Cybersecurity certifications, and where Security+ fits

The ladder runs from general IT to specialized security:

1. A+: hardware, operating systems and troubleshooting; the help desk certification.
2. Network+: how networks are built and fixed; subnetting, routing, wireless.
3. Security+: the security baseline across threats, architecture, operations and governance.
4. CySA+ (defensive analysis) or PenTest+ (offensive testing): the specialist step.
5. SecurityX (formerly CASP+): the expert-level architecture and engineering exam.

The first three together are known as the CompTIA trifecta. You do not have to climb in order: nothing is required before step three, and the recommended experience shifts with the edition. For SY0-801 CompTIA recommends two years of hands-on security administration and no longer names Network+. If you already work with networks, you can start at step three; if you have never configured a router or read a log, Network+ first makes its scenarios far easier.

These names recur in lists of cybersecurity certifications. None has prep here yet; the point is where each sits relative to the CompTIA path.

• Entry level: ISC2 Certified in Cybersecurity (CC), a lighter foundation exam; Google's cybersecurity certificate, a course rather than a proctored exam.
• Networking: Cisco CCNA, deeper and vendor-specific; an alternative to Network+.
• Cloud: AWS, Microsoft Azure and Google Cloud certifications, from fundamentals (AZ-900) to security specialties.
• Practitioner: ISC2 SSCP, similar in scope to step three but with an experience requirement; EC-Council CEH, offensive.
• Senior and management: ISC2 CISSP and ISACA CISM, both requiring years of paid experience; they are career-stage credentials, not starting points.

In DoD cyber work roles, a qualification is required rather than optional. Under DoD 8140, each work role has its own qualification options, and this exam is one of the foundational options for many of them, from system administrator to incident responder. Which role you are coded to, and at what proficiency level, decides whether it is enough. The published role list is on the exam overview.

A common route, with or without a degree:

1. Get an IT foothold. Help desk, desktop support or junior sysadmin work teaches how systems fail, which is much of what security work investigates.
2. Learn networking properly. Ports, protocols, DNS, routing and subnetting come up across security exams and interviews.
3. Pass Security+. It shows the vocabulary is in place and clears the certification bar on many job postings and DoD 8140 roles.
4. Build evidence. A home lab with a firewall, a SIEM and a few vulnerable VMs; write up what you found and fixed.
5. Specialize. Pick analysis, testing, cloud or governance, then the matching certification from the lists above.

Without experience, certifications open the interview but labs and write-ups carry it. A free practice test shows how far you are from Security+ today.