As for what to master, it's too simple. Look at the recruitment positions and needs of an information security company, and you will know what you want to master. Learn from it. You haven't graduated yet. After two years, your starting point will be higher than your classmates, and you have a great chance. The certificate is of course a safe certificate, but this inexperienced one is really useless! In fact, as long as you study hard and ask what you know after graduation, you will feel better when looking for a job.