HackBlue

Tools · Workbench

Security certification study guides

Study plans and concept guides for Security+, CySA+, eJPT, PNPT, OSCP, CISSP, and other common security certifications.

  • 18 lessons
  • 2.5 h of reading
  • 4 topics
Start with lesson 1All workbenches

A certification is a structured reason to learn a body of material and a signal to employers that you did. These guides explain what each exam measures, how the domains fit together, and how to build a study plan around hands-on labs instead of memorized trivia.

Exam objectives change. Always check the vendor’s current objectives document before you plan your study.

Planning

5 lessons

  1. 01Choosing a security certification path that matches the job you wantMap certifications to roles such as SOC analyst, penetration tester, cloud security engineer, and security manager, and decide what to take first based on job postings rather than hype.8 min
  2. 02Turning an exam objectives document into a weekly study planBreak the official objectives into tracked items, rate your confidence, weight study time by domain percentage and weakness, and schedule review and practice exams.8 min
  3. 03A home lab for certification study: virtual machines, networks, and snapshotsBuild an isolated lab with a hypervisor, an internal network, a Windows domain, Linux hosts, and a logging stack, so every exam objective has a hands-on exercise.9 min
  4. 04Exam integrity: why brain dumps hurt you and how to judge study resourcesUnderstand certification agreements that prohibit sharing exam content, the consequences of using dumps, and how to spot legitimate practice materials.6 min
  5. 05Keeping certifications active: continuing education credits and renewalUnderstand renewal cycles and continuing education requirements, track qualifying activities as you do them, and use renewal as a reason to keep learning.6 min

Exam technique

4 lessons

  1. 01Active recall and spaced repetition for security conceptsReplace rereading with self-testing, build good flashcards for ports, protocols, and frameworks, and use Anki scheduling so review time goes to what you are about to forget.7 min
  2. 02Preparing for performance-based and simulation questionsKnow what simulation questions look like, practice the underlying tasks in a lab, and manage time by flagging them and returning after multiple-choice items.8 min
  3. 03A note-taking system for practical, hands-on examsOrganize methodology checklists, command references, and per-host notes in tools such as Obsidian or CherryTree, and capture evidence during practice so reporting is fast.8 min
  4. 04Exam day strategy: logistics, pacing, and handling hard questionsPrepare logistics for testing centers and online proctoring, set pace checkpoints, eliminate wrong answers systematically, and manage breaks and stress in long practical exams.7 min

Foundational certifications

2 lessons

  1. 01CompTIA Security+: what it covers and an eight-week study planUnderstand the Security+ domains, the mix of multiple-choice and performance-based questions, and a lab-backed weekly plan built from the official objectives.9 min
  2. 02Security+ concept drills: control types, ports, and choosing the right cryptographyDrill the concept families that appear across Security+ questions: control categories and types, common ports, and which cryptographic primitive fits which requirement.8 min

Practitioner certifications

7 lessons

  1. 01CompTIA CySA+: preparing for analyst-level log, vulnerability, and incident questionsPrepare for CySA+ by practicing security operations, vulnerability management, incident response, and reporting tasks with real logs, scan output, and timelines.9 min
  2. 02Preparing for the eJPT: a first practical penetration testing examUnderstand the eJPT’s open-book lab format, the skills it checks across host discovery, enumeration, web basics, and pivoting, and how to practice them legally.8 min
  3. 03Preparing for the PNPT: internal network assessment, reporting, and the debriefPrepare for TCM Security’s PNPT, which combines external and internal network assessment including Active Directory with a professional report and a live debrief.9 min
  4. 04OSCP preparation: methodology, lab practice, and time managementPrepare for OffSec’s OSCP with a repeatable methodology, broad practice on legal lab machines including Active Directory, disciplined time boxes, and evidence capture for the report.10 min
  5. 05CISSP: the eight domains and the risk-management mindset the exam expectsUnderstand ISC2’s CISSP domains, the experience requirement, the adaptive exam format, and why answers favor risk management, governance, and protecting people first.9 min
  6. 06Cloud security certifications: AWS, Azure, Google Cloud, and vendor-neutral optionsCompare provider security certifications and vendor-neutral options, the hands-on skills each expects, and how to practice them with free tiers and budget alerts.8 min
  7. 07Practical blue team certifications: preparing for hands-on investigation examsPrepare for practical defensive exams that ask you to investigate incidents with SIEM, packet, endpoint, and email evidence, and build the habits they test.8 min