Frequently Asked Questions

TheCertCoach is a study platform for CRISC, CISM, CISSP, Security+, CySA+ V4 (CS0-004), and CCSP. Its lessons follow the published exam outlines and pair the material with original scenarios, explanations, progress tracking, and study planning.

The first lesson in every domain and all six 150-question practice banks are available without payment. The remaining lessons, section reviews, and domain reviews or capstones require a full-access account. See the access page for current availability.

You can read the free sample lessons without an account. Sign-in is required for protected course content and enables selected progress fields to sync between devices. Some activity remains only in the current browser, so account sync is not a complete backup.

Pick a certification track (CRISC, CISM, CISSP, Security+, CySA+ V4, or CCSP), start with Module 1, and work through at your own pace. Use the dashboard to create a study schedule.

Choose based on the work you do or want to do. CRISC concentrates on IT risk and controls; CISM concentrates on managing an information security program. Neither is universally the better first credential. See the side-by-side comparison and confirm that you can meet the experience requirement for the credential you choose.

ISACA currently states that CISM applicants need at least five years of professional information security management experience across at least three of the four CISM domains. The experience must fall within the 10 years before the application. You may take the exam before meeting the requirement, but you must qualify and apply within five years after passing.

The active 2022 CISM outline remains in effect through November 2, 2026. The revised CISM exam begins November 3, 2026, with domain weights of 18% / 20% / 33% / 29%. ISACA’s updated preparation materials begin September 1, 2026. TheCertCoach’s current CISM track does not yet cover the revised outline. See the CISM track’s source and scope note for its current coverage.

ISACA requires at least three years of professional experience across at least two of the four CRISC domains, with no experience waiver or substitution. You may take the exam before meeting the experience requirement, but you must meet it and apply within five years after passing.

Fees vary by exam, region, taxes, membership, and voucher type, and they can change. Check the certification body’s registration page before budgeting or purchasing a voucher. The figures on each certification page are dated where a price is shown.

CISM and CRISC each have 150 multiple-choice questions (4 hours, pass at 450/800). CISSP and CCSP both use CAT adaptive format with 100–150 questions (3 hours, pass at 700/1000). Security+ has up to 90 questions in 90 minutes. CySA+ V4 has up to 85 questions in 165 minutes. Both CompTIA exams include multiple-choice and performance-based items and use a 750/900 passing score.

Security+ establishes a broad vendor-neutral security foundation. CySA+ V4 goes deeper into analyst work: interpreting telemetry, prioritizing vulnerabilities, coordinating incident response, and reporting findings. CompTIA recommends relevant hands-on experience for CySA+ but does not require Security+ as a prerequisite.

Yes. The CySA+ track follows the four-domain CS0-004 V4 outline for the exam launched June 23, 2026. Its domain weights are 34% Security Operations, 26% Vulnerability Management, 24% Incident Response and Management, and 16% Reporting and Communication. The track contains 61 lessons and reviews plus a 150-question practice bank.

Both tracks are available. Security+ contains 61 lessons and reviews across five domains, while CISSP contains 84 across eight domains. Each track includes section reviews, domain capstones, and a 150-question practice bank.

We map lessons to the active exam outline, explain concepts in context, and use original questions to practice choosing between plausible answers. The rationales focus on the facts that control the decision instead of relying on a universal keyword rule. Read more about the method.

There is no reliable schedule that fits every candidate. Start with your available weekly time, prior experience, the number of domains you need to cover, and the exam date you are considering. The study scheduler can distribute the track across that time; adjust it when your results show that a domain needs more work.

Each track has a 150-question practice bank. Choose one of the set sizes offered by that track, answer original scenarios, and get feedback with explanations. Scores are tracked over time.

CISM, CRISC, and CCSP each include one structured simulation scored against a versioned 100-point practice rubric. “Submitted” means every required decision was recorded. “Practice benchmark met” means the attempt earned at least 80 points without a defined critical error. Either result is activity evidence only; it does not verify workplace competence, predict an exam result, or change the Practice Readiness Estimate. CISSP and Security+ currently provide unscored decision worksheets instead.

It is a 10-question pilot mapped to objectives 6.1–6.5 in the current CISSP outline. Results show limited practice evidence and link back to the mapped lessons. The check is not an ISC2 score, psychometrically validated assessment, mastery claim, or pass prediction, and it does not change the Practice Readiness Estimate.

No single percentage proves readiness because third-party question banks do not reproduce the certification body’s scoring model. The dashboard’s Practice Readiness Estimate and “Strong Practice Evidence” label summarize activity recorded on TheCertCoach; neither predicts nor guarantees an exam result. Look for stable results on fresh mixed sets, coverage of every domain, and the ability to explain why close alternatives are wrong. See When Are You Ready to Sit? for a practical checklist.

No. The dashboard provides personal study-group planning templates and calendar exports that you can use for your own group or solo schedule. Saving a template does not enroll you in a live cohort, contact other learners, or create a notification service.

Signing in enables cross-device sync for selected progress fields, but it is not a complete automatic backup. Module notes, bookmarks, knowledge-check results, and Decision Lab drafts, artifacts, and private reflections remain in the current browser. A local copy can also remain when an account update is not confirmed. If the dashboard shows a sync warning, follow its retry guidance. See the Privacy Policy for details.

Clearing site data removes browser-only information, pending sync records, and local copies. Fields that were successfully synced can load again after you sign in; browser-only or unsynced work cannot. Signing out alone does not erase local study data. It switches the site to its guest view and keeps account-scoped records for the matching account, so clear site data before handing a shared device to someone else.

Yes. You can start another attempt, choose a different set size, and review saved attempt history. Questions are shuffled, but the bank is finite, so repeated exposure eventually measures familiarity as well as knowledge.