How Hard Is the CMMC CCA Exam, Really?

Nobody publishes a pass rate for the CMMC Certified Assessor (CCA) exam. Not ISACA, which runs it, and not the Cyber AB. So the honest answer to “how hard is it?” isn’t a number. It’s a description of what the exam asks you to do, and that turns out to be more useful anyway: the CCA exam is hard in a specific way, and you can prepare for that way.

The exam at a glance

According to ISACA’s exam candidate guide, the CCA exam is 150 multiple-choice questions in four hours, in English, taken at a PSI test center or remotely proctored. Every question has four options and one best answer. It’s scored on a scale of 200 to 800, and you pass at 450.

That scale is the first thing people misread. A 450 isn’t 450 out of 800 correct, and it isn’t a percentage. It’s a scaled score, and ISACA doesn’t publish how many correct answers it takes. Any “you need 70 percent” figure you see online is a guess. (So is the 500 passing score that still turns up on some prep sites; ISACA’s current guide says 450.)

Two scoring details are worth knowing going in. There are “no penalties for incorrect answers,” so leave nothing blank. And you get a preliminary pass or fail on screen when you finish, with the official score within ten working days.

Where the questions come from

ISACA’s exam content outline splits the CCA exam into four domains, and the weighting tells you where to spend your study time:

The outline names three source documents: the DoD’s CMMC Level 2 Assessment Guide, its Level 2 Scoping Guide, and the Cyber AB’s CMMC Assessment Process (CAP). Underneath them sit NIST SP 800-171 Revision 2 and NIST SP 800-171A, which the rule ties CCA work to (32 CFR § 170.11), and 32 CFR Part 170 itself.

How it differs from the CCP exam

If you passed the CCP, you’ve seen the format: the same 200–800 scale and the same 450 to pass. The content shifts, though. The CCP outline spreads across six domains, including orientation material such as the CMMC ecosystem (5%), the Code of Professional Conduct (5%), and governance and source documents (15%). The CCA drops those and puts the weight on doing the work: 40 percent on assessing practices, against 35 percent for the CCP’s model and implementation domain; 20 percent on scoping, against 15. The CAP is a quarter of both.

Put simply, the CCP asks whether you understand the program. The CCA asks whether you can assess inside it.

What makes it hard

It tests judgment, not recall. ISACA says the questions test “practical knowledge and the application of general concepts,” and several of the outline’s task statements open with “Given a scenario.” Knowing that AC.L2-3.1.1 is about authorized access won’t get you far. Knowing what an assessor should accept as evidence that access is limited to authorized users, and what isn’t enough, is the level the exam works at.

It’s closed book. The guide lists “reference materials, study materials, paper, notes” among the prohibited items. On a real assessment, a CCA has the Assessment Guide open all week. On the exam, you have to know where the answer lives and what it says.

Four in ten questions are about assessing practices. That’s 110 requirements and their 320 assessment objectives, examined, interviewed and tested. The verbs matter: an objective that asks whether something is “defined” asks for different evidence from one that asks whether it’s “monitored” (we wrote a whole post on what the verbs in the objectives ask for).

Scoping is a fifth of it. Asset categories, what’s in and out of the assessment boundary, and how External Service Providers and enclaves change the picture. Scoping decides what everything else in an assessment applies to, so the exam treats it as its own skill.

The process has to be second nature. A quarter of the exam is the CAP: the phases, who does what, the readiness review, how findings are recorded, how POA&Ms and closeouts work, and where impartiality rules apply. It’s procedural material, and procedural material is easy to underestimate.

Time is real, but it isn’t the main problem. Four hours for 150 questions is about 96 seconds each. That’s more per question than the CCP gives you: 170 questions in three and a half hours, about 74 seconds each. The time goes to reading scenarios carefully, not racing.

Before you can sit it

The CCA is the second rung, not the first. ISACA requires an active CMMC Certified Professional (CCP) certification and completion of the required CCA course from an Approved Training Provider. The rule adds experience: at least three years of cybersecurity experience and one year of assessment or audit experience (§ 170.11(b)(6)), and a DoD 8140.03 qualification at Intermediate level or higher for the Security Control Assessor role.

One thing you don’t need first: the Tier 3 background investigation. ISACA states that “CCA candidates do not need to complete Tier 3 before taking CCA training and exam.” You need a favorable determination to hold the credential, not to sit the exam, so start the paperwork early and study in parallel.

ISACA lists the exam at US$760, or US$575 for members. Registration opens a six-month window to sit it, with one six-month extension available for US$75. The full cost picture, including the course, is in what the CCA really costs.

If you don’t pass the first time

ISACA allows “four (4) attempts within a rolling 12-month period,” with waiting periods between them, and every attempt is paid in full.

The score report shows how you did by domain, for information only, which makes it a study guide for the next attempt. A failed first attempt isn’t a disaster, but the waits and fees add up quickly, and the 90-day gaps can push your path to the credential back by months. It pays to sit the first one ready.

How to prepare for the exam this actually is

1. Study from the three source documents, not summaries of them. The questions are written against the Assessment Guide, the Scoping Guide and the CAP. Read them the way an assessor uses them.
2. Work objective by objective. For each requirement, ask what you’d examine, who you’d interview, and what you’d test, and what would make the evidence insufficient.
3. Practice scoping decisions out loud. Take a sample environment and categorize every asset. If you can’t say why something is out of scope, you don’t know yet.
4. Walk the CAP as a timeline. Who does what in each phase, and what has to be true before the next one starts.
5. Take the course close to the exam. The six-month window is generous; memory isn’t. Book the exam while the course is fresh.

Learning from assessors

The surest preparation for an exam about assessing is learning from people who assess. Our CCP and CCA courses are taught live by 1st Defense instructors who assess for a living, in alternating months so you can go from one straight to the next. Training is delivered through Shadowscape, an Approved Training Provider, and the CCA course includes the exam voucher. If you’re still working out which rung you’re on, start with CCP vs. CCA.

Sources: ISACA, CCP & CCA Exam Candidate Guide (2026); ISACA, CCA certification page, CCA exam content outline, and Get CCA Certified page (checked October 27, 2026); 32 CFR Part 170, § 170.11.