CompTIA CySA+

CySA+: Other certifications (Security+, PenTest+, CASP+) [updated 2022]

For anyone looking to become a cybersecurity analyst, CompTIA’s vendor-neutral CySA+ certification offers a pathway to gain the skills and knowledge needed to lead security operations in various enterprises through mastery of analytics, intrusion detection and response. The intermediate/mid-career certification program lasts for three years and validates a person’s competency in using data analysis to identify threats, risks and vulnerabilities, as well as suggest preventative measures that will effectively respond to and help recover from incidents. In addition, the certification holder is also expected to be proficient in configuring and leveraging threat-detection solutions that will secure companies’ applications and systems.

With that said, not everyone looking to break into the cybersecurity field needs to start with CySA+. Depending on your level of experience, you can start with a lower-level certification like Security+, take up an equivalent program like PenTest+ or aim for a higher-level exam like CASP+. Below is a detailed breakdown of each.

Earn your CySA+, guaranteed!

Get hands-on experience and live expert, instruction. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Lower level: Security+

CompTIA introduced this vendor-neutral certification back in 2002 to validate the professionals’ capabilities required to oversee and manage core security tasks involved in the cybersecurity profession. Individuals holding the Security+ certification are expected to have the knowledge and skills required to do the following:

• Assess the security posture of an enterprise environment and recommend and implement appropriate security solutions
• Monitor and secure hybrid environments, including cloud, mobile, and IoT
• Operate with an awareness of applicable laws and policies, including principles of governance, risk, and compliance
• Identify, analyze, and respond to security events and incidents

The exam for this certification comprises 90 multiple-choice and performance-based questions to be answered within 90 minutes. Candidates need to score a minimum of 750 points (on a scale of 100–900) to pass the exam. To be eligible for this test, CompTIA recommends having at least two years of work experience in IT systems administration with a focus on security, hands-on technical information security experience, and broad knowledge of security concepts.

CompTIA does offer first-time exam takers a few suggestions. For example, gaining other core certifications like Network+ before taking the Security+ exam can help candidates master network fundamentals and security concepts that are essential in the profession and can make them more confident in tackling this credential.

Being a lower-level exam than CySA+, Security+ is ideal for individuals who are looking for any entry-level cybersecurity role, explains Patrick Lane, Director of Products at CompTIA, in a podcast about how the certification is evolving.

Intermediate level: PenTest+

CompTIA’s PenTest+ is suitable for those working in a security consultant, penetration tester or network & security specialist job roles and who are tasked with identifying vulnerabilities and remediation techniques across broader surfaces to ensure the resiliency of networks against attacks. The credential verifies their competencies in discovering, managing, reporting and exploiting threats and vulnerabilities.

The updates to PenTest+ implemented at the end of 2021 reflect newer pentesting techniques for the latest attack surfaces, including the cloud, hybrid environments, and web applications, as well as more ethical hacking concepts, vulnerability scanning and code analysis. There’s also more focus on the importance of planning, scoping, and managing weaknesses, not just exploiting them.

CompTIA PenTest+ certification exam will verify successful candidates have the knowledge and skills required to do the following:

• Plan and scope a penetration testing engagement
• Understand legal and compliance requirements
• Perform vulnerability scanning and penetration testing using appropriate tools and
• techniques, and then analyze the results
• Produce a written report containing proposed remediation techniques, effectively
• communicate results to the management team, and provide practical recommendations

The credential is equivalent to CySA+ in the sense that it recommends that candidates have a professional experience in hands-on information security (three to four years for PenTest+), along with a basic level certification like CompTIA Security+ or equivalent experience to meet the requirements.

An area where the two certifications differ is the nature of the exam. PenTest+ is more offensive-focused, while the exam for CySA+ is geared towards preventive and defensive security measures.

PenTest+ is nothing similar to the other penetration testing certifications that a candidate may come across. CompTIA’s PenTest+ covers everything a qualified penetration tester should be skilled at, from all aspects of vulnerability management to project reporting and communication, project planning and scoping.

The exam for PenTest+ comprises 85 performance-based and multiple-choice questions. Candidates need to score 750 points (on a scale of 100-900) within 165 minutes to pass the exam.

Certified pentesters are typically recruited by companies to conduct penetration testing in varying environments such as cloud, desktop, mobile and more. Both the CySA+ and PenTest+ certifications are globally recognized and raise an individual’s prospects of landing a high-paying position in the field of cybersecurity. The best-of-the-breed candidates possess both certifications and, therefore, a complete skill set to protect their employers against cyber threats. A professional able to work as a penetration tester and a cybersecurity analyst can ultimately help firms to identify vulnerabilities in security implementations.

Higher level: CASP+

Cybersecurity professionals with a CySA+ certification can aim for CASP+ (see CySA+ versus CASP+). This is a higher-level certification that is suitable for candidates who have at least ten years of general hands-on IT experience, with at least five years of broad hands-on security experience. The exam for the CASP+ certification ensures candidates will have the knowledge required to do the following: 

• Architect, engineer, integrate, and implement secure solutions across complex environments to support a resilient enterprise
• Use monitoring, detection, incident response, and automation to proactively support ongoing security operations in an enterprise environment
• Apply security practices to cloud, on-premises, endpoint, and mobile infrastructure, while considering cryptographic technologies and techniques
• Consider the impact of governance, risk, and compliance requirements throughout the enterprise

Basically, the certification validates the holder’s ability to lead research and collaboration, risk management, enterprise security operations and architecture, and the implementation of technical security strategies. In addition, candidates also get to apply critical thinking and acumen across a range of disciplines to deploy, recommend and suggest robust information security solutions.

Candidates get a maximum of 90 multiple-choice and performance-based questions, which they need to answer in 165 minutes. This test has no scaled score, and it is pass/fail only.

Because it is a higher-level certification than CySA+, CASP+ also offers access to a number of cybersecurity specialist roles, including security architects and senior security engineers who can effectively design, implement, and manage cybersecurity solutions on complex enterprise networks.

Earn your CySA+, guaranteed!

Get hands-on experience and live expert, instruction. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Conclusion

So, which certification is best for cybersecurity? Well, that depends on your job role, your experience level and your career expectations. CySA+, along with these three certifications, provides IT professionals with an opportunity to advance from entry-level to intermediate-level and higher-level options for your future. The best part is that there are multiple ways candidates can prepare for the exam through education, training and learning options that can cater to any needs. With the right approach, candidates can gain the proficiency and competence they need to excel in the cybersecurity industry, a field that continues to grow.

CompTIA’s State of the Tech Workforce Report provides an up-to-date look at how tech employment is evolving and still providing plenty of opportunities despite a slowing economy and labor market. Companies, however, are careful to recruit IT professionals with certifications that are awarded based on the passage of rigorous, performance-based exams and that can then validate their expertise in an objective way.

 

Sources:

• Career Pathway, CompTIA
• CySA+ certification, CompTIA
• Security+ certification, CompTIA
• PenTest+ certification, CompTIA
• CASP+ certification, CompTIA
• How to Choose: Which Certification is Best for Cybersecurity?, CompTIA