billing works. It's the right first cert for career switchers, salespeople,
project managers, recruiters, and anyone supporting cloud teams without writing
infrastructure code.

Skip CLF-C02 if you already have hands-on AWS experience and a technical
role. If you can comfortably describe EC2, S3, VPC, and IAM from real work, go
straight to AWS Solutions Architect Associate (SAA-C03). CLF-C02 is foundational
on purpose. Hiring managers for engineering roles rarely weight it, and you'll
get more career return from the associate-level cert.

What does the CLF-C02 actually test?

CLF-C02 tests four domains. The current weights took effect with the C02 version
in 2023 and shifted security up and billing down compared to the old C01 exam.
Every scored question maps to one of these.

Domain	Weight	What it covers
Cloud Concepts	24%	Benefits of cloud, the AWS Cloud value proposition, cloud economics, the Well-Architected Framework, migration basics
Security and Compliance	30%	Shared responsibility model, IAM, AWS compliance programs, security services (GuardDuty, Shield, WAF), data protection
Cloud Technology and Services	34%	Core compute, storage, networking, database services, ways to deploy and operate, AWS global infrastructure
Billing, Pricing, and Support	12%	Pricing models, Cost Explorer, Budgets, the Pricing Calculator, support plans, account structures

The exam is light on tradeoffs and heavy on definitions. A typical question
describes a need ("a company wants to reduce the operational burden of patching
servers") and asks which AWS concept or service fits. You're matching the right
term to the right scenario, not designing an architecture.

If you've heard CLF-C02 called "the AWS vocabulary test," that's a fair summary.
Knowing what each service does matters far more than knowing how to configure it.

How hard is the CLF-C02?

CLF-C02 is a difficulty 1.5 out of 5. It's the easiest AWS cert and one of the
easier entry IT certs overall. Easier than CompTIA A+, much easier than AWS
Solutions Architect Associate (SAA-C03). AWS doesn't publish pass rates, but
community surveys put first-time pass rates well above 80% for candidates who
studied even two weeks.

The exam is approachable, but people still fail it. The common reasons:

Underestimating it and walking in with zero study, expecting general tech knowledge to carry them
Confusing similar service names (Inspector vs Macie vs GuardDuty, or EBS vs EFS vs S3)
Missing the shared responsibility model, which shows up repeatedly and trips up people who guess instead of memorizing the line between "AWS" and "you"
Skipping billing and support plans because the domain is only 12%, then losing easy points

Pacing is not a concern here. 65 questions in 90 minutes is roughly 1.4 minutes
per question, which is generous. Most candidates finish with 30 minutes to spare.

The most common failure pattern is overconfidence. Someone reads "foundational,"
assumes it means trivial, studies for an afternoon, and gets caught on the
service-identification questions. Two focused weeks beats one rushed evening
every time.

How long should you study for CLF-C02?

AWS recommends about 6 months of general AWS exposure before CLF-C02, but unlike
the associate exams, you can pass this one with study alone and no production
experience. Realistic study time:

With any IT or cloud background: 1 to 2 weeks at 5 to 8 hours per week
Career switcher, non-technical: 4 to 6 weeks at 5 to 8 hours per week
Already work adjacent to AWS (sales, PM, support): 2 to 3 weeks, mostly to learn service names and the billing model
Coming from Azure or GCP fundamentals: 1 week to map equivalent terms

The biggest time waster is over-studying. People watch a 14-hour course twice
and grind 1,000 practice questions for an exam that mostly asks "what does this
service do." You do not need labs for CLF-C02, though spinning up one free-tier
EC2 instance and one S3 bucket makes the concepts stick faster than any video.

A realistic week-by-week pace for a 4-week plan looks like:

Week 1: Cloud concepts, the six benefits of cloud, the Well-Architected Framework, global infrastructure (Regions, Availability Zones, edge locations)
Week 2: Core services. Compute (EC2, Lambda), storage (S3, EBS, EFS), databases (RDS, DynamoDB), networking (VPC, Route 53, CloudFront)
Week 3: Security and compliance. Shared responsibility model, IAM, security services, AWS Artifact and compliance programs
Week 4: Billing and support. Pricing models, Cost Explorer, Budgets, support plans, then practice exams and weak-area cleanup

Most people who fail skip week 3. Security and Compliance is the second-heaviest
domain at 30%, and the shared responsibility model alone shows up in several
questions.

What does the CLF-C02 cost?

The exam itself is $100 USD plus any local taxes. Beyond that, real total cost
depends on your study path:

Component	Range	Notes
Exam fee	$100	One attempt. Retake is another $100 if you fail.
Study course	$0 to $20	AWS Skill Builder has a free official course; Stephane Maarek or Neal Davis on Udemy run ~$15 during sales
Practice questions	$0 to $30	NerdExam has 893 CLF-C02 questions if you want a free option
AWS lab costs	$0	Free tier covers everything you'd touch for this cert
Books or whitepapers	$0	AWS Cloud Adoption Framework and Well-Architected PDFs are free
Total realistic spend	$100 to $150	Cheapest viable path: $100 (exam only)

AWS offers a 50% retake voucher if you fail your first attempt, but only if you
book the retake within 14 days. AWS also runs free digital training through
Skill Builder, and the AWS Educate program offers exam vouchers to eligible
students, so check before paying full price.

What salary can you expect after passing?

CLF-C02 is a door-opener, not a salary multiplier. It signals cloud literacy for
entry roles and adjacent positions, but it doesn't carry the earning power of the
associate and professional certs. 2026 US salary data from job boards shows:

Entry-level cloud support or associate roles: $65,000 to $85,000
Cloud-adjacent roles (sales engineering, project coordination, recruiting): $75,000 to $95,000
National average for CLF-C02 holders early in a cloud career: roughly $85,000
With CLF-C02 plus 2 to 3 years experience: $95,000 to $120,000, usually after adding an associate cert

The honest framing: CLF-C02 helps you get the interview and clear an HR keyword
filter, but it rarely moves a salary number on its own. The real jump comes when
you pair it with hands-on work and follow up with SAA-C03 or a developer cert.
Treat CLF-C02 as the cheapest, fastest way to prove you belong in cloud
conversations, then climb from there.

What study resources actually work?

Candidates who pass on the first attempt tend to use a small, simple stack:

One video course for breadth. AWS Skill Builder's official Cloud Practitioner Essentials course is free; Stephane Maarek's Udemy course (around $15 on sale) is the community favorite for a slightly faster pace
The AWS Cloud Adoption Framework and Well-Architected overview (free PDFs, short reads that map directly to the Cloud Concepts domain)
The shared responsibility model diagram, printed and memorized. It is the single highest-yield page for this exam
At least 200 practice questions to learn the service-identification style and find your weak domains
One full-length timed practice exam in your final few days. If you score above 80%, you're ready. CLF-C02 doesn't need two or three full mocks the way the associate exams do

Skip the bootcamps. A $300 course for a $100 foundational exam is poor value.
Skip the printed books, which go stale as AWS renames and adds services. Reddit's
r/AWSCertifications has current crowd-sourced advice on which free resources are
working this quarter.

For the practice question portion, NerdExam has 893 enriched CLF-C02 questions
with full explanations. Start practicing CLF-C02 questions
to see the question style before you commit to a study plan. The free question
explanations show you the service-matching pattern the exam expects, which is the
exact skill CLF-C02 rewards.

Who should NOT take CLF-C02?

The cert is wrong for these candidates:

You are	Take instead
An engineer with real AWS production experience	AWS Solutions Architect Associate (SAA-C03) directly
A developer building on AWS	AWS Certified Developer Associate (DVA-C02)
A SysOps or operations admin	AWS Certified SysOps Administrator (SOA-C02)
Already holding any AWS associate cert	Skip CLF-C02 entirely. It's foundational and adds nothing on top
Working primarily in Azure or GCP	The matching Azure (AZ-900) or Google (Cloud Digital Leader) fundamentals cert. Don't context-switch unless your job requires AWS

The risk with CLF-C02 is spending money to prove something you've already
outgrown. If you can already explain the core services from memory, the exam is
a formality that won't change how hiring managers see you. Foundational means
foundational. Use it as a starting line, not a destination.

What's next after CLF-C02?

Once CLF-C02 is in hand, the path forward is clear:

Architect track: AWS Solutions Architect Associate (SAA-C03). The natural, highest-value next step and the cert most cloud job postings actually ask for. Most people move here within 3 to 6 months of CLF-C02
Developer track: AWS Certified Developer Associate (DVA-C02) if you write application code that runs on AWS
Operations track: AWS Certified SysOps Administrator (SOA-C02) if you run and monitor infrastructure
Multi-cloud literacy: Azure Fundamentals (AZ-900) or Google Cloud Digital Leader if your organization runs more than one cloud

Most people take 1 to 4 months between CLF-C02 and an associate cert. Use that
time to get real hands-on practice in a free-tier account. CLF-C02 proves you
know the words. The associate certs prove you can build, and that's where the
salary lives.

Ready to start? Practice with real CLF-C02 questions on NerdExam
or browse the free per-question explanations.
The AWS Cloud Practitioner Essentials course is also worth working through first:
start it on AWS Skill Builder.

CompTIA Security+ Study Guide: A 10-Week Plan for SY0-701

NERDEXAM — Mon, 08 Jun 2026 14:01:58 +0000

The CompTIA Security+ SY0-701 exam is the most popular entry-level
cybersecurity certification and one of the most-cited credentials in
DoD 8140 baseline job postings. Pass at 750 out of 900. 90 questions in
90 minutes. $404 USD per attempt. Most candidates need 8 to 12 weeks of
focused study to pass on the first try. This guide is the actual
week-by-week plan, the resources that work, and the exam-day mistakes
that cost people their voucher.

The 90-second answer

Plan 10 weeks at 8 to 10 hours per week. Professor Messer's free
YouTube series carries the instruction. NerdExam covers the practice
questions. A printed exam objectives document is your single source of
truth for scope. That's the entire stack. Total cash spend if you
self-fund: $404 for the voucher.

Add Mike Chapple's Sybex book if you prefer reading to watching.
Add CertMaster Labs ($175) if you have zero hands-on security
experience. Skip the $300 bootcamps. They compress 10 weeks of
material into 1 week of cramming and the retention rate is terrible.

The first-attempt pass rate among candidates who score 80%+ on three
full timed practice exams (90 questions, 90 minutes, no breaks) is
roughly 90%. The pass rate among candidates who skip practice exams is
roughly 50%. Practice exams are the single most useful activity in
this plan and the easiest to skip.

How long should I study for Security+?

Most candidates need 8 to 12 weeks at 8 to 10 hours per week. The
honest variance comes from prior experience, not study material
quality.

Your background	Realistic study window
2+ years IT admin experience, no security focus	8 to 10 weeks
Active sysadmin or net admin role	6 to 8 weeks
Network+ certified, some security exposure	6 to 8 weeks
Career changer with no IT background	14 to 18 weeks; consider Network+ first
Active SOC analyst or security engineer	4 to 6 weeks for refresher only
College student studying cybersecurity	10 to 14 weeks

The biggest predictor of pass-on-first-try is hands-on time, not study
hours. Two candidates with the same 80 hours of study will see very
different scores if one of them did command-line work (nmap, Wireshark
captures, SSH key generation) and the other watched videos. Build at
least 20 hours of lab time into the 10-week plan.

What's actually tested on Security+ SY0-701?

Security+ SY0-701 tests five domains. CompTIA updated the weights when
they retired SY0-601 in mid-2024. Every question maps to one domain.

Domain	Weight	What it covers
General Security Concepts	12%	CIA triad, AAA, change management, cryptographic solutions, zero trust
Threats, Vulnerabilities, and Mitigations	22%	Threat actors, attack surfaces, malware classification, vuln analysis, indicators of compromise
Security Architecture	18%	Network, infra, application, and cloud security architecture; resilience and recovery
Security Operations	28%	Hardening, asset management, vuln management, monitoring, incident response, forensics
Security Program Management and Oversight	20%	Risk, governance, audit, vendor assessment, security awareness, compliance

Two domains carry 50% of the weight: Security Operations (28%) and
Threats / Vulnerabilities / Mitigations (22%). Spend the most study
time there and the math works in your favor.

The exam mix is roughly 75% multiple-choice and 25% performance-based
questions (PBQs). PBQs are simulated environments where you might be
asked to drag firewall rules into the right order, classify network
traffic from a Wireshark snippet, or identify the attack from a syslog
sample. PBQs are time-expensive and stress-inducing. Plan to skip them
on the first pass and return when you've answered the easier MCQs.

How do I structure a 10-week study plan?

The 10-week structure below tracks the official exam objectives in
roughly the order CompTIA presents them, with the heaviest-weight
domains getting extra time. Hours assume 8 to 10 hours per week.

Week	Focus	Deliverable
1	General security concepts, CIA, AAA, change management	Watch Messer 1.1-1.4, write a 1-page CIA summary in your own words
2	Cryptographic solutions, PKI, hashing, key exchange	Generate an RSA key pair, sign and verify a file with openssl, document the steps
3	Threat actors, attack surfaces, social engineering	Map a phishing email's red flags. Read CISA's Known Exploited Vulnerabilities catalog.
4	Malware classification, indicators of compromise	Capture a process tree on your own machine. Identify 3 normal vs 3 suspicious patterns.
5	Network and infra security architecture, zero trust	Build a home lab firewall (pfSense or OPNsense in a VM). Configure two zones.
6	Application and cloud security architecture	Walk through OWASP Top 10. Run a SQL injection demo on a deliberately vulnerable app.
7	Security operations: hardening, monitoring, incident response	Set up Splunk Free or Wazuh. Ingest your own VM logs. Build 2 alert rules.
8	Forensics, automation, vendor management	Take 2 full practice exams under timed conditions. Score honestly.
9	Risk, governance, audit, compliance frameworks	Map NIST CSF v2.0 functions to specific Azure or AWS services.
10	Practice exams + weak-area cleanup	Take 3 timed practice exams. Postpone exam if you're not at 80%+.

The single biggest miss in self-study plans is skipping week 8 lab
work for incident response. Roughly a quarter of SY0-701 questions
expect you to know what a real alert looks like, what triage steps
follow, and what evidence preservation requires. Reading about it
doesn't stick. Configuring Splunk or Wazuh does.

If you fall behind in any week, push schedule by 1 week rather than
compressing material. Compressed material doesn't retain. The exam
asks you to recognize patterns under time pressure, not regurgitate
facts.

Which Security+ study resources are worth using?

The candidates who pass on the first attempt use a consistent stack
of free and low-cost resources. Anything beyond this stack is
optional.

Professor Messer's SY0-701 video series (free, ~50 hours of YouTube videos). The community gold standard. Watch at 1.25x playback for first pass, real-time for review.
CompTIA Security+ SY0-701 exam objectives PDF (free, 24 pages). Print it. Highlight every sub-objective as you cover it. Don't trust any study material that doesn't map to this document.
Mike Chapple "CompTIA Security+ Study Guide: SY0-701" ($40 Sybex book). Strong supplement if you prefer reading. Skip if Messer's videos work for you.
A practice question bank with 800+ questions for pacing and weak-area discovery
CertMaster Labs SY0-701 ($175). Worth it if you have zero security hands-on experience. Skip if you've ever configured a firewall, run nmap, or read Wireshark output.
3 full-length timed practice exams in weeks 8 and 10. Take them on a Saturday morning, treat them like the real exam, score honestly. If you're below 80%, postpone the real exam.

Skip the $300 bootcamps. They compress 10 weeks into 5 days and the
material doesn't stick. Skip the $80 mobile flashcard apps unless
you're a flashcard person already; the time is better spent on
practice questions with explanations.

For the practice question portion, NerdExam has 1,056 enriched
SY0-701 questions with full explanations covering all five domains.
Start practicing Security+ questions to
see the question style before you commit to the full plan. The
explanations show the reasoning pattern the exam expects, which is
harder to learn from videos than from doing the questions.

How do I practice for the performance-based questions?

PBQs require hands-on configuration, not memorization. The fastest
way to prepare is to build a small home lab and practice the same
five scenarios that CompTIA cycles through on every exam version.

The five PBQ scenarios you should drill before exam day:

Firewall rule ordering: given a set of rules and a desired policy, drag the rules into the right order. Practice in pfSense or OPNsense in a VM.
Log analysis: identify the attack from a 10 to 20 line syslog or Wireshark snippet. Practice with Wireshark sample captures and sample Splunk logs.
Cryptography selection: pick the right algorithm for a given use case (data at rest, data in transit, integrity verification).
Wireless security configuration: configure WPA3 vs WPA2-PSK vs Enterprise auth correctly for a stated scenario.
Incident response sequencing: drag the IR phases into the right order for a stated breach scenario (NIST 800-61 sequence).

The home lab to support this fits on any modern laptop. A free
VirtualBox installation, two Linux VMs (one Ubuntu, one Kali), a
pfSense VM as the firewall between them, and a Windows 10 evaluation
VM as a Windows attack target. Total hardware cost: zero. Build time:
about 4 hours.

CertMaster Labs replicates a similar environment in-browser at $175
if you'd rather not build it yourself. The decision usually comes
down to whether you'll re-use the home lab after Security+ (Net+,
SY0-701 to CySA+ to Pentest+, or self-directed security learning).
The candidates who go on to a security analyst role get more value
from owning the lab. The candidates who just want the cert get more
value from CertMaster Labs.

What are the biggest exam-day mistakes?

Most Security+ failures happen because of pacing or PBQ mismanagement,
not because of knowledge gaps. The same 4 mistakes show up in
post-mortems on Reddit's r/CompTIA every week:

Spending 8+ minutes on the first PBQ. The exam often opens with one. People panic, over-invest, and run out of time on the easier MCQs at the end. Skip every PBQ on the first pass. Flag them. Return after answering all MCQs.
Reading every question word-by-word. 90 questions in 90 minutes is 1 minute average. Reading 200-word questions twice eats your buffer. Read once, decide, move on.
Second-guessing 10+ answers. Statistically, your first answer is right 75% of the time. Don't change answers unless you spot a clear word you misread.
Skipping the timed practice exams. Candidates who never time themselves discover their pace problem on exam day. By then it's too late.

A practical pre-exam check: take a 90-question practice exam under
real conditions in week 9 (no breaks, no notes, no internet). If you
score 750+ in 75 minutes or less, book the real exam within 7 days.
If you score 700 to 749, study weak areas one more week. If you score
below 700, postpone by 2 to 3 weeks. The voucher fee is too high to
gamble with.

What's next after Security+?

Once Security+ is in hand, three paths open up depending on what you
want from your career:

Analyst track: CySA+ (CompTIA Cybersecurity Analyst). The natural follow-on. Focuses on SIEM operations, threat hunting, and vulnerability management. Most analysts do this within 6 to 12 months of Security+.
Offensive security track: Pentest+ (CompTIA Pentest+) or OSCP. Pentest+ stays in the CompTIA ecosystem; OSCP is the gold standard but takes 6 to 9 months of study.
Cloud security track: AWS Certified Security Specialty or Azure AZ-500 (Security Engineer). Pairs well with Security+ for cloud-focused security analyst roles.

Most people take 6 to 12 months between Security+ and their next
cert. Use that time to ship real production security work in a SOC,
GRC, or pentest role. The cert pays off when hiring managers see it
alongside actual experience, not when it's the only line on your
resume.

Ready to start? Practice with 1,056 real Security+ SY0-701 questions
on NerdExam or browse the
free per-question explanations.
CompTIA's free exam objectives PDF is also worth downloading first if
you haven't: CompTIA Security+ exam objectives.

Adjacent reading: Where to actually buy a Security+ voucher and
which discounts work,
What is MFA, What is Zero Trust,
What is a CVE, and
7 most common reasons people fail IT certification exams.

CompTIA Security+ Exam Voucher: Cost, Discounts, and Where to Buy

NERDEXAM — Sun, 07 Jun 2026 14:02:01 +0000

The CompTIA Security+ SY0-701 exam voucher costs $404 USD direct from
CompTIA. That's the sticker price. Almost nobody pays it. Bundled
vouchers from Total Seminars, ITPro.TV, and Get Certified Get Ahead
drop the effective cost to $280 to $300 when bought with study material.
Student discounts shave another 10%. Military gets the voucher free
through the COOL program. Cash-paying retail buyers are the only people
paying $404, and there's no good reason to be one.

The 90-second answer

Buy the voucher direct from CompTIA if your employer is paying or
you need a fast turnaround. The full $404 fee gets you the voucher
within minutes via email and the longest validity window (12 months).

Buy a voucher bundle from Total Seminars or Get Certified Get Ahead
if you're self-funding. The bundle includes study material plus a
voucher for $280 to $300 total. The voucher is identical to the one
you'd buy from CompTIA. You get a discount because CompTIA wholesales
vouchers to publishers and they pass on part of the margin.

Skip eBay vouchers, Reddit DMs, and "I have an extra voucher" offers
from strangers. Most of them are stolen, refunded, or already
redeemed. Pearson VUE has flagged accounts and revoked seats for buyers
who used compromised vouchers, and CompTIA doesn't refund when that
happens.

How much does the Security+ exam actually cost?

The Security+ SY0-701 exam costs $404 USD purchased directly from
CompTIA's online store. The price increased from $370 in 2023. Outside
the US, the price varies by region but typically stays within $390 to
$420 USD-equivalent. Pearson VUE adds local tax at checkout for
testing-center delivery.

The full cost breakdown for a typical self-funded candidate:

Component	Range	Notes
Exam voucher (direct CompTIA)	$404	One attempt. Voucher valid 12 months.
Voucher (bundled with study material)	$280 to $310	Same voucher, packaged with a course or book
CompTIA CertMaster Practice	$159	Optional. Adaptive practice from CompTIA.
Professor Messer course	$0	Free YouTube series. The default starter for most candidates.
Mike Chapple book (Sybex)	$40	Solid printed reference. Skip if you do CertMaster.
Practice exam access (NerdExam)	$0	1,056 SY0-701 questions with explanations.
Retake voucher	$0 to $404	Free if you bought a CompTIA bundle. Otherwise full price.
Realistic self-funded total	$280 to $500	Cheapest viable path: voucher bundle plus free resources.

The cheapest path that actually works is: Total Seminars voucher bundle
at $280, Professor Messer YouTube videos for instruction, and free
NerdExam practice questions. That stack passes the exam if you put in
8 to 10 weeks. Adding $200 of paid material on top of that doesn't
move the pass rate much.

What's the cheapest way to get a Security+ voucher?

The cheapest legitimate Security+ voucher is the Total Seminars
voucher bundle at approximately $280, sold via the CompTIA-affiliated
training partner channel. It includes the voucher plus a short course.
The voucher itself is identical to the direct-from-CompTIA voucher.

The realistic ranking of voucher sources from cheapest to most
expensive:

Get Certified Get Ahead bundle: ~$280 with their study guide
Total Seminars bundle: ~$295 with their Udemy course
CompTIA Marketplace academic bundle: ~$315 with CertMaster Learn
CompTIA Marketplace standard bundle: ~$350 with CertMaster Practice
Direct from CompTIA: $404
eBay / Reddit "spare voucher" sellers: varies, often $200 to $250 but high risk of fraud (see the section below)

Be aware that "bundle" pricing changes whenever CompTIA runs a
promotion. Check the bundle price the day you buy. If the bundle costs
more than direct purchase, just buy direct.

Are CompTIA Marketplace bundles worth it?

The CompTIA Marketplace bundles are worth it only if you actually use
the CertMaster product. CertMaster Learn and CertMaster Practice are
solid tools but they retail for $159 to $359. The bundle pricing
effectively gives you both the voucher and the tool for less than the
voucher alone at retail.

The catch is most candidates don't finish CertMaster. The product is
designed for slow, methodical learning. If you prefer Professor
Messer's faster video pace or a printed book, you'll buy the bundle,
log into CertMaster twice, and never use it again. The math breaks the
moment you stop touching the tool.

The bundles worth buying:

CertMaster Practice + voucher at $350: skip if you already have another adaptive practice tool or 800+ practice questions elsewhere
CertMaster Labs + voucher at $400: worth it for hands-on candidates who learn by doing, not reading
CertMaster Learn + voucher at $440: roughly equivalent to a Udemy course plus the voucher; skip if you already have a video course

The third-party bundle from Total Seminars at $295 beats every CompTIA
Marketplace option on pure cost if you don't care about CertMaster.

Can my employer pay for Security+?

Most US employers in IT, defense, and federal contracting will pay for
Security+ because it appears on DoD 8570 and DoD 8140 baseline lists
for over 40 cybersecurity job roles. If your role is government-adjacent
or you handle CUI (Controlled Unclassified Information), the employer
typically has a budget line item for it.

What to ask for, in this order:

Voucher reimbursement if you've already passed and paid out of pocket. Most companies reimburse after a passing score is verified.
Pre-paid voucher through the company's training partner account. Many companies have CompTIA accounts with discounted bulk vouchers.
Combined tuition + voucher reimbursement if you also took a course (most tuition assistance policies cap at $5,250 annually, tax-free under IRS §127).

Bring the official cost ($404), the bundle alternative ($280-$310),
and a short note on why the cert matters for your specific role. The
DoD 8570 mapping is the strongest argument if you work in a federal
contracting role.

If you're self-funded and US-based, the exam fee is potentially
tax-deductible as a job-related expense under IRS §162 if it maintains
or improves skills required in your current job. Talk to your tax
preparer; "improving career prospects" is not deductible but
"maintaining existing job skills" is.

Do military and student discounts apply?

Active-duty US military can get the Security+ voucher free through the
Air Force COOL, Navy COOL, Army COOL, or DANTES programs. Veterans can
use GI Bill benefits to cover the voucher cost at approved test
delivery centers. Spouses of active-duty members qualify under MyCAA
if pursuing IT careers.

Verified students get a 10% discount through the CompTIA Marketplace
academic store, applied to the bundle price. The discount stacks with
some seasonal promotions but not with employer-paid voucher accounts.
Verification happens through SheerID and requires a .edu email or a
matched institution document.

The discounts that DO NOT exist, despite many forum threads claiming
otherwise:

"First-time taker" discount (doesn't exist)
"Tech industry employee" generic discount (doesn't exist)
"Career changer" discount (doesn't exist)
25% off codes from random YouTubers (the channel link is usually just an affiliate URL with no real discount on top of the bundle)

Don't waste time hunting for a code that beats the Total Seminars
bundle. The bundle floor is roughly $280, and the only path lower than
that is military-free or stolen.

What's the catch with cheap eBay or Reddit vouchers?

Cheap eBay and Reddit Security+ vouchers usually fall into one of three
categories: stolen, already redeemed, or sold by someone planning to
charge back the original purchase. All three end with Pearson VUE
canceling your exam appointment, often hours before the test, with no
recourse to recover your money.

The fraud pattern most candidates fall into:

Find a voucher on Reddit or eBay for $200
Pay via PayPal Friends and Family (no buyer protection)
Receive a voucher code that works at registration
Book an exam appointment 1 to 2 weeks out
Voucher gets revoked when the original buyer charges back
Show up to the test center, learn the seat is gone

CompTIA doesn't replace canceled exam seats for fraud cases. You lose
both the $200 you paid the scammer and the test date you scheduled.
Most people then buy a real voucher at full price and start over.

The only safe third-party vouchers are bundles from named training
partners with CompTIA Authorized Partner status. If the seller isn't a
listed partner on CompTIA's site, treat the voucher as fraudulent.

How long does a Security+ voucher stay valid?

A CompTIA Security+ voucher purchased direct or through an Authorized
Partner stays valid for 12 months from the date of purchase. You must
schedule and complete the exam within that window or the voucher
expires with no refund and no extension.

Bundled vouchers sometimes have shorter validity (90 or 180 days)
depending on the partner's contract with CompTIA. Read the partner
terms before buying. Total Seminars and Get Certified Get Ahead
typically include 12-month validity; some smaller partners use 6-month
validity to pressure faster turnaround.

If you bought a voucher and realize you won't make the deadline:

CompTIA does not extend or refund expired vouchers
You can occasionally transfer a voucher to another person before expiration (one transfer maximum, no fee, requires written request)
Pearson VUE will let you reschedule a booked exam up to 24 hours before the appointment without penalty
After the 24-hour mark, rescheduling costs $25 to $50 depending on region

The cleanest move if your deadline is slipping: schedule an exam date
inside the validity window even if you're not ready, then reschedule
later. The booked appointment locks in the voucher consumption record.

What about the retake voucher?

CompTIA does not sell a discounted retake voucher. If you fail
Security+, the second attempt costs the same $404 (or the bundle price
again). The only way to get a discounted retake is to buy a bundle
that includes one upfront, like the CompTIA Marketplace
"Voucher + Retake" package at approximately $479.

CompTIA's retake policy:

24-hour wait between attempts 1 and 2
14-day wait between attempts 2 and 3
14-day wait between attempts 3 and 4 and beyond
No limit on total attempts

Most candidates don't need a retake voucher in advance. The Security+
pass rate for prepared candidates (who scored 75% or higher on
practice exams in the final week) is around 85%. If you're under that
benchmark, postpone the exam rather than buying retake insurance.

A practical pre-exam test: take a full timed practice exam under real
conditions (90 questions, 90 minutes, no breaks). If you score 750 or
higher, book the real exam within 7 days. If you score 700 to 749,
study one more week. If you score below 700, postpone by 2 to 3 weeks.

The candidates who actually use the retake voucher are the ones who
booked the real exam without doing a timed practice run. The retake
insurance ends up being a vote of low confidence rather than a smart
hedge.

Where do you actually buy a Security+ voucher?

The right buying decision depends on three things: who's paying, how
fast you need it, and whether you want bundled study material.

Use this decision matrix:

Your situation	Where to buy	Effective cost
Employer-funded, need it today	Direct from CompTIA Marketplace	$404
Self-funded, need study material too	Total Seminars or Get Certified Get Ahead bundle	$280 to $310
Self-funded, already have a course	Total Seminars voucher-only bundle	~$280
Active-duty US military	COOL program (free)	$0
Verified student	CompTIA Marketplace academic bundle	$315 (with 10% off)
Veteran with GI Bill benefits	VA-approved testing center	$0 (after benefits)
First-time CompTIA candidate, wants safety net	CompTIA Marketplace voucher + retake bundle	~$479

The cheapest legitimate voucher is the Total Seminars bundle at $280
to $295. Add free Professor Messer videos, free NerdExam practice
questions, and you have a complete study stack under $300.

Ready to start? Browse NerdExam's free Security+ SY0-701 practice
questions to see the question style before
you commit to a voucher. The 1,056 enriched questions cover all five
SY0-701 domains, and the explanations show the reasoning pattern the
exam expects. Practicing 200 to 300 questions before you buy the
voucher means you'll know whether you're 4 weeks or 12 weeks from
ready.

Adjacent reading: the
CompTIA Security+ SY0-701 study guide,
What is MFA and why does the Security+ exam ask
about it constantly,
What is Zero Trust, and
7 most common reasons people fail IT certification exams.

CompTIA Security+ Exam Objectives (SY0-701): Domain-by-Domain Breakdown

NERDEXAM — Sat, 06 Jun 2026 14:01:33 +0000

The CompTIA Security+ SY0-701 exam tests five domains across 90
questions in 90 minutes. CompTIA updated the domain weights when they
retired SY0-601 in mid-2024. Two domains, Security Operations (28%)
and Threats/Vulnerabilities/Mitigations (22%), carry exactly half the
exam weight. The other three domains share the rest. If you study
the official objectives PDF without understanding the weights, you'll
waste 30 to 40 hours on the lower-weight domains and run out of time
on the high-impact ones.

The 90-second answer

Study the high-weight domains first. Security Operations (28%)
and Threats/Vulnerabilities/Mitigations (22%) together account for
50% of the exam. If you can answer 90% of questions in these two
domains, you're already at 45 points out of a passing 750. Combined
with average performance elsewhere, that's the path to a pass.

The traps: General Security Concepts (12%) feels easy because it
covers vocabulary, so candidates skip it during review. Then 5 to 7
questions tripped on technical definitions of things like
"compensating control" or "deterrent vs preventive" cost the exam.
Security Program Management (20%) feels boring (policies, governance,
audit) so candidates skim it. Both are deceptively trap-heavy.

The good news: every SY0-701 question maps to one of these five
domains, and the official objectives PDF lists every sub-objective.
There are no surprises if you actually read it.

What does Domain 1 (General Security Concepts) cover?

Domain 1 covers the foundational vocabulary every security question
relies on, weighted at 12%. Roughly 11 questions on a 90-question
exam. The CIA triad, AAA (authentication, authorization, accounting),
non-repudiation, security controls classifications, change management,
zero trust principles, and basic cryptography fall here.

Specific objectives you'll see on the exam:

Topic	What's tested
CIA triad	Distinguishing confidentiality, integrity, availability concerns in scenario questions
Security control types	Technical vs administrative vs physical; preventive vs detective vs corrective vs compensating vs deterrent
Change management	The PMBOK-style process of impact assessment, approval, testing, documentation
Cryptographic solutions	PKI, symmetric vs asymmetric, hashing (SHA-256, SHA-3), digital signatures, certificates
Zero trust principles	Adaptive identity, threat scope reduction, policy-driven access, control plane vs data plane

This domain is mostly vocabulary memorization. The fastest study
approach is reading Professor Messer's 1.1 through 1.4 videos at 1.5x
speed, then making a one-page summary in your own words. Most
candidates rate this the easiest domain after taking it.

What does Domain 2 (Threats, Vulnerabilities, and Mitigations) cover?

Domain 2 weighs 22% and covers everything attackers do plus how
defenders respond. Roughly 20 questions per exam. Threat actors,
attack surfaces, malware classifications, social engineering, network
attacks, application attacks, vulnerability classifications, indicators
of compromise, and mitigation techniques all fall here.

The sub-objectives that show up most often:

Threat actor motivations and capabilities: nation-state vs organized crime vs hacktivist vs insider; you need to map a scenario description to the right threat actor type
Attack vectors and attack surfaces: differentiating attack vectors (how) from attack surfaces (where)
Malware classifications: virus vs worm vs trojan vs ransomware vs rootkit vs spyware vs keylogger vs logic bomb. Several questions per exam.
Social engineering: phishing variants (spear, whaling, vishing, smishing), pretexting, watering hole attacks, business email compromise
Network attacks: DDoS variants (volumetric, protocol, application layer), MITM, DNS attacks, wireless attacks, replay attacks
Application attacks: SQL injection, XSS (stored vs reflected vs DOM-based), CSRF, directory traversal, buffer overflow, race conditions, malicious code injection
Indicators of compromise (IoC): account lockouts, concurrent session usage, blocked content, impossible travel, resource consumption, OOM errors, missing logs
Mitigation techniques: segmentation, access control, monitoring, least privilege, defense in depth, hardening

Most candidates lose points here on the indicator-of-compromise
questions and the social engineering variants. The fix is doing 50 to
80 practice questions in this domain specifically before exam day.

What does Domain 3 (Security Architecture) cover?

Domain 3 weighs 18% and covers architectural design choices that
shape security posture. Roughly 16 questions per exam. Network, infra,
application, and cloud security architecture; resilience and recovery
patterns; secure data classification all fall here.

The sub-objectives that show up most:

Network security architecture: firewall placement, DMZ design, network segmentation, VLANs, micro-segmentation, screened subnets, east-west vs north-south traffic
Cloud security architecture: shared responsibility model (specifically AWS / Azure / GCP variations), serverless vs containers, SaaS-specific concerns, IaC security, hybrid cloud
Application security architecture: secure coding practices, input validation, output encoding, parameterized queries, secure defaults, secure libraries
Resilience and recovery: high availability designs, fault tolerance, redundancy, backup strategies (3-2-1 rule), RTO/RPO calculations, hot/warm/cold sites
Data classification and protection: sensitive data identification, encryption at rest, encryption in transit, DLP, tokenization, data masking, secure data disposal

This domain often surprises candidates because it overlaps with the
CompTIA Cloud+ exam content. If you've done any cloud work,
expect to score higher here than you expect. If you haven't, this is
the domain where simulated labs help most.

What does Domain 4 (Security Operations) cover?

Domain 4 weighs 28%, the highest of any domain. About 25 questions
per exam. Hardening, asset management, vulnerability management,
monitoring, incident response, digital forensics, and identity
management all fall here.

The sub-objectives that show up most:

Hardening techniques: secure baselines, configuration management, disabling unnecessary services, default credential changes, patch management, endpoint hardening
Vulnerability management: scanning (authenticated vs unauthenticated, internal vs external), CVSS scoring, prioritization by risk, remediation strategies
Monitoring and SIEM: log aggregation, correlation rules, alert tuning, dashboards, retention policies, common SIEM platforms (Splunk, Sentinel, Elastic, QRadar)
Incident response: NIST 800-61 lifecycle (preparation, detection, containment, eradication, recovery, lessons learned), playbooks, chain of custody, tabletop exercises
Digital forensics: evidence preservation, chain of custody, volatile vs non-volatile data, timeline analysis, hash verification, legal holds
Identity and access management: SSO, MFA, federation, just-in-time access, privileged access management, identity proofing, account lifecycle
Automation and orchestration: SOAR platforms, scripted responses, ticket integration, API-driven workflows

This domain has the most performance-based questions (PBQs). Expect
2 to 3 PBQs that drop you into a simulated SIEM dashboard or ask you
to drag IR phases into the right order. The home-lab investment from
the Security+ study guide
pays off most here.

What does Domain 5 (Security Program Management) cover?

Domain 5 weighs 20%, the second-largest after Operations. About 18
questions per exam. Risk management, governance, audit, vendor risk
management, security awareness, and compliance frameworks all fall
here.

The sub-objectives that show up most:

Risk management: risk identification, assessment (qualitative vs quantitative), treatment (accept, avoid, mitigate, transfer), monitoring, risk appetite vs tolerance, risk register
Governance: policies, standards, procedures, guidelines, centralized vs decentralized governance, governance structures
Compliance frameworks: NIST CSF v2.0, ISO 27001, PCI DSS, GDPR, HIPAA, SOX, CCPA, regional data sovereignty rules
Vendor risk management: due diligence, contracts and SLAs, third-party assessments, supply chain attacks, fourth-party risk
Audit and assessment: internal vs external audit, attestation reports (SOC 1, SOC 2 Type I vs II, ISO certifications), gap analysis, control testing
Security awareness: training programs, phishing simulations, password policies, acceptable use policies, role-based training
Privacy considerations: data subject rights, consent management, privacy impact assessments, breach notification timelines

This domain trips technical candidates because it asks process
questions, not technical ones. The framework-mapping questions (NIST
CSF function to a specific control) are where most points get lost.
Spend at least 8 hours on this domain even though it feels
"boring" to technical readers.

How do the domain weights compare to SY0-601?

CompTIA shifted weight toward Security Operations and Security Program
Management when they updated to SY0-701 in mid-2024. The old SY0-601
breakdown was:

Domain	SY0-601 weight	SY0-701 weight	Change
Attacks, Threats, Vulnerabilities	24%	22%	-2% (now "Threats, Vulnerabilities, Mitigations")
Architecture and Design	21%	18%	-3% (now "Security Architecture")
Implementation	25%	merged into Architecture + Operations	removed as standalone
Operations and Incident Response	16%	28%	+12% (now "Security Operations")
Governance, Risk, Compliance	14%	20%	+6% (now "Security Program Management")

The big shift is Security Operations going from 16% to 28%. If you're
using older study material that pre-dates SY0-701, you'll under-prepare
on the most important domain. Verify your course version covers
SY0-701 explicitly before you spend study time on it.

How do I use the domain weights to plan study time?

Allocate study hours proportional to domain weights, with a 1.2x
multiplier for domains where you have weaker hands-on experience. A
realistic 80-hour study budget breaks down like this:

Domain	Weight	Base hours	Adjusted hours (for typical IT admin)
Security Operations	28%	22	24-28 (most candidates need extra lab time)
Threats, Vulnerabilities, Mitigations	22%	18	18-20
Security Program Management	20%	16	18-20 (process-heavy, often skipped)
Security Architecture	18%	14	14-16
General Security Concepts	12%	10	8-10 (vocabulary, fast to learn)

If you're a process-oriented person (project manager, GRC analyst),
flip the multiplier: spend MORE time on Architecture and Operations,
less on Program Management.

The candidates who pass on the first try track their per-domain
practice-question accuracy weekly. Practice tools like NerdExam break
their question banks by domain, so you can see where you're at 85%
and where you're at 60%, then allocate the next week's study time
accordingly.

For practice questions filtered by domain, NerdExam has 1,056
enriched SY0-701 questions with full explanations.
Start practicing Security+ questions to
see the question style before you commit to a study plan.

What's NOT on the SY0-701 exam?

CompTIA explicitly excludes several topics that show up in study
forums but never appear on the real exam:

Specific vendor product configuration (no exam questions on "configure Cisco ASA firewall syntax")
Programming syntax (you might see PowerShell or Bash pseudo-code in a PBQ but never write code)
Deep cryptography math (you need to know SHA-256 exists, not implement it)
Specific CVE numbers (you need to know what CVSS is, not memorize CVE-2024-1234)
Detailed legal case law (you need to know HIPAA exists and its general scope, not memorize which exception applies in subsection 164.512)
Specific tool keyboard shortcuts or menu paths
Vendor-specific cloud service names (you need "object storage", not "S3 vs Azure Blob vs GCS")

If a YouTube prep video spends 20 minutes on any of these, switch
videos. The exam doesn't reward that level of detail.

Adjacent reading: CompTIA Security+ Study Guide: 10-Week Plan,
Where to actually buy a Security+ voucher,
What is MFA, What is a CVE,
What is Zero Trust.