Blog Post
Comparing SC-900, ISC2 CC, and CompTIA Security+ for beginners. See what each costs, what it covers, and which one matches your background and budget.
Checking sign-in status...
Three certifications come up every time a beginner asks where to start in security: Microsoft SC-900, ISC2 CC, and CompTIA Security+. They are all marketed as entry points. They are not interchangeable.
The right first certification depends on three things: your current IT background, how committed you already are to cybersecurity, and your budget. Get those wrong, and you either overspend on an exam you were not ready for or waste weeks on a credential that does not match your target role.
Here is how each one differs, and how to pick.
Related: CompTIA Security+ Study Plan ↗
Microsoft SC-900 (Security, Compliance, and Identity Fundamentals) is Microsoft's entry-level security exam. It covers four domains: security and compliance concepts, Microsoft Entra capabilities, Microsoft security solutions, and Microsoft compliance solutions. It is vendor-specific. It assumes no hands-on background.
ISC2 CC (Certified in Cybersecurity) is a vendor-neutral credential launched in 2022. It covers five domains: security principles, security governance, IAM concepts, networking and cloud security concepts, and security operations and incident response. It was free for two years and moved to a paid model in 2026. It assumes no hands-on background.
CompTIA Security+ (SY0-701) is the most widely recognized entry-level security certification. It covers five domains: threats and vulnerabilities, architecture, implementation, operations, and governance. It assumes some networking knowledge, though there are no formal prerequisites.
| Certification | Exam fee | Renewal |
|---|---|---|
| SC-900 | $99 | None (lifetime) |
| ISC2 CC | $199 (first year AMF included) | $50/year starting Year 2 |
| Security+ | Starting at $439 | Every 3 years via CEUs |
Budget matters more than most guides admit. A beginner testing the field should not spend $439 to find out whether security interests them.
Cheapest to start: SC-900 costs $99 with no ongoing fees.
Cheapest long-term: SC-900 is the cheapest option. The ISC2 CC requires a $50 annual maintenance fee, adding $150 over a three-year cycle on top of the $199 exam fee. Security+ also requires renewal every three years.
One clarification worth noting: ISC2 requires you to pay the first $50 Annual Maintenance Fee (AMF) upon passing to activate your certification. Your year-one total is $249.
Related: SC-900 for Beginners ↗
Security+ is the most recognized of the three in job postings. It appears in five to eight times as many US listings as the ISC2 CC. It is also DoD 8140 compliant, which matters for government and defense roles.
The ISC2 CC has growing recognition but is not yet equivalent to Security+ in employer preference. It signals commitment to security as a field, and it carries ISC2 membership, which is a path to SSCP or CISSP later.
SC-900 is recognized primarily within the Microsoft ecosystem. If you work in a Microsoft 365 environment or plan to pursue SC-200, SC-300, or SC-400, it carries weight. Outside that ecosystem, its recognition is limited.
| Certification | Typical study time |
|---|---|
| SC-900 | 2-3 weeks |
| ISC2 CC | 4-6 weeks |
| Security+ | 6-10 weeks |
These assume one to two hours of focused study per day. Background matters. A candidate with networking experience can compress Security+ into four weeks. A career changer with no IT background should plan for the longer end of each range.
SC-900 is the cheapest and fastest of the three. It is a legitimate credential, not a participation trophy. But it is vendor-specific, so it is not the right choice if your target employers are not Microsoft shops.
The CC is not free anymore, which changes the calculation. But if you are serious about security as a career, the cost is reasonable and the ISC2 pathway is well-defined.
Security+ is the most expensive and longest to prepare for. It is also the one that carries the most weight in hiring. If you already have the background and the commitment, it is the strongest first step.
Beginners often ask whether AWS or Google offer a comparable entry-level security certification. Neither does, in the same sense. Both offer foundational learning paths, but neither has a dedicated beginner security exam that competes directly with SC-900, CC, or Security+.
AWS does not have a dedicated beginner security certification. AWS Certified Cloud Practitioner (CLF-C02) covers foundational security concepts alongside general cloud topics, including the Shared Responsibility Model, IAM basics, and security groups. It is a cloud certification, not a security certification. The dedicated AWS Certified Security Specialty (SCS-C03) is an advanced exam that expects hands-on AWS experience. AWS does offer a Security Essentials course through CISA's NICCS program, but this is training, not a certification exam.
Google Cloud offers a Google Cloud Cybersecurity Certificate through Coursera. This is a training program (3-6 months) rather than a certification exam. It covers security principles, risk management, and cloud security operations through interactive labs. The formal Google Professional Cloud Security Engineer is a professional-level exam suited for experienced engineers, not beginners.
Neither platform offers a beginner security certification equivalent to SC-900, CC, or Security+. Both expect you to build cloud fundamentals first and specialize later.
Do not collect all three. SC-900, CC, and Security+ overlap heavily in foundational concepts. Once you hold one, move to an intermediate certification (SC-200, CySA+, or SSCP) rather than adding another beginner credential to your resume.
The exception: if you work in a Microsoft shop and plan to pursue the SC-200 path, SC-900 followed by Security+ can make sense as a way to combine vendor-specific and vendor-neutral foundations.
Whichever you choose, the approach is similar:
If you are not sure which exam fits you best, try them on ExamOS. You can practice using the Rookie / Challenger / Legend practice modes. Once you pick, a Daily Sprint keeps you consistent, a Mock Exam tests you under pressure, and your Readiness Score shows when you are prepared to book.
Yes, you can skip it if you have networking experience or already hold a certification like Network+. Security+ assumes some foundational knowledge, but there are no formal prerequisites. Beginners without IT background will find Security+ harder without a prior certification.
It depends on your goal. If you want a vendor-neutral foundation and plan to pursue SSCP or CISSP, the certification is worth the cost. The exam fee is $199, and the $50 annual maintenance fee is due upon passing to activate the certification.
SC-900 does not expire. The ISC2 CC requires an annual maintenance fee starting in Year 2 and continuing professional education credits. Security+ requires renewal every three years through continuing education units.
Security+ is the best option. It is DoD 8140 compliant, which is often a hard requirement for government and defense roles. SC-900 and CC are not.
Not sure which exam fits you best? Try SC-900, ISC2 CC, and Security+ on ExamOS to test your skills before you commit.