CertQuests
Pick your career, not your exam.
Pick the job, not the cert. Each roadmap below sequences the right certs in the right order — plus the homelab/code/soft-skills employers actually check.
More on the approach
Most cert sites are organized vendor-first (AWS, CompTIA, Cisco, Microsoft). That mirrors how exams are sold, not how careers are built. If your goal is “become a SOC analyst,” you don’t want to know every CompTIA cert — you want to know which four certs in which order get you there. No bootcamp affiliate revenue. No vendor revenue. Updated as exams change.
Interactive career tools
Your Career OS: plan a roadmap, see which roles your certs already match, drill realistic incidents, and rehearse the interview — all free, all in the browser.
🧭 My Roadmap
Pick a target role and get an ordered cert sequence you own — progress rolls up from your practice automatically.
Build my roadmap🎯 Job Match
See which IT roles your validated certifications already fit — and exactly which certs remain for each, with salary ranges.
See my matches🧪 Hands-on Labs
Troubleshoot real incidents one decision at a time — every choice tells you why it's right or wrong. Weak-area labs surface first.
Start a lab🎤 Interview Prep
A STAR behavioural trainer plus a timed voice/typed mock interview with an instant self-check — rehearse the questions you'll actually be asked.
Practise interviewsCareer paths
SOC Analyst
Network+ → Security+ → CySA+ → Splunk. The cleanest path into entry-level cybersecurity, anchored on what L1 SOC postings actually require.
Open roadmapCloud Engineer (AWS)
CCP → SAA → DVA → SOA. The associate-trio path that anchors the upper end of entry-level AWS Cloud Engineer offers.
Open roadmapCloud Engineer (Azure)
AZ-900 → AZ-104 → AZ-305 → AZ-500. Better than AWS in finance, healthcare, and government metros.
Open roadmapPentester
Network+ → Security+ → PenTest+ → OSCP. The longest path of the six because OSCP is genuinely hard. Highest skill-check requirement.
Open roadmapDevOps / SRE
Cloud → Linux → Docker → Kubernetes → Terraform. The widest path: 5 certs across 5 disciplines. Coding skill non-negotiable.
Open roadmapNetwork Engineer
Network+ → CCNA → CCNP ENCOR → CCNP Security. Cisco-anchored. Cloud-adjacent network roles pay best in 2026.
Open roadmapRole Profiles
Data Engineer in 2026: Skills, Salary & Day-to-Day
The honest 2026 role profile for one of the highest-leverage data seats: what Data Engineering actually is in the lakehouse era (Iceberg/Delta + dbt + Snowflake or Databricks), the skills hiring managers screen for, day-to-day workload, and the $130–180k US mid-level band.
Read profilePlatform Engineer in 2026: Skills, Salary & Day-to-Day
The honest 2026 role profile for one of the fastest-growing IT seats: what Platform Engineering actually is (an internal product, not a DevOps rename), the skills hiring managers screen for, day-to-day workload, and the $135–185k US mid-level band.
Read profileCareer Pivots
From QA Engineer to DevOps in 12 Months
A 12-month plan from a $70–90k QA / SDET seat to a $115–150k DevOps Engineer offer. Cert sequence (SAA-C03 → Terraform Associate → CKA), CI/CD and IaC artifacts hiring managers screen for, and the months where most candidates burn out.
Read roadmapFrom Help Desk to Cloud Engineer in 12 Months
A 12-month plan from a $48–55k help desk seat to a $95–125k entry-level Cloud Engineer offer. Cert sequence (CCP → SAA-C03 or AZ-104), homelab milestones, and the months where most candidates burn out.
Read roadmapFrom SOC Analyst to Pentester in 12 Months
A 12-month plan from a $70–85k SOC L2 seat to a $95–130k junior pentester offer. Cert sequence (eJPT → PenTest+ or HTB CPTS → OSCP), lab milestones, and the months where most candidates burn out.
Read roadmapFrom SysAdmin to SRE in 12 Months
A 12-month plan from a $75–95k senior Linux sysadmin seat to a $120–160k SRE I/II offer. Cert sequence (Terraform Associate → CKA → optional cloud associate), code artifacts on GitHub, and the months where most candidates burn out.
Read roadmapFrom Windows SysAdmin to Azure Cloud Engineer in 12 Months
A 12-month plan from a $70–90k Windows sysadmin seat to a $120–155k Azure cloud engineer offer. Cert sequence (AZ-104 → Terraform Associate → AZ-305), one real migration artifact, one landing zone, and the months where most Windows-background candidates burn out.
Read roadmapFrom Network Engineer to Network Security Engineer in 12 Months
A 12-month plan from a $90–115k network engineer seat to a $125–160k network security engineer offer. Cert sequence (Security+ → NSE 4 or PCNSE → CCNP Security or AZ-500), homelab firewall artifact, segmentation rollout, and the months where most network-background candidates burn out.
Read roadmapFrom Junior to Senior DevOps in 18 Months
An 18-month plan from a $90–110k junior DevOps seat to a $160–200k senior DevOps offer. Cert sequence (CKA → AWS SAP-C02 → Terraform Associate), platform module other teams import, post-mortem catalogue, and the months where most candidates stall before the levelling rubric.
Read roadmapFrom Data Analyst to Data Engineer in 12 Months
A 12-month plan from a $70–95k senior data analyst seat to a $130–180k data engineer offer. Cert sequence (SnowPro Core → dbt → AWS DEA-C01), a public dbt project, a real Airflow pipeline, and the months where most analyst-background candidates burn out.
Read roadmapCert ROI & Analysis
Is the CCSP (Certified Cloud Security Professional) Worth It in 2026?
$599 exam, 120–180 study hours, ~50% pass rate, and a $25–40k salary bump for cloud-security architects and CISSP holders pivoting into cloud. The vendor-neutral cloud-security cert — and when SCS-C02 or AZ-500 wins instead.
Read analysisIs the AWS AI Practitioner (AIF-C01) Worth It in 2026?
$100 exam, 20–40 study hours, ~80% pass rate, 3-year validity. The Bedrock-era foundational AI cert for AWS engineers, developers, and partner consultants — and when to skip it for MLA-C01 or AI-900.
Read analysisIs the Azure AI-102 (AI Engineer Associate) Worth It in 2026?
$165 exam, 60–100 study hours, ~70% pass rate, annual free renewal. The associate-tier engineering cert for Azure OpenAI, Foundry, and Document Intelligence — and when to take AI-900 or DP-100 instead.
Read analysisIs the AWS SAA-C03 Worth It in 2026?
$300 exam, 140 study hours, ~55% pass rate, and a $25–40k salary bump for most candidates. The math, the caveats, and when to skip it.
Read analysisIs the AWS DVA-C02 (Developer Associate) Worth It in 2026?
$150 exam, 80–130 study hours, ~70% pass rate (post-SAA), and a $15–30k salary lift for developers shipping to AWS — Lambda, DynamoDB, API Gateway, Step Functions. The natural second associate cert — and when to skip it.
Read analysisIs the AWS SCS-C02 (Security Specialty) Worth It in 2026?
$300 exam, 130–180 study hours, ~50% pass rate, and a $25–45k salary bump for AWS engineers pivoting into cloud security or DevSecOps. The cheapest credible cloud-security signal in 2026 — and when to skip it.
Read analysisIs the CompTIA Security+ SY0-701 Worth It in 2026?
$404 exam, 60–100 study hours, DoD 8140 compliance gate, and an $18–30k salary bump. The math and when to skip it.
Read analysisIs the Cisco CCNA 200-301 Worth It in 2026?
$300 exam, 100–140 study hours, ~70% pass rate, and a $15–25k salary bump for helpdesk-to-network pivots. The math, the caveats, and when to skip it.
Read analysisIs the CompTIA Network+ (N10-009) Worth It in 2026?
$369 exam, 80–120 study hours, ~70% pass rate, and a modest $8–15k bump for help-desk-to-NOC pivots. Why this foundational cert is the floor for three career paths — and when to skip it for CCNA.
Read analysisIs the CKA (Certified Kubernetes Administrator) Worth It in 2026?
$445 exam, 120–180 study hours, ~60% first-attempt pass rate, and a $20–35k salary bump for DevOps engineers moving into Kubernetes-anchored platform and SRE roles. The math and when to skip it.
Read analysisIs the CKAD (Certified Kubernetes Application Developer) Worth It in 2026?
$445 exam, 70–110 study hours, ~65% first-attempt pass rate, and a $15–30k salary bump for backend and platform-leaning developers shipping into Kubernetes. Half the prep of CKA — when CKAD is the right pick.
Read analysisIs the HashiCorp Terraform Associate (003) Worth It in 2026?
$70.50 exam, 30–60 study hours, ~75% first-attempt pass rate, and a $10–20k salary lift for DevOps, platform, and cloud engineers moving into IaC-anchored roles. The cheapest credential in the cloud-native stack.
Read analysisIs the CISSP Worth It in 2026?
$749 exam, 100–180 study hours, ~70% first-attempt pass rate, $135/year AMF, and a $20–40k salary lift for senior security engineers, architects, and managers. The 5-year experience gate and the DoD 8140 angle, included.
Read analysisIs the Cisco CCNP Still Worth It in 2026?
$800 in exam fees, 400–500 study hours, ~50% pass rate, and a $20–35k salary jump for working network engineers moving into senior and design roles. The honest math — and when to skip it.
Read analysisIs the AWS SAP-C02 (Solutions Architect Professional) Worth It in 2026?
$300 exam, 150–250 study hours, ~45% first-attempt pass rate, and a $25–45k salary bump for senior cloud engineers moving into principal-architect and AWS consulting roles. The math, the caveats, and when to skip the Pro tier.
Read analysisIs the AZ-104 (Microsoft Azure Administrator) Worth It in 2026?
$165 exam, 80–120 study hours, ~70% first-attempt pass rate, and a $15–25k salary bump for help-desk and sysadmin pivots into Azure cloud roles. The math, the renewal model, and when to skip it.
Read analysisIs the GCP ACE (Associate Cloud Engineer) Worth It in 2026?
$125 exam, 80–120 study hours, ~65% pass rate, 3-year validity. The GCP-shop operator-tier gateway cert — $10–25k salary bump in Bay Area / ad-tech / ML-startup metros, and when to skip it for PCA or AWS SAA.
Read analysisIs the AZ-700 (Azure Network Engineer) Worth It in 2026?
$165 exam, 100–150 study hours, ~60% pass rate, and a $20–35k salary lift for AZ-104 holders and on-prem network engineers pivoting to Azure landing-zone and cloud-network engineer roles. The math — and when CCNP or AWS ANS-C01 wins instead.
Read analysisIs the AZ-305 (Azure Solutions Architect Expert) Worth It in 2026?
$165 exam, 120–180 study hours, ~50% first-attempt pass rate, and a $25–40k salary lift for AZ-104 holders and senior Azure engineers moving into architect, principal, and Microsoft Partner architect seats. The case-study reality — and when to skip it.
Read analysisIs the AZ-204 (Microsoft Azure Developer) Worth It in 2026?
$165 exam, 100–140 study hours, ~55% pass rate, and a $15–25k salary bump for backend and cloud-native developers moving into Azure-anchored roles. The math, the AZ-104 comparison, and when to skip it.
Read analysisIs the AZ-400 (Azure DevOps Engineer Expert) Worth It in 2026?
$165 exam, 100–150 study hours, ~55% first-attempt pass rate, and a $20–35k salary lift for AZ-104 or AZ-204 holders moving into senior DevOps and platform-engineer seats. The case-study reality — and when AWS DOP-C02 wins instead.
Read analysisIs the AWS DOP-C02 (DevOps Engineer Professional) Worth It in 2026?
$300 exam, 150–220 study hours, ~50% first-attempt pass rate, and a $25–40k salary bump for SAA-C03 or DVA-C02 holders moving into senior DevOps, SRE, and Platform Engineer seats. The strongest AWS-side DevOps credential — and when AZ-400 wins instead.
Read analysisIs the AZ-500 (Microsoft Azure Security Engineer) Worth It in 2026?
$165 exam, 80–120 study hours, ~60% first-attempt pass rate, and a $20–35k salary bump for Azure cloud engineers pivoting into security in Microsoft-heavy shops. The named SC-100 prerequisite — and when to skip it.
Read analysisIs the SC-100 (Microsoft Cybersecurity Architect Expert) Worth It in 2026?
$165 exam, 80–130 study hours, ~50% first-attempt pass rate, and a $25–45k salary bump for senior Azure security engineers moving into architect seats. The only Microsoft expert-tier security cert — and when to skip it for CISSP.
Read analysisIs the GCP Professional Cloud Architect Worth It in 2026?
$200 exam, 100–150 study hours, ~50% first-attempt pass rate, and a $20–35k salary bump for senior engineers pivoting into GCP-leaning cloud architect roles. The case-study format, the AWS Pro comparison, and when to skip it.
Read analysisIs the GCP Professional Data Engineer Worth It in 2026?
$200 exam, 100–150 study hours, ~50% first-attempt pass rate, and a $20–40k bump for analytics engineers and ML-platform engineers moving into BigQuery, Dataflow, and Vertex AI seats at GCP-leaning shops. When PDE pays — and when DEA-C01 or DP-203 fits better.
Read analysisIs the RHCSA (EX200) Worth It in 2026?
$500 exam, 100–150 study hours, ~70% pass rate, and a $15–30k salary lift for Linux engineers and sysadmins moving into RHEL-anchored roles in finance, telco, defense, and OpenShift shops. The hands-on reality — and when to skip it.
Read analysisIs the Docker DCA (Docker Certified Associate) Worth It in 2026?
$195 exam, 40–80 study hours, ~65% pass rate, and a modest $5–15k bump for junior-to-mid DevOps engineers proving container fundamentals. The Swarm caveat — and when to skip it for Kubernetes.
Read analysisIs the Splunk Core (SPLK-1002) Power User Worth It in 2026?
$130 exam, 40–70 study hours, ~70% pass rate, and a $10–25k lift for SOC, security, and observability analysts inside Splunk shops. The narrow, high-leverage bet — and when to skip it for your actual stack.
Read analysisIs the Fortinet NSE 4 Worth It in 2026?
~$400 exam (now the FCP FortiGate Administrator), 50–90 study hours, ~65% pass rate, and a $10–20k lift for firewall and network-security engineers in Fortinet shops. The narrow, high-leverage bet — and when to skip it.
Read analysisIs the SnowPro Core (COF-C02) Worth It in 2026?
$175 exam, 30–50 study hours, ~75% pass rate, and a $10–20k lift for data analysts and engineers moving into Snowflake-anchored roles. The deep-but-narrow data-platform bet — and when to skip it.
Read analysisIs the MS-900 (Microsoft 365 Fundamentals) Worth It in 2026?
$99 exam, 20–30 study hours, ~85% pass rate, and lifetime validity. The cheapest credible foot-in-the-door for helpdesk, career-changers, and M365 partner roles — and when working admins should skip straight to MS-102.
Read analysisIs the AZ-900 (Microsoft Azure Fundamentals) Worth It in 2026?
$99 exam, 25–40 study hours, ~85% pass rate, and lifetime validity (no renewal since 2023). The right entry-level Azure cert for non-engineering roles and career changers — and when working engineers should skip straight to AZ-104.
Read analysisIs the CKS (Certified Kubernetes Security Specialist) Worth It in 2026?
$445 exam, 100–150 study hours on top of CKA, ~55% first-attempt pass rate, and a $25–40k salary bump — the largest single-cert delta in the cloud-native stack for platform-security, DevSecOps, and staff SRE roles.
Read analysisSalary Trends
Interview Prep
Top 10 AWS SAA-C03 Interview Questions (2026)
The 10 Solutions Architect Associate questions that appear most in AWS interviews in 2026 — with the operational answer logic that gets you the offer, not just the cert-book version.
Read prep guideTop 10 AZ-104 Interview Questions (2026)
The 10 Azure Administrator questions that appear most in cloud-engineer interviews in 2026 — with the operational answer logic that gets you the offer, not just the cert-book version.
Read prep guideTop 10 CKA Interview Questions (2026)
The 10 Certified Kubernetes Administrator questions that appear most in platform and SRE interviews in 2026 — with the operational answer logic that gets you the offer, not just the cert-book version.
Read prep guideTop 10 SC-200 Interview Questions (2026)
The 10 Microsoft Security Operations Analyst questions that appear most in Microsoft-stack SOC interviews in 2026 — Defender XDR, Sentinel, KQL, and Defender for Cloud — with the operational answer logic that gets you the offer.
Read prep guideTop 10 CCNA 200-301 Interview Questions (2026)
The 10 Cisco CCNA questions that appear most in network-engineer and NOC interviews in 2026 — VLANs, STP, OSPF, subnetting, NAT, and ACLs — with the operational answer logic that gets you the offer.
Read prep guideTop 10 AZ-500 Interview Questions (2026)
The 10 Microsoft Azure Security Engineer questions that appear most in 2026 cloud-security interviews — Entra ID, Conditional Access, PIM, Key Vault, NSG/Firewall, and Defender for Cloud — with the operational answer logic that gets you the offer.
Read prep guideTop 10 GCP PCA Interview Questions (2026)
The 10 Google Cloud Professional Cloud Architect questions that come up most in 2026 interviews — VPC, IAM, GKE, BigQuery, Spanner, and Anthos — with the operational answer logic that gets you the offer.
Read prep guideTop 10 CompTIA Security+ Interview Questions (2026)
The 10 SY0-701 questions that come up most in 2026 SOC and junior security-analyst interviews — CIA triad, IDS vs IPS, Zero Trust, phishing IR, and NIST 800-61 — with the operational answer logic.
Read prep guideTop 10 CISSP Interview Questions (2026)
The 10 CISSP questions that come up most in 2026 security-manager and architect interviews — risk math (ALE), BCP vs DRP, defense in depth, GDPR/NIS2/PCI v4, and CFO-grade budget justification — with the manager-level answer logic.
Read prep guideTop 10 Terraform Associate (003) Interview Questions (2026)
The 10 HashiCorp Terraform 003 questions that come up most in 2026 DevOps and platform engineer interviews — state, modules, count vs for_each, lifecycle, and remote backends — with the operational answer logic that gets the offer.
Read prep guideTop 10 Advanced CKA Interview Questions (2026)
The 10 advanced Kubernetes questions that come up in 2026 senior platform engineer and staff SRE loops — Karpenter vs Cluster Autoscaler, API priority & fairness, multi-tenancy, control-plane scale, and Kubernetes FinOps — with the design-judgment answer logic.
Read prep guideTop 10 AWS SAP-C02 Interview Questions (2026)
The 10 AWS Solutions Architect Professional questions hiring managers ask most in 2026 senior-architect loops — Organizations & Control Tower, Transit Gateway, PrivateLink, DR strategies, mass migration, and the FinOps move that hits 20% in 90 days — with the design-judgment answer logic.
Read prep guideHow to pick
If you don’t already have a strong preference, pick by what matches:
- You like puzzles, attention to detail, calm under pressure — SOC Analyst.
- You like building things, automating, and reading docs — Cloud Engineer (pick AWS or Azure by metro).
- You like breaking things, CTFs, and have time for a long path — Pentester.
- You already code or want to, and like cross-discipline work — DevOps / SRE.
- You like protocols, troubleshooting, and tactile gear — Network Engineer.
The paths overlap. Network+ is the foundation for SOC Analyst, Pentester, and Network Engineer. AWS CCP is the foundation for Cloud (AWS) and DevOps. So if you start on one path and pivot within the first 3 months, your study time isn’t wasted.
What every path shares
- Honest timeline. 12–24 months part-time. Faster is possible with full-time bootcamp or prior IT experience; slower usually means burnout.
- Homelab requirement. Every path expects hands-on evidence on top of the certs. The candidates who skip this lose offers at the technical interview.
- Sequenced ATS gate. Each path has one cert that’s the floor most ATS systems screen for. Don’t skip it — even if you “know the material.”
- Salary lever. Each path has one cert beyond the floor that pushes your offer above entry-level. Worth doing if you can stay disciplined.
What we don’t do
- No bootcamp affiliates. No revenue from any cert vendor, training site, or bootcamp mentioned.
- No “fast-track to six figures” lies. If the timeline says 18 months, it’s because we’ve watched candidates take 18 months. Bootcamp ads claim 6 months; reality is 18.
- No fake certifications. Every cert listed is real, currently issued, and respected by hiring managers in 2026. We re-check quarterly.
Not sure which path? Just start with a quiz
The fastest way to figure out what excites you is to take 5 questions in each domain and notice which one pulls you in.
How we wrote these roadmaps
No vendor or bootcamp affiliate revenue. All six paths were sequenced based on what actual job descriptions list as required vs. preferred, plus interviews with hiring managers in 2025–2026 across SaaS, FinServ, government, MSSPs, and consulting firms. Every recommendation is auditable: tell us what you’d change and we’ll update or explain.
What we’ll change without being asked: any cert that gets retired, any new cert that becomes the new floor, any salary band that shifts more than ±10%. Roadmaps are dated and we mark them when we update.