CompTIA Security+

CompTIA Security+ is the most recognized ENTRY-level certification for cybersecurity fundamentals. It’s theoretical (a test), broad, and vendor-neutral. It doesn’t make you a pentester, but it validates that you know the base concepts and is often a requirement in many jobs and HR processes.

What it is (and isn’t)

- a FUNDAMENTALS certification, theoretical (multiple-choice exam + performance questions)
- broad: covers the whole security spectrum at a conceptual level
- vendor-neutral, recognized worldwide
- NOT practical/offensive: it doesn't replace OSCP/eJPT for technical pentest roles

What it covers (domains)

- threats, attacks, and vulnerabilities; secure architecture and design concepts
- implementation (IAM, crypto, secure networks); operations and incident response
- governance, risk, and compliance (GRC) at a basic level
# it gives the VOCABULARY and conceptual map of all security

Who it’s useful for

- those STARTING who want a solid base and an HR-recognized cert
- IT/support roles adding security; a requirement in many jobs (incl. public sector/defense)
- meets the DoD 8570/8140 baseline in the US (relevant for certain jobs)
- a base complement before going to practical certs (eJPT/OSCP) or GRC

How to prepare

- official CompTIA material + a course (Professor Messer is a free reference)
- practice tests until you comfortably pass; memorize acronyms and concepts
- relate each topic to practice (this wiki's areas give the real "why")

Professional value

- opens doors in HR (a frequent filter) and in entry-level roles
- a conceptual base that helps understand the rest (blue, GRC, cloud)
- on its own it doesn't demonstrate practical skill -> combine with labs/portfolio

Blue Team / career

Security+ gives the vocabulary and map of all security: a good base for any role.
It’s a frequent HR filter and a requirement in public sector/defense (DoD 8570).
It doesn’t replace practical certs: for technical roles, combine with eJPT/OSCP and labs.
Also useful as a base before GRC (grc-*) and cloud.

Tips and common mistakes

It’s broad and theoretical: study by domain and use practice tests (the exam has PBQs, performance-based questions).
Great as a first cert/baseline (DoD 8570); don’t expect hands-on offensive content.
Common mistake: memorizing without understanding; PBQs require applying concepts.

Testing checklist

Official material + a course (e.g. Professor Messer)
Cover all domains (threats, architecture, IAM, crypto, IR, GRC)
Practice tests until you pass comfortably
Relate concepts to practice (wiki areas)
Decide the later specialization (roadmap)
Combine with labs/portfolio to demonstrate skill
Check whether your target job requires it (HR/DoD)