Plan your CompTIA Security+ study and build a safe, isolated home lab for hands-on practice.
Why it matters
Hiring managers for security roles look for two things in a junior candidate: proof of knowledge and proof of practice. Certifications are the usual proof of knowledge. A home lab, with notes and write-ups of what you built and broke, is the proof of practice. This lesson helps you plan both, honestly and on a small budget.
The certification path
Certification details (exam versions, objectives, prices, renewal rules) change regularly. Always check the official sites rather than relying on any summary, including this one.
- CompTIA Security+ is the most common entry-level security certification. It covers threats and vulnerabilities, security architecture, operations, incident response, and governance, risk and compliance: much of what this course introduced. It appears in many junior job postings and in US government and defence contractor role requirements. Official page: comptia.org/certifications/security. Checked on 2026-10-23.
- Network+ is useful if networking still feels shaky, but it is not required before Security+.
- CompTIA CySA+ (cybersecurity analyst) is a common next step for people heading into security operations, covered in the Security Operations & Defense course.
- ISC2 CISSP is a senior certification. It requires about five years of paid security experience (an associate status exists for those who pass without it). Official page: isc2.org. Checked on 2026-10-23.
- Cloud security roles also value vendor cloud certifications (AWS, Azure, Google Cloud) alongside Security+.
Some roles also require a degree or a security clearance. A certification helps you get interviews; it does not replace experience, and employers will ask what you have actually done.
A realistic Security+ study plan
Most people with this course behind them need about 8 to 12 weeks at 5 to 8 hours a week. A plan that works:
- Download the official exam objectives from CompTIA. This is your checklist; every topic on the exam is listed there.
- Pick one main course (a video series such as Professor Messer's free course, or a book) and one source of practice questions.
- Weekly rhythm: study one or two objective domains, take notes in your own words, and do a short lab for each topic where possible.
- Track weak areas in a simple spreadsheet: objective, confidence 1 to 5, notes. Revisit anything below 3.
- Practice exams in the last 2 to 3 weeks. Review every wrong answer and why the right answer is right.
- Book the exam when you consistently score well above the passing level on practice tests from more than one source.
Beware of "brain dump" sites that sell real exam questions: using them breaks the certification agreement and can get your certification revoked.
Building a safe home lab
A home lab is a small, isolated environment where you are allowed to break things. You do not need expensive hardware: a laptop with 16 GB of RAM can run two or three small virtual machines.
A good beginner lab:
- Hypervisor: VirtualBox (Windows, Linux, Intel Macs) or UTM (Apple silicon Macs).
- Network: a host-only or internal network in the hypervisor, so lab VMs can talk to each other but not to your home network or the internet. Only connect a VM to the internet when you need to download updates, and never expose deliberately vulnerable machines to the internet.
- Machines:
- A Linux VM you administer (you built one in Linux Administration).
- A deliberately vulnerable practice app, such as OWASP Juice Shop or DVWA, on the isolated network only.
- Optionally, a security-tools VM (for example Kali Linux) to attack the practice app, and a log collector such as a free SIEM to watch the attacks from the defender's side.
- Snapshots: take one before every experiment so you can roll back.
Free online platforms are a legal complement to your lab: TryHackMe, Hack The Box, PortSwigger Web Security Academy, OverTheWire and picoCTF all provide targets you are explicitly allowed to attack, within their rules.
The rules from the previous lesson apply: attack only machines in your lab or on platforms that authorise it. Never point lab tools at your school, employer, ISP or neighbours.
Make your practice visible
Keep a lab notebook or a public repository with short write-ups: what you set up, what you tried, what you saw in the logs, and how you would defend against it. Defender-focused write-ups ("here is what the attack looked like in the logs and the alert I wrote") stand out to employers. Never publish secrets, real company data, or write-ups of retired platform machines in ways their rules forbid.
Common mistakes
- Collecting certifications without practice. Interviews quickly reveal whether you have done the work.
- Bridged networking for vulnerable VMs. That puts an intentionally broken machine on your home network. Use host-only or internal networks.
- Studying without the objectives. You will over-study some topics and miss others.
- Waiting until you feel "ready" to apply. Apply for help desk, junior SOC and IT roles while you study; they are common entry points.
Quick recap
- Security+ is the usual first security certification; CySA+ and cloud certifications follow; CISSP needs years of experience. Check official sites for current details.
- Study from the official objectives with one main course and practice questions, over roughly 8 to 12 weeks.
- Build an isolated lab with a hypervisor, host-only networking, snapshots and deliberately vulnerable apps.
- Practise only on your lab and authorised platforms, and write up what you learn.
Try it
Open the Do tab to write your study plan and set up your lab.