Tags: Cyber Security Awareness Month, instructing the instructors, webinar
Are you a CompTIA instructor? Are you aware of CompTIA’s ongoing webinar series that discusses current and changing IT trends? As Cyber Security Awareness month draws to a close, CompTIA will offer instructors a FREE interactive webinar highlighting security frameworks, with a panel of expert speakers available to answer questions.
As October Cyber Security Awareness month draws to a close join CompTIA’s James Stanger, Patrick Lane, and Stephen Schneiter as they take a look at current IT security trends and why it is important for IT professionals to understand and interpret information from data analytics. The session will define and discuss the growing importance of implementing security frameworks to protect information. Instructors will have the opportunity to ask questions to the panel about security trends and delivering this knowledge to students in our classrooms.
The webinar runs on October 29, 2015 at 1030am CT / 1130am ET / 330pm GMT. To register, click here: https://www.comptia.org/events/webinars/registration?eventid=ce102915
This webinar series is for instructors who teach CompTIA certification courses and are members of the CompTIA Instructor Network.
Tags: casp, exam expirations, Security+
Winter holidays are crunch time for many folks. Certification test-takers are no exception, as vendors typically choose the end of the calendar year to retire exams. Those seeking to earn (or renew) their Security+ have until December 31, 2014 to take the older edition of the exam, SY0-301 / JK0-018.
When the newer edition of this exam, SY0-401, was released earlier this year, Robin Abernathy blogged extensively about the changes to the objectives, topic weighting, and method of item delivery, and how these changes would affect your plan of study. If you’re on the fence about whether to knock out the 301 or wait a little longer to sit the 401, her posts may give you the information you need to make that decision:
- Part One: Depth of topic coverage and item types
- Part Two: Changes to topics in domains 1, 2, and 3
- Part Three: Changes to domains 4, 5, and 6, plus new acronyms
You can still purchase the Transcender practice exam for Cert-SY0-301.
On an additional note, CompTIA has announced they will release an updated CASP certification exam, CAS-002, launching on January 20, 2015. The new exam will repleace CAS-001, which will retire in May 2015.
Tags: casp, CompTIA, Performance-Based Testing, Security+
It’s getting close to that time of year again, folks. The CompTIA Academy Educator Conference will be held on August 1-3 in beautiful Phoenix, Arizona. (Now, I’m just taking everyone else’s word on the beautiful part. This will be my first visit there! But the pictures I’ve seen are lovely.)
This three-day event is well worth your time if you are an educator at any level (high school, college, professional) and you instruct individuals who are seeking CompTIA certifications. As a peer-to-peer networking resource, it’s beyond compare. You also get to rub elbows with some great folks – ehem – ME! Also, you don’t have to be a CompTIA Academy educator to attend. However, the sessions are designed to benefit Academy Partners. If your organization is not an Academy Partner, visit this site to learn how (and why) to become one: http://partners.comptia.org/Academy-Partner.aspx.
With the recent release of a new Security+ exam and the new CASP and Network+ exams due to be released in the coming months, it’s a great idea to attend this conference just to stay on top of things. My presentation on Friday will cover the new Security+ exam, the CASP exam, some techniques for covering the new performance-based items in your classroom. I will also share some information about braindumps/piracy and why you should never use this type of content in your classroom. You can see the full schedule here: http://www2.comptia.org/events/events/academy-educator-conference/agenda.aspx
For all conference related information, including the agenda, registration information, exhibitor information, and hotel information, visit the CompTIA Academy Educator Conference page. If you register before July 31st, you pay $199 instead of $399 at the event. Believe me when I say that this will be the best $199 you will spend.
I would LOVE to see you there!
Tags: CompTIA, Security+
In my first post, I covered the overall changes from SY0-301 to SY0-401. I described how the exam is moving from “tell” to “show and tell,” with more emphasis on applying your knowledge to scenarios than simply answering fact-based questions.
In my second post, I went into detailed changes in the first three domains. This post will wrap up the topic-level changes that will affect those who previously studied for the SY0-301, as well as those who are approaching the Security+ exam for the first time. I’ll also cover the alphabet soup of new acronyms added to the list of “terms you should be familiar with.” Hang on to your hats!
Domain 4: Application, Data and Host Security Changes
Domain 4.1 is “Explain the importance of application security controls and techniques.” There are two new topics for this domain: NoSQL databases vs. SQL databases, and Server-side vs. Client-side validation.
In SY0-301, mobile devices were covered as a subdomain of Domain 4.2, “Carry out appropriate procedures to establish host security.” The 2014 test makes mobile devices the sole topic of Domain 4.2, which is now called “Summarize mobile security concepts and technologies.” This domain covers these topics, all of which are new to the Security+ exam (with the exception of GPS):
- Device security
- Full device encryption
- Remote wiping
- GPS (included in 4.2 in SY0-301)
- Application control
- Storage segmentation
- Asset tracking
- Inventory control
- Mobile device management
- Device access control
- Removable storage
- Disabling unused features
- Application security
- Key management
- Credential management
- Application whitelisting
- Transitive trust/authentication
- BYOD concerns
- Data ownership
- Support ownership
- Patch management
- Antivirus management
- Adherence to corporate policies
- User acceptance
- Architecture/infrastructure considerations
- Legal concerns
- Acceptable use policy
- On-board camera/video
The non-mobile device topics from the old Domain 4.2 are now in the new Domain 4.3, which states “Given a scenario, select the appropriate solution to establish host security.” There are a few new topics in this domain: OS hardening, white listing vs. black listing applications, trusted OS, host-based intrusion detection, and virtualization subtopics (including snapshots, patch compatibility, host availability/elasticity, security control testing, and sandboxing).
Domain 4.4 now states “Implement the appropriate controls to ensure data security” where this SY0-301 domain (which was 4.3) merely asked you to explain concepts in data security importance. The new topics in this domain are cloud storage, SAN, Handling Big Data, data in-transit/data at-rest/data in-use, permissions/ACL, and data policies (including wiping, disposing, retention, and storage).
Domain 4.5 is another new domain, called “Compare and contrast alternative methods to mitigate security risks in static environments” (aka “Did someone hack your refrigerator?”). The topics are divided into Environments and Methods, with the following subtopics:
- Embedded (Printer, Smart TV, HVAC control)
- Android and iOS
- Game consoles
- In-vehicle computing systems
- Network segmentation
- Security layers
- Application firewalls
- Manual updates
- Firmware version control
- Control redundancy and diversity
Domain 5: Access Control and Identity Management Changes
Domain 5.1 now states “Compare and contrast the function and purpose of authentication services” where the SY0-301 domain was about explaining this information. There are only two new topics here: SAML and Secure LDAP.
Domain 5.2 now states “Given a scenario, select the appropriate authentication, authorization or access control,” where the SY0-301 domain asked you to simply explain these concepts. Many of the topics have changed their wording, but are essentially the same concept. The only new topics in this category are authentication (TOTP, HOTP, CHAP, PAP), federation, and transitive trust/authentication.
Domain 5.3 now states “Install and configure security controls when performing account management, based on best practices.” The new topics included in this domain are as follows:
- Account policy enforcement (credential management; Group policy; password history, reuse, and length; and generic account prohibition)
- User access reviews
- Continuous monitoring
Domain 6: Cryptography Changes
Domain 6.1 now states “Given a scenario, utilize general cryptography concepts” where the SY0-301 domain asked you to summarize these concepts, so this is another domain that will now involved scenario-based questions. This domain has four new topics: session keys, in-band vs. out-of-band key exchange, ephemeral key, and perfect forward secrecy.
Domain 6.2 now states “Given a scenario, use appropriate cryptographic methods,” where this SY0-301 domain did NOT mention scenarios. The new topics for this domain are Diffie-Hellman, DHE, ECDHE, cipher suites (specifically strong vs. weak ciphers), and key stretching (PBKDF2, Bcrypt).
Domain 6.3 now states “Given a scenario, use appropriate PKI, certificate management and associated components” and is the result of combining Domains 6.3 and 6.4 from SY0-301 and adding the scenario stipulation. This domain has added topic coverage for certificate authorities and digital certificates, including OCSP and CSR.
Alphabet Soup: Acronyms to Know and Love
The Security+ exam objectives also include a list of acronyms. While I don’t advocate trying to memorize the entire list, it’s good to skim it and read up on terms you’re not familiar with. You may know that concept in practice, but not by the specific name it’s called on the Security+ exam. Or it may be a concept so familiar that it never occurred to you to make an acronym of it (such as TOTP – Top of the Page ).
There are seventy new acronyms on the list (and only one removed – they no longer ask you to remember BOTS as Network Robots). I repeat, don’t panic: many of the new additions to the acronym list were already included as subtopics or topics on SY0-301. Also, the majority of these terms are familiar to anyone who does any kind of work in computers.
The completely new concepts are:
API – Application Programming Interface
ASP – Application Service Provider
BAC – Business Availability Center
BIA- Business Impact Analysis
BPA – Business Partners Agreement
BYOD – Bring Your Own Device
CAPTCHA- Completely Automated Public Turning Test to Tell Computers and Humans Apart
CIO– Chief Information Officer
COOP – Continuity of Operation Planning
CP – Contingency Planning (included as “IT contingency planning” in Domain 2.5 in SY0-301)
CSR – Control Status Register
CSU – Channel Service Unit
CTO- Chief Technology Officer
DHE – Data-Handling Electronics
DNAT – Destination Network Address Transaction
DSL – Digital Subscriber line
DSU – Data Service Unit
ECDHE – Elliptic Curve Diffie-Hellman Key Exchange
ESN- Electronic Serial Number
GPO – Group Policy Object
HOTP – HMAC based One Time Password
HTML – HyperText Markup Language
IRP – Incident Response Procedure
ISA – Interconnection Security Agreement
ISSO- Information Systems Security Officer
ITCP – IT Contingency Plan (included as “IT contingency planning” in Domain 2.5 in SY0-301)
LAN – Local Area Network (was LANMAN, Local Area Network Manager, in SY0-301)
MaaS- Monitoring as a Service
MOU – Memorandum of Understanding
MPLS – Multi-Protocol Layer Switch
MTBF – Mean Time Between Failures (a topic in 2.7 in SY0-301)
MTTR – Mean Time to Recover (a topic in 2.7 in SY0-301)
MTTF – Mean Time to Failure (a topic in 2.7 in SY0-301)
NDA – Non-Disclosure Agreement
OCSP – Online Certificate Status Protocol
OLA – Open License Agreement
P2P – Peer to Peer
PAM – Pluggable Authentication Modules
PBKDF2 – Password Based Key Derivation Function 2
PCAP – Packet Capture
PIV – Personal Identity Verification
ROI – Return of Investment
RPO – Recovery Point Objective
SAML – Security Assertions Markup Language
SAN – Storage Area Network
SCADA – System Control and Data Acquisition
SCEP- Simple Certificate Enrollment Protocol
SEH – Structured Exception Handler
SIEM – Security Information and Event Management
SOAP – Simple Object Access Point
SQL – Structured Query Language
SSD – Solid State Drive
TOTP – Top of the Page
TSIG – Transaction Signature
UEFI – Unified Extensible Firmware Interface
UDP- User Datagram Protocol
URI- Uniform Resource Identifier
UTM- Unified Threat Management
VDI – Virtualization Desktop Infrastructure
WPS – WiFi Protected Setup
WTLS – Wireless TLS
XML – Extensible Markup Language
That’s all, folks!
We have released our SY0-401 practice test, a feat we are especially proud of because we are the first product to market. Please visit the product page for more information!
Well, that’s all I have to say for now. I am sure that you will be hearing from me soon! -Robin
Tags: CompTIA, Performance-Based Testing, Security+, study tips, sy0-401
In my previous post, I covered the overall changes from SY0-301 to SY0-401. I described how the exam is moving from “tell” to “show and tell,” with more emphasis on applying your knowledge to scenarios than simply answering fact-based questions.
In this post I’ll delve into the first three domains and draw out the topic-level changes that may affect your study plan, especially if approaching your three-year renewal in Security+.
(In my final post, I’ll cover domains 4 through 6 and the list of acronyms.)
Domain 1: Network Security Changes
Domain 1.1 now states “Implement security configuration parameters on network devices and other technologies,” where this SY0-301 domain only asked you to explain each security function and its purpose. In addition, all-in-one security appliances are now referred to as UTM security appliances. These are now listed as including URL filters, content inspection, and malware inspection.
Domain 1.2 now states “Given a scenario, use secure network administration principles” where this SY0-301 domain focused on applying and implementing these principles. This particular change means that all questions now written for this domain will include scenarios.
Domain 1.3 now states “Explain network design elements and components” where they SY0-301 domain was only about distinguishing and differentiating between these components. The Cloud computing topic within this domain now has four new subtopics: Private, Public, Hybrid, and Community.
Domain 1.4 now states “Given a scenario, implement common protocols and services” where this SY0-301 domain was only about implementing common protocols. This particular change means that all questions now written for this domain will include scenarios. New protocols added to this domain include: iSCSI, Fibre Channel, FCoE, FTP, SFTP, TFTP, TELNET, HTTP, and NetBIOS. (Most of these were listed in Domain 1.5 in SY0-301 and were moved to this domain.) Also, this domain now includes a listing of port numbers that you should definitely know: 21, 22, 25, 53, 80, 110, 139, 143, 443, and 3389.
Domain 1.5 now states “Given a scenario, troubleshoot security issues related to wireless networking” where this SY0-301 domain was actually domain 1.6, where it read “Implement wireless network in a secure manner.” Once again, this domain change means that all questions now written for this domain will include scenarios. In addition, there are four new topics for this domain:
All of the new topics added to this domain are:
- Application-aware devices (1.1)
- Unified threat management (1.2)
- Layered security / Defense in depth (1.3)
- OSI relevance (1.4)
- Captive portals (1.5)
- Antenna types (1.5)
- Site surveys (1.5)
- VPN (over open wireless) (1.5)
Domain 2: Compliance and Operational Security Changes
There were so many new topics added in this domain that I have chosen to list them in the domain description (to prevent slow death by bulleted list).
Domain 2.1 now states “Explain the importance of risk-related concepts” instead of just defining the concepts, as in SY0-301. The topics that have been added to this domain are: False negatives, SLE, ARO, MTTR, MTTF, MTBF, Vulnerabilities, Threat vectors, Probability / threat likelihood, Recovery time objective, and recovery point objective.
Domain 2.2 is a new objective: “Summarize the security implications of integrating systems and data with third parties.” The topics included in this domain are as follows:
- On-boarding/off-boarding business partners
- Social media networks and/or applications
- Interoperability agreements
- Privacy considerations
- Risk awareness
- Unauthorized data sharing
- Data ownership
- Data backups
- Follow security policy and procedures
- Review agreement requirements to verify compliance and performance standards
Domain 2.3 now states “Given a scenario, implement appropriate risk mitigation strategies” instead of just carrying out these strategies as in SY0-301. One new topic was added to this domain: Enforce technology controls, including Data Loss Prevention (DLP).
Domain 2.4 is technically a new domain, but it was actually listed as a topic under Domain 2.4 in SY0-301. It states “Given a scenario, implement basic forensic procedures.” This is another domain that will include only scenario-based questions. Only one new topic is listed here: Big data analysis.
Domain 2.5 now states “Summarize common incident response procedures” where this SY0-301 domain was about executing the appropriate incident response procedures. All but one of this topics in this domain are new:
- Incident identification
- Escalation and notification
- Mitigation steps
- Lessons learned
- Recovery/reconstitution procedures
- First responder
- Incident isolation
- Device removal
- Data breach
Domain 2.6 is the same as Domain 2.4 in SY0-301. Topics that were added to this domain include: Role-based training, Information classification levels (High, Medium, Low, Confidential, Private, and Public), and Follow up and gather training metrics to validate compliance and security posture.
Domain 2.7 states “Compare and contrast physical security and environmental controls” and pulls some topics from SY0-301 Domain 2.6 Explain the impact and proper use of environmental controls. New topics to this domain include the following:
- Physical security
- Hardware locks
- Video Surveillance
- Proximity readers
- Access list
- Proper lighting
- Protected distribution (cabling)
- Motion detection
- Control types
Domain 2.8 is completely new and states “Summarize risk management best practices.” However, most of the topics in it are repeated from SY0-301 Domains 2.5 and 2.7. The NEW topics in this domain are as follows:
- Risk assessment
- IT contingency planning
- High availability
- Tabletop exercises
Domain 2.9 is completely new, and states “Given a scenario, select the appropriate control to meet the goals of security.” This domain, like many others, will only include scenario-based questions. The topics covered in this domain are as follows:
- Access controls
- Digital signatures
- Fault tolerance
- Escape plans
- Escape routes
- Testing controls
Domain 3: Threats and Vulnerabilities Changes
Domain 3.1 now states “Explain types of malware” where this SY0-301 domain asked you to analyze and differentiate malware. The new topics here are ransomware, polymorphic malware, and armored viruses.
Domain 3.2 now states “Summarize various types of attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Three new attack types were added to this domain: Password attacks (Brute force, Dictionary attacks, Hybrid, Birthday attacks, and Rainbow tables), typo squatting/URL hijacking, and watering hole attacks.
Domain 3.3 now states “Summarize social engineering attacks and the associated effectiveness with each attack” where this SY0-301 domain was about analyzing and differentiating these attacks. One new topic, Principles (reasons for effectiveness), was added with several subtopics: Authority, Intimidation, Consensus/Social proof, Scarcity, Urgency, Familiarity/liking, and Trust.
Domain 3.4 now states “Explain types of wireless attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Four new topics have been added to this domain: Near field communication, Replay attacks, WEP/WPA attacks, and WPS attacks.
Domain 3.5 now states “Explain types of application attacks” where this SY0-301 domain was about analyzing and differentiating the attacks. Four new topics have been added to this domain: Integer overflow, LSO (Locally Shared Objects), Flash Cookies, and Arbitrary code execution / remote code execution.
Domain 3.6 now states “Analyze a scenario and select the appropriate type of mitigation and deterrent techniques.” The major change to this domain is that is uses the word scenario, which implies that all questions on this topic will now be scenarios. There are no new topics in this domain.
Domain 3.7 now states “Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities” where this Sy0-301 domain was about implementing these tools. Once again, scenarios are specifically mentioned as being the question type for this domain. Two new tools are listed in this domain: Passive vs. active tools and Banner grabbing.
Domain 3.8 now states “Explain the proper use of penetration testing versus vulnerability scanning.” Three vulnerability scanning topics have been added to this domain: Intrusive vs. non-intrusive, Credentialed vs. non-credentialed, and False positive.
Stay tuned next week, when I’ll finish out my summary of changes in Domains 4, 5, and 6!
Until next time!
Tags: CompTIA, Performance-Based Testing, Security+, study tips
Has it been three years already? It seems like just last week I was talking about SY0-301, and now here I am trying to catch my breath after pushing the 2014 Security+ exam, SY0-401, over the finish line and into our practice test lineup. (But really, I am just glad to finally get to write about something other than project management.) As usual, the new Security+ exam will include many of the same topics as the previous version. In this post I’ll focus on the overall differences between SY0-301 and SY0-401. In the next two posts (get excited!) I’ll take a closer look at changes within the examination blueprint, which can be downloaded here from CompTIA. (Note: the download requires you to provide personal information.)
Topics and weightings
At first glance, it may seem that very little has changed. The six domains are the same apart from some shifts in weighting (the percentage of the test devoted to that topic):
1.0 Network Security 20% (21% in SY0-301) 2.0 Compliance and Operational Security 18% (no change) 3.0 Threats and Vulnerabilities 20% (21% in SY0-301) 4.0 Application, Data and Host Security 15% (16% in SY0-301) 5.0 Access Control and Identity Management 15% (13% in SY0-301) 6.0 Cryptography 12% (11% in SY0-301)
As you can see from these numbers, this new distribution will probably only mean one or two questions more for Domains 5 and 6. But it’s more important to note that within each domain, there are many topic-level changes that will affect your study plan. Within these domains CompTIA has added several new topics which were not tested in 301. These new topics include application-aware devices, unified threat management, defense-in-depth, OS hardening, white-listing versus black-listing, and many others that I’ll cover in the next two posts. There are three new sub-domains distributed among Domains 2 and 4. These new sub-domains add topic coverage on mobile security, mitigating security risks in a static environment, and implementing basic forensic procedures. That last sub-domain leads neatly into my next topic: you can expect increased difficulty and more applied concept questions on the new Security+ exam, in comparison to the older style of asking straight knowledge-based questions.
Stop, Drop, & Scenario!
While many of the sub-domains cover the same list of topics, CompTIA has changed many of the keywords from “understand” and “explain” to “implement” and “troubleshoot.” Several also show the addition of one important phrase: “given a scenario.” Because this phrasing was added to so many domains, I feel I should take a little time to explain the distinction. As many of you know, the Security+ exam has been considered a mostly knowledge-based exam that includes mostly knowledge-based questions. Scenario questions are the next logical step up from knowledge-based questions. They expect you to take those tidbits of knowledge that you have memorized, remember them, and then apply them in the scenario to come up with the correct answer. Let me give you an example. First, look at a sample knowledge-based question from our practice test:
Which of the following is a default port used by FTP? a. 20 b. 53 c. 80 d. 443
Now look at another example, which turns this same question into a scenario:
Your company has recently implemented a new firewall. Users start complaining that they are unable to access resources on your company’s FTP server. What should you do? a. Open ports 20 and 21 on the new firewall. b. Open port 53 on the new firewall. c. Open port 80 on the new firewall. d. Open port 443 on the FTP server.
As you can see from my examples, you still need the same basic knowledge to answer both of these questions. So REALLY, answering these two questions is the same level of difficulty, but by adding the scenario you are ensuring that the student understands how the knowledge applies in a real-world situation. Instead of remembering which port belongs with FTP, the student also has to identify the location where the ports should be configured. I could also increase the difficulty of the scenario question by including more invalid options. We have released our SY0-401 practice test, a feat we are especially proud of because we are the first product to market. Please visit the product page for more information!
The next post will dive into the topic-level changes in Network Security (Domain 1), Compliance and Operational Security (Domain 2), and Threats and Vulnerabilities (Domain 3).
I’ll cover the other three domains in the final post in this series.
Until next time! –Robin
Tags: capm, PMP, Project Management Institute, Project+
Project management is needed in almost all fields and includes both commercial and non-commercial projects. Many colleges and universities offer degrees in the field of project management. Search any job Web site, and you will find project management positions available with many companies.
But what if you want to prove your proficiency in project management? There are many popular project management certifications that you can obtain. In this article, I want to discuss three of those certifications: CompTIA’s Project+, PMI’s Certified Associate in Project Management (CAPM), and PMI’s Project Management Professional (PMP).
Of the three certifications, CompTIA’s Project+ certification is probably the easiest to take. Like most CompTIA certifications, there are no prerequisites or qualifications to take this exam, although CompTIA does recommend one year of managing, directing, or participating in small- to medium-scale projects. The certification also does not require an application process. To take the exam, you simply register for the exam through Vue and pay the examination fee of $261 U.S.
The exam consists of 100 multiple-choice questions. You are given 90 minutes to complete the exam and need to obtain a score of 710 (on a scale of 100-900) to pass the exam.
Currently, this certification does NOT have an expiration date, meaning you will be Project+-certified for life.
PMI’s Certified Associate in Project Management (CAPM)
To take the CAPM exam, you must first complete an online application. To qualify for the exam, you will need to have a high-school diploma (or equivalent) and 1,500 hours of professional experience on a project team OR 23 hours of formal project management education. Once the application is approved for completeness, you must then pay the exam fee of $225 (PMI members) or $300 (non-members). (If your application is selected for audit, you have 90 days to submit the audit materials.) You have one year from the application approval date to take the exam.
The exam consists of 150 multiple-choice questions that focus on the material covered in the PMBOK 5th Edition. You are given 180 minutes to complete the exam. PMI does not publish the minimum score that you need to receive to obtain the certification, but you will receive a report when you complete the exam that lists your score and proficiency in the topic domains.
Currently, this certification expires five years from the date you originally passed the exam. You will need to re-take the exam to re-certify.
PMI’s Project Management Professional (PMP)
Like the CAPM exam, the PMP exam requires the completion of an online application. To qualify for the exam, you should have either of the following:
- High-school diploma, associate’s degree, or equivalent
- 5 years of professional project management experience
- 35 hours of formal project management education
- Four-year degree or equivalent
- 3 years of professional project management experience
- 35 hours of formal project management education
Once the application is approved for completeness, you must then pay the exam fee of $405 (PMI members) or $555 (non-members) for the computer-based exam. (If your application is selected for audit, you have 90 days to submit the audit materials.) You have one year from the application approval date to take the exam.
The exam consists of 200 multiple-choice, scenario-based questions based on the PMBOK 5th Edition. You are given 240 minutes to complete the exam. PMI does not publish the minimum score that you need to receive to obtain the certification, but you will receive a report when you complete the exam that lists your score and proficiency in the topic domains.
To maintain the certification, you must complete 60 professional development units (PDUs) within three years to renew the certification. If you do not obtain and report the PDUs, this certification expires three years from the date you originally passed the exam.
If you are new to the project management field and only have a one or two years of experience, I suggest that you take the Project+ exam first. This exam will be a great start in your career path and will help you to gauge your knowledge of project management.
If you have several years experience in the project management field but do not have enough formal project management education to take the PMP exam, you should take the CAPM exam, which is also the next logical step after the Project+ exam.
As far as formal project management education goes, most college courses or training courses from a reputable training provider qualify. While PMI has a list of approved training providers for CEUs (the training credits required to maintain certification), the educational requirements for taking the certification exams are usually not as strict. However, you may need to provide a transcript or proof of completion. Find out the latest on education, certification requirements, and more on the PMI web site.
Once you have enough experience and formal education, take the PMP exam. This is one of the most highly respected certifications in the industry today.
While experienced project managers might choose to jump right in and take the PMP, newbies should probably start at the Project+ level.
If you are still undecided on whether project management certifications are the right way to go, consider this fact: According to salary.com, the median expected salary for a typical project manager in the United States is $107,056.
For most of us, that salary statistic may speak volumes and help to solidify our resolve to pursue the certifications.
Here’s hoping you achieve certification success in 2014!
Tags: CompTIA, Performance-Based Testing
Our very own Robin Abernathy will be talking all about performance-based testing, CEUs, and security certifications on Thursday, January 30th at 4pm ET in a webinar hosted by CompTIA. This event is the first of what will be a Professional Development series of webinars hosted by CompTIA and starring some of our favorite industry experts.
Register here to join in the fun! Note that although the description says ‘For Academy Partners,’ this webinar is open to anyone who creates a login ID.
To see the lineup of upcoming events, or to meet some of these experts in person at the next CompTIA Academy Educator Conference this August in Phoenix, AZ, visit: CompTIA Events
Tags: comptia educator's conference, Security+
For the last two years, I have been attending the CompTIA Academy Educator Conference (which used to be part of CompTIA Breakaway, which is now renamed ChannelCon…but I digress!). The first year I was an attendee and just took in all the IT certification information that was handed out. Last year in Las Vegas, I gave a small presentation on CompTIA’s CASP certification (you can read about that here).
This year, I will be speaking on “Security Certifications and Performance-Based Testing: Taking Your Students to the Next Level.” If you have attended this event in the past, you already know just how valuable it can be for educators who are responsible for any CompTIA training. And this year looks to be no different, especially when you consider all the changes that CompTIA has implemented over the past few years.
If you have never attended this event, I encourage you to do so, particularly if you provide training for any CompTIA certifications. At this event, you often get access to some A-list authors in an informal environment. They give you pointers and show you some of the tools you can use in your classroom. It is a great value – especially for its low cost.
And I have GREAT news – you can use Promo Code EDU25% to receive 25% off the published conference rate. Go to http://www.comptia.org/events/events/academy_educator/index.aspx to register and obtain conference details. (Register before 7/24 to get the best rate!)
Hope to see you there!
Tags: a+, CompTIA
So a few months ago…after much arm twisting…I had the “opportunity” to host an A+ Webinar. (The term opportunity is in quotes because anyone who knows me knows that I get very nervous when speaking to a group, whether live or virtual, and I hate my recorded voice.) Well, the Webinar went off without a hitch…That is, unless you consider my very southern accent as a “hitch.”
The video of that Webinar is available now. So if you’ll pardon my southern accent, agree NOT to count the number of times I say UMMM, and ignore the long pauses, here’s your chance to learn more about the new 800-series A+ exams:
Hope you enjoy it!