The IT Certification Megathread: Straight Outta CompTIA

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The IT Certification Megathread: Straight Outta CompTIA

«‹›10 »

psydude: Apr 1, 2008

What you don't want to be is the guy with a Sec+ and a degree in Cyber Security from ITT Tech sending a pissy email and holding up an ATO because the exec-timeout 10 command isn't entered into the switch or router.

exec-timeout 10 is the default value and won't show up unless you do a show run all

# ¿ Dec 15, 2016 16:06

Adbot: ADBOT LOVES YOU

# ¿ May 16, 2024 12:57

psydude: Apr 1, 2008

I always recommend people take it in two parts unless they're already very comfortable with the material. If you're completely new to networking, tackling the entire CCNA at once can be a bit intimidating and demoralizing.

# ¿ Dec 24, 2016 16:59

psydude: Apr 1, 2008

Taking TSHOOT tomorrow to re-cert my CCNP. Haven't studied at all; let's hope continuous hands-on practical experience for the past two years is sufficient.

# ¿ Jan 5, 2017 04:50

psydude: Apr 1, 2008

New TSHOOT is pretty easy. Basically the same as the previous version, but they removed the ability to switch between tickets to see what changed in the config and added a few more IPv6 related questions.

# ¿ Jan 6, 2017 05:09

psydude: Apr 1, 2008

Martytoof posted:

CISSP:

I don't think anyone really knows ISC2's criteria for auditing a candidate's prior experience. If you have the five years in two or more of the eight domains then you have the five years and it's not going to be an issue either way. When you fill out the form you need to describe your job duties in "detail". I just copied and pasted from my resume, as did my friend who was just certified. I'm just going to guess that as long as you're thorough and appease the human on the other end of the screen that you've worked with two of the eight domains then it won't be an issue. If you do and they don't believe you, the most that would likely happen is that then they would call your references for verification, delaying your actual endorsement. And speaking of endorsement, unless you want to jump through a bunch of hoops like sending company letterheads or employment letters to ISC2 directly, find an existing CISSP to stamp your endorsement. I'm probably one week out from having my CISSP verified (judging by my buddy who took the test a two weeks before me having just received his) and I didn't have to do anything except fill out the online form. I suppose if they come back next week and tell me I'm being audited I'll have to do more work but, knock on wood, that shouldn't happen.

My study time was atypical as I ran through a good week long bootcamp and sat the exam the following Monday. To be honest I didn't do that much studying either. I read the 11th Hour CISSP book cover to cover and went through my notes a few times that weekend but other than that there wasn't much. I didn't read the complete CBK book -- I don't think I even opened it past halfway to be perfectly frank.

Someone who didn't bootcamp it can probably step in an explain better but if you were truly learning the CBK instead of learning to the test as our bootcamp did I would suggest that this isn't a two week thing even if you are going 24/7. The CBK is /beyond/ dry material. I would give myself five to six months if I were coming in completely fresh with an infosec background. Maybe more. This stuff is really dumb.

CCNA:

When I took the exam three years ago, you could pass CCENT/ICND2 using just Cisco's lovely flash simulator. It's not extremely deep. That said, you can very very very easily set up a GNS3 virtual lab that will get you 99% of the way there. If you really need a hardware switching setup you can find old 2924s for literally pennies and hook those together.

I haven't kept up with CCNA at ALL so I'm not sure what changed, but I wouldn't study with old material.

If you have no prior experience with networking then CCNA in a month might be a stretch too, but not impossible. It's certainly much more doable in a month than CISSP which I think is completely unreasonable unless you've got someone paying for a 4k bootcamp. I renewed my CCNA by sitting the full exam three years ago and I did that on maybe a week's worth of studying. When I sat it first six years ago I think I probably put in a good two months. I could have done it in a month but I wasn't nearly as dedicated.

If you work in security, the various CISSP self study books (especially the Conrad book) are more than enough to pass. I thought it was a fairly easy exam so long as you follow the order of operation of the ISC2 when it comes to answering questions.

I still haven't put it in my email signature because I'm not a pretentious dick, but every time I come across an uppity GS-X or contractor who tries to give me poo poo for some minor CIS or STIG technicality on a high level design it makes me reconsider it.

# ¿ Jan 7, 2017 06:46

psydude: Apr 1, 2008

Be familiar with everything in the official study guide, but know everything in the 11th Hour book.

# ¿ Jan 10, 2017 22:22

psydude: Apr 1, 2008

DEA posted:

Which is the best & most advanced certification? Which one will impress a potential employer the most?

Trick question. Smugly announce that you don't need certifications and then complain in this forum about how you can't find a job.

# ¿ Jan 13, 2017 15:54

psydude: Apr 1, 2008

Mine took around a month.

# ¿ Jan 17, 2017 18:45

psydude: Apr 1, 2008

Codecademy has a quick intro course that's pretty good.

# ¿ Feb 28, 2017 04:02

psydude: Apr 1, 2008

Kashuno posted:

I've been really slacking on certs since I've been learning a lot on the job, but I scheduled my Sec+ exam for tomorrow. I know all the content without much issue, but my only question is what in the world can they give you for performance based questions? It's so much rote memorization that outside of something basic like a firewall rule or something I really can't see how that will work. Anybody have some insight?

Your performance based on rote memorization.

# ¿ Feb 28, 2017 14:37

psydude: Apr 1, 2008

Doug posted:

I'd say so. If you're not planning to go into networking pretty hard or have dreams of CCNP R&S, I'd say taking a CCNA specialization is a better choice. Since it's new, it might not get you the same HR traction, but from reviewing the exam topics it looks like a pretty solid security cert to have. If they do proper marketing I could see that showing up on a lot of job reqs.

I'm skeptical of it, since enterprise cybersecurity operations is focused on methods and tools that fall entirely outside of Cisco's wheelhouse.

If you want to go into security operations (incident response, forensics, etc), I'd recommend maybe getting a CCNA Security and then focusing on the OSCP or some of the SANS stuff.

# ¿ Mar 2, 2017 14:39

psydude: Apr 1, 2008

Doug posted:

That's really just not true. Cisco now owns Sourcefire which is an IDS/IPS with a huge market share. They also offer AMP which is a pretty solid offering in A/V and endpoint security. Any of the new ASAs with NGFW capabilities would certainly be utilized during SecOps.. The exam also touches on NIST Incident Handling and VERIS incident classification.

Without fail, these devices always fall under the jurisdiction of the security engineering team, not the security operations team. There's overlap in some organizations, but not all (and especially not in organizations big enough to have a dedicated incident handler taskforce). ASAs are going end of life, and are almost always under the purview of separate firewall teams. What limited "NGFW" capabilities hey have are relegated to the FirePOWER services modules, which are going to be replaced by the FTD unified code image within the next 12 months.

The cyber operations exam doesn't focus on those devices, anyway. It's basically a CISSP-light.

quote:

The CCNA Security is focused almost solely on security architecture, which while important really isn't going to do you much good if you're in a SecOps/SOC role.

You just mentioned Sourcefire, AMP, and ASA as cornerstones of the market while simultaneously saying that the very exam that focuses on those devices (CCNA security) isn't worth taking if you're in a SOC role. I'm not trying to be a dick with arguing semantics, but I hope you realize the contradictory nature of your statement.

quote:

Also, recommending someone interested in SecOps/SOC stuff to take the OSCP is entirely misguided.

You're saying that a practical understanding of how attackers gain entry to a network is misguided for someone wishing to work in the security field?

psydude fucked around with this message at 05:06 on Mar 3, 2017

# ¿ Mar 3, 2017 05:02

psydude: Apr 1, 2008

CEH is like OSCP-lite with a bunch of Sec+ stuff thrown in.

# ¿ Mar 7, 2017 03:56

psydude: Apr 1, 2008

Tiny posted:

Agree. CEH only proves that you have heard of a thing and can talk about it. OSCP proves that you can do a thing, and have done it.

Yeah basically.

I don't think CEH is worth it unless you're being required to get it for a current position or your employer/school is paying for it. Security+ will do the same thing for you.

# ¿ Mar 9, 2017 04:23

psydude: Apr 1, 2008

Did they fix the CCNA: Security? I signed up today to take it tomorrow because I have to get the NP in Security. Last time I took the NA exam the ASDM sim was broken.

It's really dumb they won't let you take a NP exam if you already have another NP unless you have the pipeline NA as well.

# ¿ May 10, 2017 19:23

psydude: Apr 1, 2008

Solaron posted:

I hadn't even looked at the BS - I'd assumed the certs and skills would be similar. That's a significant difference, and I definitely agree that the certs are a lot more inline with what I'm looking for. I'm fairly certain I can get work to foot the bill for a second BS since it's directly related to my job title.

What has your experience been with WGU? And the training/education is quality?

I'm married, have a house full of kids (bio and foster) and a full-time job so I want to make sure I wouldn't drown under the workload or something. My last experience with college was a while ago now and WGU seems to have a different setup.

As a counterpoint, a lot of brick and mortar universities offer online degrees now that are more loosely structured and allow a bit more flexibility for working professionals.

Re: Networking jobs:

It's pretty much impossible to find people to fill SDN consulting positions. It's three times as impossible to find security engineer consultants. $180-200k with additional compensation for mid-senior to senior level people is becoming pretty common; add more if you've got a CCIE or some other interesting stuff that sets you apart.

psydude fucked around with this message at 21:00 on May 17, 2017

# ¿ May 17, 2017 20:51

psydude: Apr 1, 2008

Judge Schnoopy posted:

Counterpoint to that, wgu is commonly less than half the cost of brick and mortar online degrees.

Correct. I think WGU is a great option for people pursuing a first undergrad degree since it's regionally accredited and is non-profit. With a master's the question becomes:

1) What am I trying to get out of it?
2) What do I want to do with it?

I'm not trying to knock WGU, but let's be real: seeing a master's from the University of Michigan or Penn State is going to raise a hiring manager's eyebrows a lot more than WGU.

# ¿ May 17, 2017 21:06

Adbot: ADBOT LOVES YOU

# ¿ May 16, 2024 12:57

psydude: Apr 1, 2008

Hey folks - I received a request to update the OP with more current information, since a lot of this is out of date. I moved into ~management~ about 4 years ago and haven't been as focused on certs (other than some cloud-based stuff I'm currently working on), so I'd appreciate it if the community could provide the latest and greatest. Feel free to PM me and I'll update each section accordingly.

# ¿ Apr 27, 2022 08:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The IT Certification Megathread: Straight Outta CompTIA

«‹›10 »