SC
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The SC designation is a vendor-neutral certification for security practitioners who want to demonstrate breadth across the full security discipline rather than depth in a single product or platform. It suits security analysts, engineers, administrators, and consultants who already touch several domains in their day-to-day work and want a credential that reflects that range, as well as candidates moving from a narrow technical role into a broader security position. The exam is built around eight domains: security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. Expect conceptual questions that test judgement and prioritisation as much as recall, with scenario stems that ask what you should do first or which control best fits a described situation. Preparation usually combines a structured study guide or course with hands-on familiarity with the technologies named in the domains, then practice questions used to expose weak areas rather than to memorise answers. Because the domains overlap heavily, most candidates do best by studying them in order and revisiting governance and risk concepts, which frame decisions in every other domain. Confirm eligibility, scheduling, and current exam details with the certifying body.
What you'll study
About SC preparation
What is the exam format?
It is a multiple-choice exam delivered at a testing centre or online proctored. Questions are scored individually, and some may be unscored pilot items, so a small number of questions you answer will not count. Check the certifying body's candidate handbook for the current delivery options and item types before you book.
How long is the exam and how many questions are there?
The certifying body publishes the current question count and time limit on its official site, and these change between exam versions, so treat any number you see in forums as unreliable. Plan for a session long enough that pacing matters, and confirm the exact figures when you schedule.
How much does it cost and how do I pay?
Fees vary by region and are set by the certifying body, so the official site is the only reliable source. Many providers offer member and student rates, and some employers reimburse. Confirm the current fee, accepted payment methods, and any rescheduling charges before you commit to a date.
How hard is it, and how long should I study?
Most candidates with a few years of broad security experience need one to three months of consistent study; those new to the field should allow longer. Difficulty comes from breadth, not trickery. If practice scores plateau below a comfortable margin, extend your timeline rather than booking early and hoping.
What happens if I fail? Can I retake it?
Retakes are generally allowed, but the certifying body sets waiting periods and per-attempt fees, so check its policy page. Use the score report: it usually breaks results down by domain, which tells you exactly where to concentrate before a second attempt. Do not simply re-read the same material.
What order should I study the domains in?
Follow the published domain order on a first pass, because risk management and asset security establish vocabulary used throughout. Then study your weakest domains first on the second pass. Leave security operations and software development security for later, since they draw on concepts from architecture, network, and identity domains.
Why do candidates fail?
The most common causes are studying only one or two domains in depth, memorising practice questions instead of reasoning through scenarios, and misreading stems that ask for the best or first action rather than a correct-sounding one. Weakness in risk and governance language also costs marks across every domain, so do not skip it.
Are there prerequisites or continuing education requirements?
Prerequisites and any recertification or continuing education obligations are defined by the certifying body and can change. Check the official requirements page before applying, and if you are certified, track your continuing education credits from the start rather than scrambling at renewal time.
How should I use practice questions?
Use them as diagnostics, not flashcards. After each set, write down why every wrong option was wrong; that reasoning is what the exam tests. Track accuracy by domain so you can see whether a weak score reflects missing knowledge or poor question reading, and revisit the underlying topic before attempting more items.