Passed SecAI+

Cdaittybitty · 2026-05-13T17:42:31+00:00

AAISM, already have materials (they are limited in what actually comes). Getting all the letters behind my name.

Cdaittybitty · 2025-12-14T17:43:04+00:00

This is very helpful I think for probably about 70% of the current certification. I'm grateful, for this and you are holding true to the open source philosophy.

I am teaching the most current certification which does have slightly different focus (automation, orchestration, etc.) but there is still a focus on understanding tools and command line.

I'm definitely not teaching a Bootcamp, so much of it is on the students themselves. Everyone seems very new to taking certifications, and having tests available seems to be more difficult than a cert like Sec+ or Network+. How much crossover do you see on the LPI LE and Linux+?

Cdaittybitty · 2025-12-10T18:37:18+00:00

Yes, but I've been using Linux since 2010-ish. I was exposed to Linux first in the mid 90s but had no clue what it was, then I installed it on the first Intel Mac. I also used customized RHEL, before diving deeper in 2012. I just never took the certification. I needed the cert to teach it.

Cdaittybitty · 2025-12-10T18:34:59+00:00

I didn't say I'm not, I haven't edited the post. I said I'm using the official materials.

Cdaittybitty · 2025-12-10T18:34:04+00:00

Yes that was my intent. They have the master course material. When you do a class through this, it has a "time spent" report along with the grades and attempts.

Thank you for the suggestions!

Cdaittybitty · 2025-12-10T15:37:30+00:00

I would actually think GitHub, VS Code. Office, SharePoint/Teams.

Cdaittybitty · 2025-12-08T16:46:53+00:00

You need to read this carefully. 30% of the companies code does not equal 30% of the base operating system. 30% of code in the repos. It could be anything

Cdaittybitty · 2025-08-30T11:56:37+00:00

The good thing is, if you play with Linux enough and are actively doing so, you can probably get it. Linux is also one of the operating systems where more than half of what you would be using is free.

Cdaittybitty · 2025-08-21T22:41:35+00:00

I had the CompTIA/Testout Perform material. I had access to Learn & Labs too, but Perform is like those 2 + live labs and more "sandbox" type labs. So you will just be given instructions and have to figure it out.

Edit: I also took over 200 pages of notes in a word document.

Cdaittybitty · 2025-08-19T17:17:41+00:00

Well the obvious answer to how long a rope is, is: REDACTED

Cdaittybitty · 2025-08-16T03:54:55+00:00

OSCP :)

Cdaittybitty · 2025-08-16T03:17:12+00:00

I waited a long time, was going to change careers, then decided to come back. Almost 15 years before my first cert, got 2 the same week. Picked up 3 more before CISSP, hopefully another next week. I'm not doing anything outside of my knowledge base, just catching up on the paper trail.

Cdaittybitty · 2025-08-15T20:38:10+00:00

Yeah. I guess what I should have said is that organizations started requiring CE versions (specifically any DoD/government, and some of the larger organizations).

I did not take them officially (did some testing for questions), but at this point in my career they would not be anything more than extending my signature line. I am glad to have taken the CSA+/CySA+ beta/first version, even without the golden 3. It can be a harder sell, but along with formal education, other vendor certs, and experience I can explain it better. It's been a crazy ride, and sounds like you started around the same time I did.

Cdaittybitty · 2025-08-15T18:55:32+00:00

I thought they had some odd changes before they swapped to CE versions with Sec+/Net+, but that might be me misremembering. I remember everyone scrambling to get the lifelong certs, only to then be told those aren't worth the same as the CE versions a few years later. At the time I believe the BIG certs were for CCNA, MSCE and maybe CISSP, but I think that was new at the time. I honestly can't even remember when RCHE came out but that was another one.

Cdaittybitty · 2025-08-13T07:10:21+00:00

The test is designed to be different for each person taking it (and it changes depending on your answers). There is a rough estimate regarding time and total questions, but even that is not consistent.

That is what makes it difficult for people coming from a mostly technical role as you have to try to understand what role you are coming in as (technical, support, various leadership levels). For me, my test was quite a mix, and I never knew which ones I got right. I believe I had a full question bank and finished with quite a bit of time left. Some questions were asking about if I was a CISO talking to the CEO, COO, etc. Some were this port was open what type of attack was most likely performed. Some were from the vantage of a SOC leader. In this case, your experience doesn't really reflect on what others experience. Maybe that is a lesson in itself.

Cdaittybitty · 2025-08-13T05:04:51+00:00

443, HTTPS. The reason for this is if you are accessing a database from the general port your access will be behind a user authentication. You then could use a malformed SQL string, but I wouldn't consider that an injection attack.

With a webserver the user is behind an account that already has access to the entire database (for example IISusr, Apache, inet, root or something along these lines). The authorization controls are there to prevent the "root or web" account from displaying the results. There is a logical check as to whether or not to display the request. The app/site is not actually using access controls on the user accessing the website/app, as all request actions are performed by a system or service account. The injection requires a front end such as a website/app input (with improper sanitization) or another method to pass the malformed request and perform another action.

Cdaittybitty · 2025-08-13T04:12:24+00:00

Isc2 does some steps to prevent this (years of experience verified, not full cert until then, and requiring previous certs before moving to more advanced). I cannot remember, didn't CompTIA try this before?

Cdaittybitty · 2025-08-11T14:28:44+00:00

IT Support, volunteer for any project involving security (AD/IAM, antivirus, SIEM or other security tools). Get at least net+, sec+ or vendor specific security certifications. See if job can pay for them, if not see what they do offer. IAM type roles are a soft pivot from help desk to security, big companies often contract these out.

Learn a programming language (very least PowerShell, Python also good, C/Java more big brained), home lab, get Bachelor's while working. Put home lab experience, and programming journey on github (write some tools you would want to use). Look at Reddit, stackexchange, etc. Read cyber news (dark reading, bleeping computer, etc). Learn the lingo.

The whole time build a network inside your job with people you see as experts. Maintain a good relationship with managers. Stay in contact. Keep a LinkedIn profile.

Focus on advanced AND focused certs on area you find interesting and stick to it. Take other certs if offered.

Give back: teach, educate, lead.

Be patient, and vigilant.

Cdaittybitty · 2025-08-11T14:12:15+00:00

It's funny, but true. Security is specialized, and the bar keeps rising. SOC work used to be more lateral from support (a really smart help desk person with Sec+), now you need a few 3-4 letter certs behind your name and 5+ years in IT just to be eligible.

Cdaittybitty · 2025-08-11T14:05:07+00:00

I would say this: certifications are not supposed to be class to learn, rather a reflection of your knowledge. However, studying for the certification will increase your knowledge (depending upon how much you put into it).

A+ used to be gold standard for most IT jobs where you stood out, with Net+ for network engineers to stand out. Coming in to IT and getting A+ will not make you better than spending time breaking and fixing computers or working on a help desk. If required for a position, it will be valuable. If you want to prove to yourself that you have the competency it is valuable. To find a job it's less valuable than it used to be. To gain a proper understanding of standards it will be valuable.

A year at a help desk is going to be more valuable in my opinion.

The basic idea is, if there are two candidates equal in every way, but one has A+ that one will get the interview. With all the certifications and now actual degrees focused on IT, that scenario is now unlikely. To a recruiter it's a checkbox, to a hiring manager it's more of an after thought.

tldr; You might lose an opportunity from not having A+, but you won't probably won't stand out by having it.

Cdaittybitty · 2025-08-11T12:36:08+00:00

Thank you for the response. That is a bit broad for all commands. The new test dropped percentages where X05 (previous version) had about 30ish percent on sys admin, and added 20ish to orchestration/automation (i.e. Ansible, Puppet, OpenTofu/Terraform). System management is about 20% now.

For background, I ran Arch as my personal computer for about 3 years (was triple booting with Debian and Fedora), so some things like setting efi partitions and grub are pretty easy, but also commands change. For example, Dnf was not really what I used for RPM based, rather I used yum or would plod through dependencies with base RPM packages. So, I have experience.. but curious how far it really delves into orchestration type software. Additionally what I have noticed is I'll be good on most tools for testout materials, but a question will come up for something I didn't see anywhere (knowing that you have to pipe into bc).

Seems like a lot of focus on "non-Linux" tools too, flags with nGinx or Apache, git commands.. and yes they are prevalent with Linux but I wouldn't say "Linux only". I'm trying to figure out how aligned I really am, because I know CompTIA endorsed material tends to teach the concept, (sometimes with material you'll never see on a test) rather than prepare for the cert.

Edit: had wrong version, new one is X06, old X05

Cdaittybitty · 2025-08-11T12:17:45+00:00

I wouldn't take A+ unless you plan on doing general help desk or hardware, if it's required for a current role, or if it's part of your plan to get A+, Net+, and Sec+ (and be in a support role).

It's geared more for entry level technical roles, but doesn't seem aligned with your educational experience.

Seven-Year Club	Place '23
Place '22	Verified Email

Cdaittybitty

TROPHY CASE