I know I mentioned this previously on Facebook and Google+, but I'll do so again. I passed the CompTIA Security+ exam last Monday. The minimum required to pass was 750 out of 900, and I scored a 798 (roughly 89%). I am extremely happy that I passed it and should not have to worry about taking it again for three years. But I did want to share some thoughts to pass on to people that may be taking the test in the near future.
In my opinion it was a difficult test, at least for me. I deal with very few of the topics that were on the test on a daily business in my line of work. The problem, though is that a lot of government and corporate institutions these days are starting to require that you have this certification either before you get a particular position or within a particular time frame after you take a position (usually about six months or so). For the U.S. government (at least in the groups for which I work) you are required to have the Security+ exam regardless of your position. You are also required to have the "subject matter" certifications as well. So if you are an MS Windows systems engineer for example you need to be certified in MS Windows (which, in many cases could require six or more tests!).
I have no problem with taking a test in your area of expertise, but requiring a test with topics you don't use on a regular basis is not a good idea. This is just another one of the federal government's "cookie cutter/one size fit all" directives that really needs to be better thought out. Particularly when these tests can cost the test taker a large amount of money. Security+ exams are $302 dollars! More advanced exams can cost the test taker over $500 dollars or more! If your company reimburses you for successfully taking the test, that's great! But many companies don't do that and you usually only get reimbursed for a successful completion. Heaven forbid if you fail the exam and have to take it over again!
So how to prepare for the test? Well, hopefully you have a little experience with the subjects of the exam. And we all have different ways of preparing for exams. I'll tell you my methods.
First thing I would suggest is that you need to block off time to study. The books all recommend a minimum of six weeks of studying every day. I would agree with that assessment, but I didn't take that long. I pretty much spent four weeks studying, the whole of the month of August. Every day I spent anywhere from two to five hours studying for the exam. A lot of that time was drilling sample exam questions that would be similar to what was on the exam. But get it in your mind that the questions will be similar to what is on the exam, but in most cases are not the same. More on that later.
Don't just focus on one book to cover all the topics. No matter what the books says, something will be missing. The main book I used was CompTIA Security+ SY0-401 Cert Guide, Deluxe Edition (3rd Edition) by David L. Prowse. This is the official book put out by the Pearson testing service and, for the most part it got me through the test. By the way, if you use this book you should upgrade the the "Premier" edition for an additional $15 at the Pearson site. It gives you the book in PDF, mobi (Amazon format) and ePub formats as well as the Pearson question engine which gives you access to around nine hundred prep questions.
But don't just rely on one book! I used two other books to prepare as well as well as a thousand or so more questions and a review syllabus that a supervisor at work had from a test preparation company he used. Don't skimp if you can on preparing for the test; use any means necessary to get prepared. I'll put links to the other books in a set of links.
One other thing that you need to do is practice the simulations on the test. Not only will you have a number of questions you have to answer, there will be several simulations that you have to work on and correctly answer or configure. You might be asked to match the different kinds of social engineering OR you might have to use a set of pictures and IP addresses to configure a demilitarized zone (DMZ). Both of these came in the supplemental materials that were in the Prowse book, but there could be even more. You need to look for simulations & demo videos that simulate some of the topics on the exam and you need to have these stone cold in your memory ready to implement them when/if they appear on the exam.
Make sure you read all of the primary book you are using. Don't just skim it. There is always information in it that will help you in the exam somewhere. Then go to your "supplemental" books and questions and focus on the topics that got little or no coverage in your main book. Don't assume that if it wasn't in one book it won't be on the test.
When I was going through the practice questions, I made sure that I didn't memorize any specific answers. You can't assume that the questions on the real exam will be the same as they were on the practice exam(s) or that they will be in the same answer order. Many of the questions are also of the "choose the best X answers" style and you cannot assume they will have all the choices you had. Try to remember to get the concepts down, not the exact answer.
I did two things that helped me a lot. The first was to set up groups of flashcards with items like ports for different protocols I needed to know via a flashcard program called Quizlet. I was able to do traditional flashcard as well as matching games with some of the topics. The second thing I did was take extensive notes when I missed one of the questions I was drilling. That helped reinforce the concepts, particularly when I was trying to remember the types of authentication (and believe me, you need to have that down pat).
One of the best things you can do is set a goal/deadline date for the exam. That way you have a clear time to complete your preparations. You don't have to immediately schedule you exam, just set a deadline that you can reassess when needed. I set the last day of the month as my test date and was able to use that to focus my studying. Two weeks before the test, I assessed where I was in my preparations so I could adjust the test date if I needed to do so. I finally felt I had the confidence a week before to schedule the exam and did so.
So, what was exam day like?
Well, seem like any other day I guess. August 31 was last Monday. Saturday (about six hours, split into a four-hour session in the morning and two in the afternoon) and Sunday (straight four-hour morning session) I basically finished my review notes and the last of the sample questions. There was one simulation I was getting 90% right but never getting to 100% and I needed to get that down pat. Never did quite get it. I focused more on getting a decent amount of sleep and rest before the exam day. Nothing new, just quiet review.
I had to drive forty-five miles to the test site. You would think a major college town would have a Pearson test center. Nope. Luckily I scheduled it for mid-morning and left extra early to get there since I had not been to the test center before. I listened to a sci-fi audoibook on the way to relax me a bit. No additional review; I did not want to confuse myself. If I didn't know it already I wasn't going to know it by cramming it in at the last second.
One thing I would recommend is that you leave everything in your car that you can. Even your watch. The test centers are paranoid about people recording questions from the test. Just bring in your two forms of identification and your car keys. Lock the rest up out of sight in your car. The easiest thing to do.
So how was the test? Well, I felt like I had failed it. Really. The simulations were presented first. For some of them, I felt I was was prepared. It was the other simulations that got me worried. I did not recognize them AT ALL (Now you know why I'm telling you to find all the simulations you can and practice them like nuts). Then I went to the questions. And I felt like I was going to fail as I did not recognize a large majority of the questions. Two or three of them seemed completely familiar, the rest I felt out of my depth. I swear, when I got to the survey I thought I had failed. And they make you take the survey before you get the results.
Luckily I must have studied enough to absorb the needed knowledge or I must have had a major boost of luck on my side. I must have been one hell of a guesser, because I did pass. I was definitely relieved, that's for sure, but felt like I had passed only by the skin of my teeth. Yes, a pass is a pass, but I thought the margin was TOO close for comfort. But pass I did.
OK, I think that's enough for now. I'll provide my opinions on "after the test" topics in the next couple of days. I hope some of you find my observations useful.
