Security and compliance professionals who need the Certified Accreditation Professional credential from ISC2 take this test to validate their authorization skills. Candidates must have 2 years of cumulative paid work experience in 1 or more domains. This page offers free practice question sets written with AI tools, step-by-step explanations, and clear information on exam fees, time limits, and official content areas to help you prepare.
The CAP has 125 questions, takes about 3 hours and costs $599[1][2] (ISC2, verified Oct 26, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 125 items[1] | ISC2 · Oct 26, 2026 |
| Time limit | 3 hours[1] | ISC2 · Oct 26, 2026 |
| Passing score | 700 out of 1000 points[1] | ISC2 · Oct 26, 2026 |
| Exam fee | $599[2] | ISC2 · Oct 26, 2026 |
| Validity | 3-year certification cycle; exam voucher valid 365 days[3] | ISC2 · Oct 26, 2026 |
| Renewal | 60 CPE credits per 3-year cycle and $135 annual maintenance fee (AMF)[4] | ISC2 · Oct 26, 2026 |
| Delivery | Pearson VUE test centers worldwide, English only[3] | ISC2 · Oct 26, 2026 |
| Eligibility | 2 years cumulative paid work experience in 1 or more domains[1] | ISC2 · Oct 26, 2026 |
| Score release | Unofficial result at checkout; official result emailed[5] | ISC2 · Oct 26, 2026 |
| Registration opens | Continuous registration year-round[6] | home.pearsonvue.com · Oct 26, 2026 |
According to ISC2, “Number of items 125 Item format Multiple choice and advanced item types”[1]
The Certified Accreditation Professional assessment evaluates risk management and information security authorization capabilities under ISC2 standards. Pearson VUE test centers worldwide administer the examination in English only, offering continuous registration year-round without fixed seasonal windows. Candidates can purchase an exam voucher valid 365 days to schedule their sitting, and standard registration costs $599. Local testing availability, center hours, and applicable taxes vary by location and jurisdiction, so review the official Pearson VUE and ISC2 websites for regional booking details.
Qualifying for the credential requires 2 years cumulative paid work experience in 1 or more domains. The examination format includes 125 items delivered over a time limit of 3 hours. Scoring is based on a scaled standard, requiring 700 out of 1000 points to pass. Test staff provide an unofficial result at checkout upon finishing, followed by an official result emailed by ISC2. Once certified, members maintain status over each 3-year certification cycle by logging 60 CPE credits per 3-year cycle and paying the $135 annual maintenance fee.
The content areas below are copied from the official CAP content outline published by ISC2, with the share of the exam each area carries. The right-hand column shows which of our practice sets covers it.
| Official content area | Weight | Practice on this site |
|---|---|---|
| Assessment/Audit of Security and Privacy Controls[1] | 16% | Mixed practice tests above |
| Compliance Maintenance[1] | 13% | Mixed practice tests above |
| Implementation of Security and Privacy Controls[1] | 17% | Mixed practice tests above |
| Scope of the System[1] | 10% | Mixed practice tests above |
| Security and Privacy Governance, Risk Management, and Compliance Program[1] | 16% | Mixed practice tests above |
| Selection and Approval of Framework, Security, and Privacy Controls[1] | 14% | Mixed practice tests above |
| System Compliance[1] | 14% | Mixed practice tests above |
Prepare for the CAP - Certified Accreditation Professional exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: In the RMF, which step involves determining the security category of the information system?
Answer: C. Categorize
Explanation:
Option C is correct because the Categorize step identifies the potential impact on confidentiality, integrity, and availability, establishing the security category of the system and its processed information. Option A is incorrect because Authorize represents the executive determination by an authorizing official to accept operational risk. Option B is incorrect because Monitor occurs after authorization to track ongoing control effectiveness and environment changes. Option D is incorrect because Implement involves putting the selected security controls into operational practice. As a general rule, remember that categorization always precedes control selection and implementation because baseline protection requirements depend directly on the categorized impact level.
Question: Which continuous monitoring activity involves testing a subset of controls each year rather than all controls simultaneously?
Answer: B. Rolling assessments
Explanation:
Option B is correct because rolling assessments divide controls into partitioned groups evaluated across alternating cycles, ensuring consistent oversight without requiring an exhaustive review in a single event. Option A is incorrect because penetration testing simulates adversarial attacks to discover exploitable vulnerabilities rather than systematically reviewing control subsets. Option C is incorrect because baseline reconfiguration alters technical settings or security parameters instead of assessing existing safeguards. Option D is incorrect because risk acceptance acknowledges known vulnerabilities without performing control evaluations. As a general rule, continuous monitoring programs distribute assessment tasks over recurring schedules to maintain valid risk insight while managing operational workload.
Question: A CAP is tasked with ensuring that all departments adhere to new accreditation standards recently updated by the accrediting body. What is the CAP’s best initial step to ensure compliance?
Answer: D. Hold a series of training sessions to educate staff on the new standards
Explanation:
Option D is correct because educating personnel through structured training sessions builds immediate comprehension of revised accreditation standards, allowing staff to ask questions and implement necessary procedural adjustments correctly. Option A is incorrect because auditing an organization before employees understand revised standards identifies predictable failures without addressing root knowledge gaps. Option B is incorrect because rewriting documentation in isolation ignores departmental workflow nuances and hinders practical adoption. Option C is incorrect because passing instructions to department heads without baseline educational support creates inconsistent interpretations across teams. As a general rule, organizational compliance initiatives must establish clear stakeholder understanding before conducting audits or expecting uniform execution.
Begin preparation by downloading the official ISC2 exam outline to understand the scope of authorization and governance domains. Next, evaluate baseline knowledge using our foundational practice sets, starting with CAP Risk Management Framework and CAP Security Categorization. Review every AI-generated explanation carefully, noting the differences between governance policies, technical implementations, and oversight responsibilities.
Target weaker domains by working through focused sets such as CAP Security Control Implementation and CAP Continuous Monitoring and System Lifecycle. When answering practice items, treat each question as an opportunity to explain why incorrect options fail under authorization guidelines. In the final weeks before your scheduled appointment, complete review sessions that match the 125 items format and the 3 hours time limit. Aim for consistent scores above the required passing grade of 700 out of 1000 points to verify timing and pacing before sitting at a Pearson VUE center.
Candidates must have a minimum of 2 years cumulative paid work experience in 1 or more domains of the credential outline. Those who pass the examination before accumulating the required work history can become an Associate of ISC2 while they complete their professional experience requirement.
The exam consists of 125 items delivered in English only, and the testing session has a time limit of 3 hours. The format includes multiple choice and advanced item types administered at Pearson VUE test centers worldwide through continuous registration year-round.
A passing score requires 700 out of 1000 points. Pearson test center proctors hand candidates an unofficial result at checkout immediately after the testing session concludes. ISC2 then emails the official exam results to confirm completion, allowing eligible test takers to proceed with credential endorsement.
Standard registration costs $599 for candidates scheduling their test through Pearson VUE. Once purchased, an exam voucher remains valid for up to 365 days to schedule and sit for your exam. Registration remains open continuously year-round across authorized Pearson test centers worldwide.
Maintaining the credential requires earning 60 CPE credits per 3-year cycle along with paying a $135 annual maintenance fee (AMF). The credential operates on a recurring 3-year certification cycle, during which certified members submit approved professional education activities to ISC2 to keep their certification in good standing.
How we verify: editorial & fact-checking policy. Report an error: contact us.