Start from the job, not the exam
Six routes people actually take, in the order the vendors’ own prerequisites put them, with a line on each rung saying why it is there and one on each route saying what it does not need.
Starting from nothing technical, or moving into IT from another field.
IT support technician
The entry role, and the one certification programmes are actually built around. A+ is the credential help-desk postings name, and it is a genuine grounding rather than a formality: two exams covering hardware, operating systems, security basics and the troubleshooting method the rest of the field assumes you have.
Hardware, networking basics, virtualisation and mobile devices. The half that gets you through a hands-on interview question.
Operating systems, security, software troubleshooting and operational procedures. Both cores are required before the certification exists.
The next rung once support work starts touching networks, which it does within a year in most jobs.
What this role does not need. You do not need a cloud certification for this role. AZ-900 and Cloud Practitioner are useful vocabulary and they answer a question a support desk rarely asks.
Practise the whole route as one purchase: the CompTIA Core path, $169 against $196 bought one at a time.
Already in support, or coming from a role where the network was somebody else's problem.
Network administrator
Networking splits into vendor-neutral and Cisco early, and the honest answer is that most people need both: Network+ for the concepts and the language, CCNA for the configuration and the recognition. Cisco's name still carries in job postings in a way no vendor-neutral credential does.
Concepts, topologies, protocols and troubleshooting, without a vendor's implementation on top. Cheaper to fail, and it makes CCNA readable.
The configuration credential. It is the one hiring managers name, and it assumes the Network+ material rather than teaching it.
Networking roles absorb security work continuously, and Security+ is the credential that satisfies the requirement when they do.
What this role does not need. CCNP is a step past this role rather than part of it. Take it when the work is design and troubleshooting at scale, not to strengthen an application.
Coming from support or networking, aiming at a security operations centre.
Security analyst
The most crowded entry point in the field and the one with the clearest ladder. Security+ opens the door and satisfies the requirement most job postings and DoD roles name; CySA+ is the analyst credential proper, built around detection and response rather than definitions.
The baseline. It is the certification named most often in postings, and the one DoD 8140 approval most commonly runs through.
Detection, incident response and vulnerability management. This is the exam that matches what an analyst actually does all day.
If the estate is Microsoft, which for a large share of organisations it is, this is the tooling credential that follows.
What this role does not need. CISSP is not an entry credential. It requires five years of documented experience, and taking the exam before you have it earns an Associate title rather than the certification.
An administrator or developer whose estate is moving to a cloud platform.
Cloud engineer
Pick the platform your organisation actually runs before picking a certification. The fundamentals exam is worth a fortnight and no more; the associate exam is the one that changes what you can be hired for. This route is written for Azure because it is the most common enterprise answer; the AWS equivalent runs Cloud Practitioner then Solutions Architect Associate.
The vocabulary, the service families and the billing model. Cheap, quick, and it makes the administrator exam legible.
The administrator role exam, and the rung most Azure postings name. It is hands-on in a way the fundamentals exam is not.
Design rather than administration, once you are the person deciding what gets built rather than building it.
What this role does not need. Do not take fundamentals exams on three platforms. Breadth at the fundamentals level reads as indecision; depth on the platform your employer runs reads as useful.
Practise the whole route as one purchase: the Azure Fundamentals to Admin path, $89 against $98 bought one at a time.
An engineer who has built on a platform and is now being asked what to build.
Cloud architect
Architecture certifications test judgement against constraints rather than configuration, which is why they are the hardest exams here to prepare for and the least useful to take early. The route matters more than the badge: nobody passes an architect exam on reading alone.
Only if AWS is new to you. It establishes the service vocabulary and the billing model in a fortnight.
The associate architecture exam, and the one AWS postings name more than any other.
The professional exam. Two to three years past the associate, and a genuinely different kind of paper.
What this role does not need. Skip the specialty exams until the associate is behind you. They are deep in one service family and they do not substitute for the breadth the architect exams assume.
Practise the whole route as one purchase: the AWS Practitioner to Architect path, $89 against $98 bought one at a time.
A developer or administrator whose job has become the delivery pipeline.
DevOps or platform engineer
Two credentials matter here and they answer different questions. The cloud platform's own DevOps exam proves you can design delivery on that platform; the Kubernetes exams prove you can operate the thing everything is deployed onto, and they are hands-on rather than multiple choice.
The prerequisite in practice and on paper: DevOps Engineer Expert is only awarded to holders of an Azure associate certification.
Pipelines, source control strategy, security and instrumentation, across both Azure DevOps and GitHub.
Hands-on Kubernetes administration. Two hours in a terminal against live clusters, and it cannot be passed by recognition.
What this role does not need. Do not start with Kubernetes if you do not yet run it. CKA assumes containers and daily cluster work, and it is an expensive way to learn either.
These routes are our reading, not a vendor’s. Where a vendor states a prerequisite we follow it, and the rest is the order that makes each exam readable when you reach it. Nothing here claims a salary, a hiring rate or what any employer requires, because those numbers are the easiest in this category to make up.
One route, one purchase.
A certification path buys every exam in the sequence at once, for less than the same certifications bought separately, and nothing in it expires.