sec0, first attempt
570 out of 600, first sitting. The part worth writing down is not the pass — it is that the only two domains I dropped points in were the two I walked in most confident about.
TL;DR
Passed SEC0 on attempt one with 570/600 against a 390 pass mark, in 3h 52m. Every hands-on domain — operating systems, software, networking, attacks and defenses — came back at 100. The two that did not were Computer Fundamentals (90) and How the Web Works (80): the two I had treated as revision rather than study.
What SEC0 covers
SEC0 is [[issuer]]'s entry-level security certification — the breadth exam you sit before anything specialised, aimed at people who can already use a computer and now need to explain why it works the way it does. Six domains, 100 points each:
- Computer Fundamentals — hardware, storage, how a machine actually boots and executes.
- Operating Systems — processes, permissions, filesystems, the Windows/Linux split.
- Software Basics — how programs are built, packaged, and run.
- Network Fundamentals — the model, the protocols, and what a packet does on its way out.
- How the Web Works — HTTP, DNS, browsers, and the request/response round trip.
- Cyber Security: Attacks and Defenses — the threat landscape and the controls that answer it.
The exam is [[format]], sat remotely inside a [[window]] window, and costs [[cost]]. Scoring is banded rather than pass/fail per domain: 0–64 is needs improvement, 65–69 pass, 70–79 good, and 80+ excellent. You need 390 of 600 overall — 65% — to walk away certified.
The score, read honestly
Computer Fundamentals 90 ▓▓▓▓▓▓▓▓▓░
Operating Systems 100 ▓▓▓▓▓▓▓▓▓▓
Software Basics 100 ▓▓▓▓▓▓▓▓▓▓
Network Fundamentals 100 ▓▓▓▓▓▓▓▓▓▓
How the Web Works 80 ▓▓▓▓▓▓▓▓░░
Attacks and Defenses 100 ▓▓▓▓▓▓▓▓▓▓
───────────────────────────────────────────────────
total 570/600 95% pass ≥ 390
attempt 1 3h 52m 43sFirst, the fair reading: every one of the six landed in the excellent band. An 80 here is not a weak spot in any absolute sense — it is the top band, and it clears the bar by fifteen points on its own. Nothing in this table is a failure and I am not going to pretend otherwise.
The useful reading is relative. Four domains are perfect and two are not, and the two that are not are precisely the ones I had internally filed under I already know this. Computer fundamentals and how the web works are the topics you absorb by osmosis years before anyone examines you on them — which is exactly what makes them dangerous. Osmosis gives you a working model, not a precise one. It is the difference between knowing DNS resolves a name and being able to name what answers at each step, or knowing a file has permissions and knowing what the bits mean. Under exam conditions the fuzzy edges are the only thing being tested, because the middle is too easy to ask about.
The domains I revised hardest scored perfectly. That is not a coincidence and it is not a compliment to my studying — it is a warning about where I choose to spend it.
How I prepared
Roughly [[hours]] across [[resource-1]] for the structured pass and [[resource-2]] for the parts that would not stick. The split that actually worked: read once for coverage, then go back and only re-read the things I could not explain out loud without looking. Anything I could narrate from memory got closed and never opened again.
What moved the needle was building rather than reading. Most of the networking and crypto material stopped being vocabulary the moment I had to implement it for Crypt — you cannot hand-wave a hash function into a working tool. If you are preparing for this and you already write code, that is the cheapest upgrade available: pick two domains and make something small that uses them for real.
Sitting it
3 hours 52 minutes 43 seconds of a [[window]] allowance, so time was never the constraint. I went through once at pace, flagged anything I was not certain about rather than stalling on it, and did a full second pass on the flags with the clock still comfortable. The second pass changed a handful of answers; at least one of those changes was, in hindsight, me talking myself out of a correct first instinct.
There are no questions reproduced in this post and there will not be. Exam content is under NDA, and the house rules here rule out spoilers for paid content anyway. Method, pacing and preparation are fair game; the question bank is not.
Dead ends
- Over-studying attacks and defenses. It is the domain that sounds like the point of the certificate, so it got the most attention — and it was worth 100 points, exactly like computer fundamentals. Weighting prep by how interesting a domain is instead of by how many points it carries is the single clearest mistake in the table above.
- Treating "fundamentals" as a warm-up section. Nothing in the scoring discounts an easy domain, and the questions there are not easy — they are about easy things, which is not the same property.
- Memorising port numbers and acronym expansions. Cheap to revise, which is why it feels productive, and almost never the thing standing between you and the answer.
What I would do differently
- Budget study time by point weight, not by curiosity. Six domains, 100 each, no exceptions.
- Audit the domains I am confident about first — confidence is where the unexamined gaps hide, and it is the cheapest place to find them.
- Test recall by explaining, not by re-reading. If I cannot say it out loud unaided, I do not know it, however familiar the page looks.
- Trust the first pass. My second-pass changes were net-negative and I suspect they cost me at least one of the twenty missing points.
- Build something with the material. The domains I had written code against scored perfectly; the ones I had only read about did not.
What is next
SEC0 is a floor, not a finish line — it certifies that the vocabulary is in place, which mostly means I can now read the harder material without stopping every paragraph. Next up is [[next]], and the two domains that came back under 100 are getting studied properly rather than assumed, this time with something built on top of each of them.