CNCDP

Both, but judgment dominates. Factual recall (ports, log formats, framework names) gets you partway; most items describe a situation and ask for the best next action, the most likely cause, or which evidence matters. Candidates who memorized lists without practicing decisions on realistic scenarios often find the questions harder than expected.

Those figures are set by the certifying organization and can change between exam versions, so check its official website for the current blueprint rather than relying on secondhand numbers. Use the published count and duration to plan your pacing: roughly one minute per item is a common starting assumption, but confirm against the real figures.

The format includes both single-answer multiple choice and multiple-response items where two or more options are correct. Multiple-response questions typically award no partial credit, so read the stem for cues like "choose two" and treat each option as independently true or false before committing.

It sits above foundational exams. Expect fewer definition questions and more multi-step scenarios spanning several domains at once - for example, an intrusion that requires you to pick a containment action, justify it against business constraints, and identify the evidence to preserve. Hands-on familiarity with a SIEM, packet capture, and an IR process helps considerably.

Start with the two heaviest domains, security monitoring and detection, and incident response, then layer in architecture and threat intelligence, which give context for detection decisions. Leave governance and forensics for later but do not skip them; forensics questions about evidence integrity and chain of custody are easy points if you know the principles.

Three patterns recur: choosing the most aggressive response (wipe and rebuild, block everything) when the stem asks for the least disruptive correct step; confusing detection with prevention; and ignoring scope language such as "first" or "best." Another common error is treating compliance requirements as optional context when the scenario explicitly constrains the responder.

Retake eligibility, waiting periods, and any associated costs are defined by the certifying body and are not fixed across providers or exam versions. Consult its official site or your candidate handbook for the current policy before booking, and factor the waiting period into your study plan if a second attempt may be needed.

Validity periods and renewal mechanisms vary and are set by the certifying organization. Check its official website for the current recertification requirements, whether renewal is by retaking the exam, earning continuing education credits, or paying a maintenance fee, and note the deadline so your credential does not lapse.

Prerequisites are determined by the certifying body; confirm them on its official site. Regardless of formal requirements, the exam assumes comfort with network traffic analysis, log review, and at least one incident response lifecycle. If you lack that, build it through labs and tabletop exercises before scheduling.

Shift from reading to retrieval and simulation. Write one-page summaries per domain from memory, then check them. Time yourself on practice scenarios, especially multiple-response items, and rehearse explaining your reasoning aloud. Review your weakest domain once more, but avoid cramming new tools you have never used.