The number most people look up is the USD 199. The numbers that actually decide what CC costs you are further down ISC2’s policy pages: a retake ladder that gets steeper at every rung and then stops altogether, and the fact that ISC2 never tells you your score, so you cannot know how close a failure was.
Everything below comes from ISC2’s own certification and policy pages, and is explicit where ISC2 publishes nothing. Verified 18 September 2026.
The logistics at a glance
| Exam | USD 199 |
| With Peace of Mind Protection | USD 299 — two attempts, 180-day access |
| Exam-only access window | 365 days from purchase |
| Unused exam | Not refunded if you do not sit within the window |
| Wait after attempt 1 | 30 test-free days |
| Wait after attempt 2 | 60 test-free days |
| Wait after attempt 3 and beyond | 90 test-free days |
| Attempts allowed | Maximum 4 in any 12-month period |
| Reschedule fee | USD 50 (Pearson). Not possible within 24 hours of the appointment |
| Cancellation fee | USD 100 (Pearson) |
| Score reported | None. Pass or fail; proficiency levels by domain on a failure |
| Result timing | Unofficial result at the test centre; ISC2 warns results can be delayed roughly six to eight weeks |
| Annual maintenance fee | USD 50 a year; USD 135 once you hold another ISC2 certification |
| Testing centre | Pearson |
The ladder steepens, and then it ends
Fail once and you wait 30 test-free days. Fail again and it is 60. From the third attempt onward it is 90 days between sittings. On top of that there is a ceiling most candidates never read about: a maximum of four attempts in any 12-month period.
Put the two together and the arithmetic is unforgiving. Four attempts at USD 199 is most of USD 800, spread across the best part of a year, and at the end of it you are out of attempts until the 12-month window rolls forward.
Can you settle a CC question in under a minute?
Timed practice against the two-hour limit, with a written explanation for every answer — so the questions you get wrong are the ones you learn from.
- Full-length timed tests that hold you to the real two-hour limit
- An explanation for every answer, right and wrong
- Original questions written from ISC2’s published outline — never real exam content
On Udemy · lifetime access · 30-day refund policy applies
Straight answer before you click: our CC question bank was written against the previous exam outline and is being rebuilt for the domains that took effect on 1 September 2026. Until that is done it is useful for the fundamentals that did not change — and it does not yet cover the new governance, cloud and threat-intelligence material. We would rather tell you that here than have you find out afterwards.
Comparing entry points? CompTIA Security+ practice tests. Heading for cloud instead? AWS Solutions Architect Associate practice tests.
You will never see a score
ISC2 states that no scores are provided. A pass is a pass; a failure comes with a list of proficiency levels for each domain, handed to you at the test centre. That report is the only diagnostic you get, and it is the thing to act on before booking again — particularly now, because a weak showing in Security Governance or Networking and Cloud Security may simply mean your study material predates the 1 September 2026 outline.
It is also worth knowing that results are not always immediate. ISC2 warns that when a statistical analysis is pending, results can be delayed by roughly six to eight weeks, and that in some instances real-time results may not be available. If you are certifying to a deadline, do not assume you will walk out knowing.
The window, and the fees around it
Exam-only access gives you 365 days from purchase to schedule and sit; Peace of Mind Protection gives 180 days but includes a second attempt. Miss the window and the fee is not refunded. Pearson charges USD 50 to reschedule and USD 100 to cancel, and you cannot reschedule inside 24 hours of your appointment.
One narrow exception worth naming: candidates in the One Million Certified in Cybersecurity programme sitting CC for the first time by 31 December 2026 pay no rescheduling fees. That programme closed to new entrants on 20 May 2026, so this applies only if you already hold an unexpired code.
Exam day has tightened
Since June 2026 the ISC2 Exam Agreement prohibits phones, recording devices and other electronics, and Pearson has begun additional screening at check-in using infrared and metal-detection wands to detect covert recording devices. Plan to arrive with nothing you would mind locking away.
Where practice questions fit
Practice questions are a diagnostic, not a syllabus. Their job is to find the domain you are weak in and to train you to commit to an answer quickly, which matters more on an adaptive exam than on a fixed one. Used that way — timed, reviewed, and written from the published outline — they are the most efficient preparation available in the last few weeks.
One caution that matters more than it appears to. Sites offering “real exam questions”, brain dumps or leaked CC content are selling you a violation of the ISC2 Examination Agreement and Non-Disclosure Agreement, and ISC2 states it may revoke certifications and ban you from earning future ones. They are also stale by construction: the outline changed on 1 September 2026, so anything harvested before then describes an exam that no longer exists.
Practise under the clock, not just the syllabus.
A booking checklist
- Decide between exam-only and Peace of Mind Protection before you buy — the second attempt is cheaper bought upfront than a second full sitting.
- Diarise the end of your access window; an unused exam is not refunded.
- Make sure your name matches your ID exactly, or you will not be allowed to sit.
- Be ready before the first attempt: the waits get longer and the attempts are capped.
- Diarise your certification anniversary for the USD 50 annual fee.
For the exam parameters themselves — format, scoring and the current domains — see our ISC2 Certified in Cybersecurity (CC) exam guide.
Frequently asked questions
How soon can I retake the CC exam if I fail?
After 30 test-free days following your first attempt, 60 days after your second, and 90 days after your third and every attempt after that. You may sit an ISC2 exam a maximum of four times in any 12-month period.
How much does the CC exam cost?
USD 199 for the exam, or USD 299 with Peace of Mind Protection, which includes two attempts. Pearson charges USD 50 to reschedule and USD 100 to cancel.
Do I find out my CC exam score?
No. ISC2 provides no scores. You receive a pass or fail, and candidates who fail are given a list of proficiency levels for each domain at the test centre.
How long do I have to sit the exam after buying it?
365 days from the purchase date for exam-only access, or 180 days with Peace of Mind Protection. If you do not sit within the window your fee is not refunded.
What happens if I let my CC lapse?
There is a 90-day grace period to submit outstanding CPE credits and fees. Suspension can run up to two consecutive years, after which the certification is terminated and reinstating it requires retaking and passing the exam.
Sources. All exam parameters above come from ISC2’s own CC certification page and exam outline (effective 1 September 2026), its article on the updated exam, its exam policy pages and its Annual Maintenance Fee page, accessed 18 September 2026, together with its 22 April 2026 press release on the conclusion of the One Million Certified in Cybersecurity programme. Exam parameters change; if you spot a discrepancy, check ISC2’s page and tell us so we can correct it.
Disclosure and disclaimer. FoxMedium publishes independent study material. Our practice tests are not official ISC2 content and are not endorsed by, affiliated with, or representative of ISC2 or the official certification examination. All questions are original and written from publicly published exam outlines. We do not host or distribute real exam content. Links to our courses earn us revenue if you enrol. ISC2, CC, Certified in Cybersecurity, CISSP and all related trademarks belong to their respective owners.
