Everything you need to know about how the IIBA-CCA exam is structured — questions, time, scoring, and exactly how the marks are distributed.
75 multiple-choice knowledge-based questions in 90 minutes. Taken online with remote proctoring (PSI); on-screen pass/fail result at completion.
IIBA publishes how the 75 questions are distributed (IIBA-CCA Handbook). Weight your preparation to match — this is the single most useful planning fact:
| Area | Weight | |
|---|---|---|
| Data Security | 15% | |
| User Access Control | 15% | |
| Cybersecurity Overview & Basic Concepts | 14% | |
| Enterprise Risk | 14% | |
| Solution Delivery | 13% | |
| Cybersecurity Risks & Controls | 12% | |
| Operations | 12% | |
| Securing the Layers | 5% |
Data Security is the heaviest at 15% — most candidates under-weight it.
6 free questions · explanation for every option · per-area readiness · no dumps.
Start free →75 multiple-choice knowledge-based questions in 90 minutes.
IIBA does not publish a numeric cut score — results are pass/fail with per-area performance indicators. Aim for a consistent 80–85% on realistic mocks before booking.
IIBA does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
No formal prerequisites — no required work experience, PD hours, or references. IIBA recommends roughly 2 years of work in the specialty area.
No application fee. Learning + Exam bundle $395 (member) / $550 (non-member); Learning-only $195 / $250 — check iiba.org for current packaging.
For most candidates, around 25–45 hours (no official IIBA figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
None — the CCA is a knowledge-based certificate and does not expire.
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against IIBA's policies.