CAP Practice Test

Security and compliance professionals who need the Certified Accreditation Professional credential from ISC2 take this test to validate their authorization skills. Candidates must have 2 years of cumulative paid work experience in 1 or more domains. This page offers free practice question sets written with AI tools, step-by-step explanations, and clear information on exam fees, time limits, and official content areas to help you prepare.

CAP Exam at a Glance

What changed for CAP in 2026

• Oct 26, 2026: Eligibility changed to 2 years cumulative paid work experience in 1 or more domains (previously 2 years cumulative experience in 1+ of the 7 domains (or pass and become an Associate of ISC2)).^[1]
• Oct 26, 2026: Exam fee changed to $599 (previously US $599 (Americas & other regions); EUR 575.04 (EMEA); GBP 485.19 (UK)).^[2]
• Oct 26, 2026: Number of questions changed to 125 items (previously 125 items, multiple choice and advanced item types).^[1]
• Oct 26, 2026: Passing score changed to 700 out of 1000 points (previously 700 out of 1000).^[1]
• Oct 26, 2026: Score release changed to Unofficial result at checkout; official result emailed (previously Unofficial result at test center; official result emailed by ISC2).^[5]
• Oct 26, 2026: Renewal changed to 60 CPE credits per 3-year cycle and $135 annual maintenance fee (AMF) (previously 60 CPEs per 3-year cycle (min 20/year) + US $135 AMF).^[4]

What the CAP is and how it works

According to ISC2, “Number of items 125 Item format Multiple choice and advanced item types”^[1]

The Certified Accreditation Professional assessment evaluates risk management and information security authorization capabilities under ISC2 standards. Pearson VUE test centers worldwide administer the examination in English only, offering continuous registration year-round without fixed seasonal windows. Candidates can purchase an exam voucher valid 365 days to schedule their sitting, and standard registration costs $599. Local testing availability, center hours, and applicable taxes vary by location and jurisdiction, so review the official Pearson VUE and ISC2 websites for regional booking details.

Qualifying for the credential requires 2 years cumulative paid work experience in 1 or more domains. The examination format includes 125 items delivered over a time limit of 3 hours. Scoring is based on a scaled standard, requiring 700 out of 1000 points to pass. Test staff provide an unofficial result at checkout upon finishing, followed by an official result emailed by ISC2. Once certified, members maintain status over each 3-year certification cycle by logging 60 CPE credits per 3-year cycle and paying the $135 annual maintenance fee.

CAP content outline and where to practise each area

The content areas below are copied from the official CAP content outline published by ISC2, with the share of the exam each area carries. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through CAP questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: In the RMF, which step involves determining the security category of the information system?

1. Authorize
2. Monitor
3. Categorize
4. Implement

Answer: C. Categorize

Explanation:

Option C is correct because the Categorize step identifies the potential impact on confidentiality, integrity, and availability, establishing the security category of the system and its processed information. Option A is incorrect because Authorize represents the executive determination by an authorizing official to accept operational risk. Option B is incorrect because Monitor occurs after authorization to track ongoing control effectiveness and environment changes. Option D is incorrect because Implement involves putting the selected security controls into operational practice. As a general rule, remember that categorization always precedes control selection and implementation because baseline protection requirements depend directly on the categorized impact level.

Example 2

Question: Which continuous monitoring activity involves testing a subset of controls each year rather than all controls simultaneously?

1. Penetration testing
2. Rolling assessments
3. Baseline reconfiguration
4. Risk acceptance

Answer: B. Rolling assessments

Explanation:

Option B is correct because rolling assessments divide controls into partitioned groups evaluated across alternating cycles, ensuring consistent oversight without requiring an exhaustive review in a single event. Option A is incorrect because penetration testing simulates adversarial attacks to discover exploitable vulnerabilities rather than systematically reviewing control subsets. Option C is incorrect because baseline reconfiguration alters technical settings or security parameters instead of assessing existing safeguards. Option D is incorrect because risk acceptance acknowledges known vulnerabilities without performing control evaluations. As a general rule, continuous monitoring programs distribute assessment tasks over recurring schedules to maintain valid risk insight while managing operational workload.

Example 3

Question: A CAP is tasked with ensuring that all departments adhere to new accreditation standards recently updated by the accrediting body. What is the CAP’s best initial step to ensure compliance?

1. Conduct an organization-wide audit to assess current compliance
2. Update the policies and procedures alone and distribute them
3. Inform the heads of departments to make the necessary updates
4. Hold a series of training sessions to educate staff on the new standards

Answer: D. Hold a series of training sessions to educate staff on the new standards

Explanation:

Option D is correct because educating personnel through structured training sessions builds immediate comprehension of revised accreditation standards, allowing staff to ask questions and implement necessary procedural adjustments correctly. Option A is incorrect because auditing an organization before employees understand revised standards identifies predictable failures without addressing root knowledge gaps. Option B is incorrect because rewriting documentation in isolation ignores departmental workflow nuances and hinders practical adoption. Option C is incorrect because passing instructions to department heads without baseline educational support creates inconsistent interpretations across teams. As a general rule, organizational compliance initiatives must establish clear stakeholder understanding before conducting audits or expecting uniform execution.

How to use these practice tests

Begin preparation by downloading the official ISC2 exam outline to understand the scope of authorization and governance domains. Next, evaluate baseline knowledge using our foundational practice sets, starting with CAP Risk Management Framework and CAP Security Categorization. Review every AI-generated explanation carefully, noting the differences between governance policies, technical implementations, and oversight responsibilities.

Target weaker domains by working through focused sets such as CAP Security Control Implementation and CAP Continuous Monitoring and System Lifecycle. When answering practice items, treat each question as an opportunity to explain why incorrect options fail under authorization guidelines. In the final weeks before your scheduled appointment, complete review sessions that match the 125 items format and the 3 hours time limit. Aim for consistent scores above the required passing grade of 700 out of 1000 points to verify timing and pacing before sitting at a Pearson VUE center.

Sources & last verified

1. ISC2 — number of questions, time limit, passing score, eligibility (official source). “Number of items 125 Item format Multiple choice and advanced item types” Verified Oct 27, 2026 · source checked Oct 24, 2026.
2. ISC2 — exam fee (official source). “Certifications CC Exam CISSP Exam ISSAP Exam ISSEP Exam ISSMP Exam CSSLP Exam CGRC Exam SSCP Exam CCSP Exam Americas and all other region not…” Verified Oct 26, 2026 · source checked Oct 19, 2026.
3. ISC2 — validity, delivery (official source). “Once you purchase your exam, you have up to 365 days to schedule and sit for your exam.” Verified Oct 26, 2026.
4. ISC2 — renewal (official source). “4.2.1 members (single-certified or multi-certified), with the exception of members holding the Certified in Cybersecurity (CC) certification, are required to pay an AMF in the…” Verified Oct 26, 2026 · source checked Oct 19, 2026.
5. ISC2 — score release (official source). “Your Pearson exam proctor will give you an unofficial result when you check out at the test center. ISC2 will email you the official exam…” Verified Oct 26, 2026 · source checked Oct 19, 2026.
6. home.pearsonvue.com — registration opens (official source). “Once your form is submitted you will be redirected to the Pearson website to finalize your exam appointment.” Verified Oct 26, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.