Just Passed CySA+

yesterdaysthought

Just passed CySA+. It wasn't clear from anything on the exam documentation that it was v1 or v2 but it must have been v2 since it had cloud questions which v1 supposedly doesn't have.

It was about as hard as I thought it would be- the hardest IT cert exam I've ever taken. I scored about just under what I was scoring on the practice tests. Required passing score is 750 out of 900 (83.33% if equal weighted Q)

Preparation:

1. used the 650pg Sybex book and the practice test book and scored mid-high 80s range. Got the Sybex book as kindle and read on PC which was nice as you can create organized highlighted sections and flashcards. Much better (and cheaper) than paperback IMO. YMMV.
2. used the MeasureUp practice tests which are borderline garbage IMO but at least they offered a different perspective and a free voucher if I failed. I won't buy anything from measureup again
3. read the 650 pg Sybex book pretty much cover to cover and completed each chapter's quizzes online
4. used the practice test book's 2 main practice exams (85 Q each) and scored I think about 88-90% avg between them. I could have kept going but at some point you just memorize the question/answer combo vs really testing your knowledge of the material
5. Total study time was roughly 4 weeks, 5 tops. Probably took 500+ unique practice test questions across all media and, with retakes, I prob answered 1000+ test questions

The TEST:

1. I only had 70 questions but perhaps #2 below influenced that since they had many parts to them that could be construed as individual answers totaling 85 Q
2. The first two questions floored me- they were long scenarios with two parts that were difficult, real-world stuff. The first was 4 web servers each which two NMAP commands run against them and a screen cap of that output was presented. You were required to note if the servers had the minimum required version of apache on them and if they had the min ver of TLS on them. Part 2 of Q1 was open-ended and had 3 dropdowns where you had to recommend remediation steps to bring them into compliance (some items to address beyond what part 1 wanted).
3. The remaining part of the test was a mixture of basic questions and multiple-choice answers like you'd see on a typical practice test and some log review questions that ask to interpret what type of attack or what is required as next steps
4. 2 linux command scenarios and 1 powershell question
5. I had plenty of time for test with about 3hrs given and finished about 2hrs in, taking my time, marked prob 20-25 questions for review. Reviewed those questions and then did a complete pass through the entire exam 1-70. @ 25min remaining ended the exam.

My 2c:
All the test prep material went into a lot of detail on SDLC models and test methods, Sec/Risk frameworks, and asked too many questions that were rote memorization like what step comes after step 3 in this risk model. The Sybex book rightfully has labs and asks you to download and run the tools like nmap, tcpdump, Nikto, etc and the exam had probably 10 examples where they wanted you to read a firewall/SEIM/Router/tcpdump/wireshark logs and interpret it. If you haven't used the tools and become familiar with reading the logs, you probably won't pass.

ISC2 recommends minimum 4 years of hand-on experience prior to taking the test. I tend to agree; it's a very hands-on, technical test that without that level of experience or extensive lab work for those without it, it's unlikely they would pass.

Best of luck to anyone taking it.

On to my CISSP prep!

cyberguypr

Great write-up. Reminds me a have a voucher for this exam and need to take it before end of year.

"ISC2 recommends minimum 4 years"

Not sure CompTIA cares about that

itdept

Yes, nice write-up. You state, it was the hardest IT cert exam you have ever taken. What other certs do you have? How does it compare to Sec+?

yesterdaysthought

cyberguypr said:

Great write-up. Reminds me a have a voucher for this exam and need to take it before end of year.

"ISC2 recommends minimum 4 years"

Not sure CompTIA cares about that

Ha- CISSP is next goal. I was probably looking at my CISSP book while I was typing that!

yesterdaysthought

itdept said:

Yes, nice write-up. You state, it was the hardest IT cert exam you have ever taken. What other certs do you have? How does it compare to Sec+?

Thanks. I didn't take security+ so I can't comment there. 

I have received MS Office 365 Fundamentals, Azure Fundamentals and AWS CCP all in the last 3 months and 2 old MS certs a zillion years ago.

It's not even close- those type of certs you can watch youtube videos, run through paid practice tests a few times and you have enough knowledge to pass. I studied the real material and used the consoles more than that, about 2 weeks per exam, and scored mid-90% and passing was 70%. I could probably have studied harder and did each of them in about 5-7 days.

For the CySA+ I didn't need to do most of the labs since I already had experience as a CSA and knew how to use nmap, netstat, tracert, wireshark, nessus, SEIMs, GPOs, patching, firewalls, etc and it still took me a solid 4+ weeks of study at 4-6 hrs per day taking a few days off. If someone was looking to transition from a desktop support or jr server engineer to CSA and didn't have that much exposure to the tools they'd have to spend a bit of time getting up to speed before taking the test and I wouldn't be surprised if they didn't pass on the first attempt.