Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to EC-Council’s entry-level, hands-on security certification as it stands in October 2026: exam 212-82 and its two sections, the eight blueprint domains and their weights, the 22 course modules, cost, renewal, the jobs it fits, and how it compares to Security+, ISC2 CC and CND.
CCT is EC-Council’s entry-level certification for people starting out in cybersecurity. Its exam makes you do part of the work on live machines instead of only answering questions about it.
EC-Council launched CCT in March 2022 to cover the technician’s job across network defense, ethical hacking, digital forensics and security operations. Exam 212-82 has two sections: 50 multiple-choice questions, then 10 hands-on practical questions worked in a live cyber range. A practical question is worth five marks and a multiple-choice question is worth one, so the 10 practicals carry half the score.
The credential is ANAB accredited under ISO/IEC 17024, granted in November 2024. There are no prerequisites and no eligibility application. It is issued and maintained by EC-Council, the same body behind CEH and CND. CCT is not, however, on EC-Council’s list of DoD 8140 approved certifications, which matters if you’re aiming at federal work.
50 multiple-choice questions at one mark each, 50 marks in all.
10 hands-on questions at five marks each, worked on a live cyber range. The other 50 marks.
All eight domains carry at least one practical. Network Security Controls and Network Monitoring and Analysis carry two each.
EC-Council sets the passing mark for each exam form, anywhere from 60% to 85%.
Four things that set CCT apart from the other entry-level certifications a new security hire might be asked to earn.
Most entry-level security exams are mostly multiple choice. On exam 212-82, the 10 practical questions carry five marks each, so together they are worth as much as all 50 multiple-choice questions. EC-Council runs them on a live cyber range with real target machines. That makes lab time, not flashcards, the deciding factor in how you prepare.
No experience requirement, no eligibility application and no application fee. CND, CEH and ECIH all ask for official training or documented security experience before you can sit the exam. CCT doesn’t.
EC-Council’s official course runs 22 modules and 85 hands-on labs, and EC-Council says half of the training time is lab work. The labs are where you rehearse for the practical section.
EC-Council’s list of DoD 8140 approved certifications names CEH, CEH Practical, CND, CHFI, ECIH and CCISO. CCT isn’t on it, even though it holds ANAB accreditation.
If your job falls under DoD 8140, check your work role on the DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange before you pick a first certification. Security+ and ISC2 CC are both approved qualifications.
The certification, the exam and how to keep it current, as EC-Council lists them in October 2026.
EC-Council points CCT holders toward specializations such as ethical hacking, penetration testing and digital forensics. These three EC-Council certifications are natural next steps, depending on which side of the work you want.
EC-Council’s blue-team certification, exam 312-38, 100 multiple-choice questions over 4 hours. It takes CCT’s controls and monitoring domains much further, and it asks for official training or two years of security experience. Read the CND guide.
EC-Council’s ethical hacking credential, 125 multiple-choice questions over 4 hours. CCT introduces ethical hacking and penetration testing as assessment techniques. CEH makes the attacker’s methodology the whole exam. Read the CEH guide.
EC-Council Certified Incident Handler, exam 212-89, 100 multiple-choice questions over 3 hours. The next step from CCT’s Incident and Risk Management domain for anyone heading into incident response work. Read the ECIH guide.
CCT is a first security credential. EC-Council expects you to know computers and networks going in, and the certification then opens onto the defensive, offensive and incident response tracks.
Know your way around IT
Prove the basics, hands-on
Two questions to answer before you commit: can you take the exam, and should you take CCT specifically. Here’s a straight answer to both.
No application, no experience check.
EC-Council has no eligibility criteria for CCT. You buy a voucher, which stays valid for one year, and schedule exam 212-82 through the EC-Council exam portal. EC-Council does recommend knowing computers and networks before you start, and the practical section will find out quickly if you don’t.
Minors can test, with paperwork.
EC-Council lets minors sit its exams with a written consent and indemnity letter signed by a parent or legal guardian, plus a supporting letter from a nationally accredited school. Legal age follows the candidate’s country. This matters more for CCT than most EC-Council exams, because EC-Council lists high school students among the people it is written for.
EC-Council maps more than 20 job roles to the CCT course, from IT support to ICS/OT security. These six are the closest fit for someone holding CCT as a first security credential:
The job CCT is named for. EC-Council describes it as providing technical security support, troubleshooting network security problems, monitoring alerts and following the policies and standards that protect an organization’s information.
Watches alerts, reads traffic and logs, and escalates what looks wrong. Network Monitoring and Analysis is 16% of the CCT exam and carries two practical questions, which is a first-year analyst’s shift in miniature.
Fixes the endpoints, accounts and access problems users bring to the help desk. CCT adds the security side of that work: authentication and authorization, malware, and the controls that keep a ticket from turning into an incident.
Runs the switches, firewalls and wireless networks an organization depends on. Network Security Controls, the heaviest CCT domain at 23%, covers segmentation, firewalls, IDS/IPS, VPNs and NAC.
Builds and maintains servers, virtual machines and cloud instances. CCT’s virtualization, cloud, data security and backup topics apply to anyone with administrative rights on systems that hold real data.
Assesses vulnerabilities, reads threat intelligence and helps decide what gets fixed first. CCT introduces the assessment techniques this role uses, from vulnerability assessment and threat hunting to basic penetration testing.
The three certifications candidates most often weigh against CCT: the best-known first security exam, ISC2’s entry-level credential, and the EC-Council certification many CCT holders look at next.
| CCT | CompTIA Security+ | ISC2 CC | CND | |
|---|---|---|---|---|
| Issuer | EC-Council | CompTIA | ISC2 | EC-Council |
| Current Version | Exam 212-82, blueprint published August 2024 | SY0-701 (SY0-801 launches November 17, 2026) | Exam outline effective September 1, 2026 | CND v3, exam 312-38 |
| Exam Format | 50 multiple-choice + 10 hands-on practical, 3 hours | Up to 90 questions, multiple-choice and performance-based, 90 minutes | Adaptive, 100 to 125 items, up to 2 hours | 100 multiple-choice over 4 hours |
| Passing Score | 60% to 85%, set per exam form | 750 on a 100 to 900 scale | 700 out of 1000 | 60% to 85%, set per exam form |
| Exam Cost | $499 remotely proctored voucher | $439 | $199 | $550 remotely proctored voucher |
| Prerequisites | None | None required, Network+ and 2 yrs IT recommended | None | Official training, or 2 yrs infosec experience + $100 application |
| Renewal | 120 ECE credits over 3 years + $80 annual fee | 50 CEUs over 3 years | 45 CPEs over 3 years + $50 annual fee | 120 ECE credits over 3 years + $80 annual fee |
| DoD 8140 | Not on EC-Council’s 8140 list | Approved for multiple DCWF work roles | Approved under DoDM 8140.03 | Listed by EC-Council for DCWF 511, 521 and 531 (confirm on the current matrix) |
| Good Fit For | Beginners who want a hands-on first exam | First security credential, DoD baseline roles | Complete beginners wanting a low-cost, conceptual start | Network admins and SOC staff taking on defense |
Security+, ISC2 CC and CND facts are taken from the Training Camp guides for Security+, CC and CND. Security+ and CC are the usual alternatives to CCT, and CND is a common next step once you hold it.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our official EC-Council CCT boot camp covers all 22 modules over five days, live online or in person, using EC-Council’s authorized courseware with labs every day. Your $499 exam voucher and a free retake are included, you can take exam 212-82 onsite at the end of class, and you get 180 days of one-on-one coaching afterward.
First certifications, SOC work, packet and port analysis, reading a blueprint, and how DoD 8140 approval works.
Which first certification to pick, which entry-level jobs are real, and where incident response fits as a career track. Useful context for weighing CCT against Security+, Network+ and SSCP before you spend an exam fee.
Alert triage, tier structures, shift work and what burns analysts out. SOC analyst is one of the roles EC-Council maps to CCT, so read this before you decide it’s the seat you want.
Filters, following streams and four troubleshooting scenarios. Network Monitoring and Analysis is 16% of the CCT exam and carries two practical questions, so packet analysis is time well spent.
SYN, connect, UDP, ACK and the rest, with when each one makes sense. Network security assessment techniques and tools are a CCT sub-domain inside Network Security Controls, the heaviest domain on the exam.
The other entry-level option many beginners weigh. The five domains, the adaptive format, the cost, and who CC suits better than a hands-on exam like CCT.
How to read a blueprint and turn domain weights into a study plan. The CCT blueprint rewards a close read, because a practical question counts five times as much as a multiple-choice one.
How a certification gets onto the DoD 8140 qualification matrix and why accreditation alone doesn’t put it there. Read it before you count on CCT for a federal or contractor role.
The CCT exam blueprint organizes exam 212-82 into eight domains and 22 sub-domains. The badge shows each domain’s share of the 100 marks, which counts a practical question as five marks. The color shows which of four broad areas we group it under. Click any domain for what it covers.
Seven questions, six multiple-choice and one practical. Threat sources and threat actors, the main malware types and the vulnerabilities attackers look for, then the attacks themselves and the hacking methodologies and frameworks used to describe them. Two sub-domains: Information Security Threats and Vulnerabilities, and Information Security Attacks.
Three questions, two multiple-choice and one practical, which makes it the smallest domain on the exam. It covers network security fundamentals and the identification, authentication and authorization concepts that every later domain assumes you already know.
Fifteen questions, 13 multiple-choice and two practical, and the heaviest domain by a wide margin. Administrative controls (frameworks, laws, governance and compliance programs, security policies), physical and workplace controls, and technical controls from segmentation, firewalls and IDS/IPS to VPNs, NAC, SIEM and SOAR. The fourth sub-domain covers assessment: threat hunting, threat intelligence, vulnerability assessment, ethical hacking and penetration testing.
Five questions, four multiple-choice and one practical. Application security design and testing techniques on one side, and the fundamentals of virtualization, cloud computing and cloud security on the other.
Seven questions, six multiple-choice and one practical, with the multiple-choice questions split evenly across three sub-domains: wireless network fundamentals, encryption and security measures, mobile device security, and the security of IoT and OT devices.
Six questions, five multiple-choice and one practical. Cryptography and public key infrastructure first, then data security controls, backup and retention methods, and data loss prevention techniques.
Eight questions, six multiple-choice and two practical. Network troubleshooting, traffic monitoring, and log monitoring and analysis, with the emphasis on spotting suspicious traffic. Two practical questions make this domain worth 16 marks, so time spent in a packet analyzer and a log console pays off here.
Nine questions, eight multiple-choice and one practical, across four sub-domains: the incident handling and response process, computer forensics and digital evidence, business continuity and disaster recovery, and risk management concepts, phases and frameworks. Computer forensics alone carries four of the multiple-choice questions.
EC-Council’s official course has 22 modules, one for each blueprint sub-domain and in the same order. Each badge shows the area the module belongs to.
Threat sources and threat actors, malware and its types, and the vulnerabilities attackers go looking for.
The attacks themselves, plus the hacking methodologies and frameworks used to describe how they unfold.
The core information security and network security concepts the rest of the course builds on.
How systems establish who a user is, prove it, and decide what that user is allowed to do.
Frameworks, laws and acts, governance and compliance programs, and security policies.
Physical security controls, workplace security and environmental controls.
Security protocols, segmentation, firewalls, IDS/IPS, honeypots, proxies, VPNs, UBA, NAC, UTM, SIEM, SOAR, load balancers and anti-malware tools.
Threat hunting, threat intelligence, vulnerability assessment, ethical hacking, penetration testing, and configuration and asset management.
Application security design and testing techniques.
Fundamentals of virtualization and cloud computing, and the security measures that apply to cloud environments.
Wireless network fundamentals, wireless encryption and the measures that secure a wireless network.
Mobile device fundamentals and the security measures organizations apply to phones and tablets.
Fundamentals of Internet of Things and operational technology devices, and the measures that secure them.
Cryptography concepts and public key infrastructure.
Data security controls, data backup and retention methods, and data loss prevention techniques.
Diagnosing and fixing network problems, the everyday skill a technician uses before anything looks like an attack.
Monitoring network traffic and analyzing it for signs of suspicious activity.
Collecting, monitoring and analyzing logs to find the events that need a closer look.
The incident handling and response process, from first detection through recovery.
Computer forensics fundamentals, digital evidence and the phases of a forensic investigation.
Business continuity and disaster recovery concepts and planning.
Risk management concepts, phases and frameworks.
Domains, weights and question counts come from EC-Council’s CCT Exam Blueprint for exam 212-82 (published August 2024), and the modules from EC-Council’s CCT course outline, both as of October 2026. No blueprint change is scheduled that we are aware of. Confirm on cert.eccouncil.org before you test.
The questions candidates ask most often when researching the Certified Cybersecurity Technician certification.
CCT is EC-Council’s entry-level certification for people starting a career in cybersecurity. EC-Council launched it in March 2022 to cover the technician’s job across network defense, ethical hacking, digital forensics and security operations. It is tested by exam 212-82, which mixes 50 multiple-choice questions with 10 hands-on practical questions worked in a live cyber range. There are no prerequisites, and the credential is ANAB accredited under ISO/IEC 17024.
No. EC-Council has no eligibility criteria for CCT, so there is no experience requirement, no eligibility application and no application fee. EC-Council does say candidates should know their way around computers and computer networks before they start, even though the course covers the core technologies. Minors can test with a consent letter from a parent or guardian and a supporting letter from their school.
Exam 212-82 has 60 questions in two sections: 50 multiple-choice questions worth one mark each, and 10 hands-on practical questions worth five marks each, run on a live cyber range. EC-Council’s exam details list the duration as 3 hours, and its FAQ gives 185 minutes. The exam is not open book, it is offered in English, and it is delivered through the EC-Council exam portal with remote proctoring. EC-Council sets a cut score for each exam form, and in its words, “cut scores can range from 60% to 85%.”
The blueprint has eight domains: Information Security Threats and Attacks 11%, Network Security 7%, Network Security Controls 23%, Application Security and Cloud Computing 9%, Wireless Device Security 11%, Data Security 10%, Network Monitoring and Analysis 16%, and Incident and Risk Management 13%. The weights are shares of the 100 available marks, so a domain with two practical questions counts for more than its question count suggests. Network Security Controls and Network Monitoring and Analysis are the two domains with two practicals each.
EC-Council’s store lists the remotely proctored CCT exam voucher at $499 as of October 2026, and the voucher is valid for one year. EC-Council also sells a $999 package with e-courseware, 85 labs and the voucher. Retakes are purchased by writing to EC-Council’s certification team. Training Camp’s boot camp includes the $499 voucher and a free retake, so boot camp students don’t buy the voucher separately.
CCT is part of EC-Council’s continuing education (ECE) scheme. The certification is valid for three years, and you keep it by earning 120 ECE credits in each three-year cycle and paying the $80 annual continuing education fee. Credits come from conferences, webinars, reading, writing, teaching and the other activities listed in EC-Council’s ECE policy, and passing another EC-Council exam in the scheme, such as CND, CEH or ECIH, is worth 120 credits on its own.
Both are first security certifications, built differently. Security+ (SY0-701) is CompTIA’s exam of up to 90 questions in 90 minutes, mixing multiple-choice with performance-based questions, and it is approved for multiple DoD 8140 work roles. CCT’s exam 212-82 puts half its marks on 10 practical questions in a live cyber range, and EC-Council does not list it for DoD 8140. If a job posting or a DoD contract names Security+, take Security+. Without that constraint, CCT is the more hands-on of the two.
Not according to EC-Council. Its list of DoD 8140 approved certifications names CEH, CEH Practical, CND, CHFI, ECIH and CCISO, and CCT is not among them. CCT is ANAB accredited, but accreditation by itself does not place a certification on the DoD matrix. If your position falls under DoD 8140, check the DoD 8140 Approved Qualifications Matrix at cyber.mil for your work role. Security+ and ISC2 CC are both approved qualifications.
EC-Council maps more than 20 job roles to the CCT course. The ones closest to entry level are cybersecurity technician, SOC analyst, IT support specialist, network administrator, system administrator and cybersecurity analyst. EC-Council describes the technician’s job as providing technical security support, troubleshooting network security problems, monitoring alerts and following the policies and standards that protect an organization’s information. CCT is a starting credential, so expect to pair it with experience or a follow-on certification for mid-level roles.
It asks more of you. ISC2 CC is an adaptive exam of 100 to 125 items in up to two hours, it stays conceptual, and it costs $199. CCT costs $499, runs about three hours and puts half its marks on hands-on tasks in a live cyber range, across eight domains instead of five. If cost matters most, CC gets you a DoD 8140 approved credential for $199. CCT costs $300 more, and the extra buys an exam that tests what you can do on a live system.
It depends on how much IT you already know. EC-Council’s $999 course package lists 200 hours of learning and 85 labs, which gives you a sense of how much ground there is. People who already work in IT support or network administration will find the controls and monitoring domains familiar and can put their time into forensics, cryptography and the practical questions. Training Camp’s boot camp covers all 22 modules in five days with labs every day, and you can test onsite at the end of class, which works best when you arrive with basic networking already in place.
For someone starting out who wants proof of hands-on skill, yes. It has no prerequisites, it is ANAB accredited under ISO/IEC 17024, half of its exam score comes from practical tasks on live machines, and it leads naturally into CND, CEH or ECIH. It is a weaker choice if your target job falls under DoD 8140 (EC-Council does not list CCT), if the postings you are reading ask for Security+ by name, or if you already have two or more years in security and could go straight to CND or CEH.
Tell us where you are, from choosing between CCT, Security+ and ISC2 CC to planning training for a help desk or junior SOC team, and we’ll help you map out the right path.