CAP-C01

Practising penetration testers and security engineers who want an exam built on realistic scenarios. The provider positions its exams as suitable both for assessing existing skills and for recruiting pentesters, so it fits candidates preparing for a hands-on offensive-security role across web, network, mobile, code, and cloud work.

Six published domains: Web Application Security and Internal Network Security (20% each), External Network Security, Mobile Application Security, Source-Code Analysis, and Cloud Security Assessment (15% each). These map closely to the provider's advertised pentest service lines, so expect scenario questions rather than isolated trivia in any one area.

We do not have verified figures for duration or item count, so we do not publish them. Confirm the current format, time limit, and question count with the exam provider or on their exam site before scheduling, since these details change between revisions and any number quoted elsewhere may be out of date.

Passing score and fee are not confirmed in our source material, so we leave them blank rather than guess. Pricing and pass marks are frequently revised and sometimes vary by region or bundle. Check the provider's exam page directly for the current fee, currency, and passing threshold before you pay.

Retake terms are not confirmed here. Many practical certification programmes include a first-attempt retake or a waiting period between attempts, but the specific policy for this exam must come from the provider. Ask about retake cost and any cooling-off period when you book, so a failed attempt does not catch you unprepared financially.

Expect practical difficulty rather than memorisation difficulty. The most common failure patterns are shallow coverage - over-preparing on web exploitation and neglecting cloud or source-code review - and weak reporting. Candidates also lose marks by not following a structured methodology or by missing the business impact of a finding.

Start with the two 20% domains, web application and internal network, since together they carry 40% of the weight. Then rotate through external network, mobile, source-code analysis, and cloud in shorter blocks. Practise each domain in a lab and write a short finding report per exercise to build the reporting habit the exam rewards.

No. This is independent study material and is not affiliated with, endorsed by, or operated by The SecOps Group or any certification body. Always treat the provider's own exam page as authoritative for format, pricing, scheduling, and policy, and use this page only for structuring your preparation.

For source-code analysis, practise static review of small applications and learn to spot injection, authentication, and cryptographic weaknesses by reading code rather than running tools. For cloud, focus on the misconfiguration classes that recur in real assessments, such as overly permissive identity policies and exposed storage, and practise writing remediation advice.