- What This Credential Actually Is
- The Exam at a Glance
- The Four Formal Domains
- Four Domains vs. 25 Preparation Modules
- Eligibility: Two Routes, One Conflict
- Fees, Retakes and Booking Mechanics
- Online Proctoring Realities
- Version Naming and What Is Unverified
- Validity, Renewal and Accreditation
- Sequencing Your Preparation Around the Domains
- Who Might Value It
- Frequently Asked Questions
- The current Level 1 exam lists 100 questions, 120 minutes and a 62% passing threshold, delivered through online proctoring.
- Four formal domains cover governance, risk assessment, risk management and incident response; no domain weights are published.
- The 25 course modules are preparation topics, not 25 exam domains, and they carry no official percentages.
- Certification lasts two years; renewal requires 100 Rocheston Continuing Education credits submitted with evidence.
What This Credential Actually Is
The Rocheston Certified Cybersecurity Engineer - Level 1 (RCCE) is a cybersecurity credential governed by Rocheston and administered through the Rocheston Department of Certification (RDoC). If you are new to the acronym, our explainers on what RCCE certification is and what RCCE stands for cover the basics. Because "RCCE" is also used by other credentials elsewhere, this article is strictly about the Rocheston Level 1 offering.
The credential sits at the foundation of the Rocheston ladder. The official course page frames it around hacking and cyber defense, but the formal examination outline is narrower than the course title suggests. It centers on policy, risk and incident handling rather than a pure offensive-skills test. That distinction matters: a candidate who prepares only with exploitation labs and ignores governance will be badly misaligned with the exam outline.
The Exam at a Glance
The current exact Level 1 page and the linked Candidate Handbook agree on the headline specifications. Here is what is verified and what remains unpublished.
| Attribute | Current published detail |
|---|---|
| Questions | 100 |
| Time allowed | 2 hours (120 minutes) |
| Passing threshold | 62% |
| Delivery | Online, proctored (Rocheston Ramsys named on the Level 1 page; handbook also names Cyberclass) |
| Item types | Level 1 page: multiple-choice, true/false and short-answer; handbook: objective multiple-choice only |
| Scored vs. unscored split | Not published |
| Domain weights | Not published |
Two cautions follow from this table. First, the item-format conflict is real: do not assume the exam is multiple-choice only, and do not assume it includes hands-on performance tasks. Short-answer items mean you should be able to articulate concepts in your own words, not merely recognize them. Second, the five-day figure you may see in marketing describes training length, not exam time. Labs and any capstone belong to the course, not to a separate timed certification practical.
For a deeper look at difficulty, see our guide on how hard the RCCE exam is, and for threshold specifics, the page on the RCCE passing score. Note that 62% is a passing threshold, not a candidate pass rate; no verified population pass-rate series exists, which is why we discuss that topic qualitatively in our RCCE pass rate article.
The Four Formal Domains
The Candidate Handbook, linked directly from the exam section of the Level 1 page, lists four examination domains. They are reproduced below with practical guidance on what each implies for your study. For a longer treatment, read the complete guide to all four RCCE content areas.
Domain 1: Cybersecurity Policies and Governance
This domain is about the organizational layer: who sets security rules, how they are documented and how compliance is demonstrated.
- Know the purpose and hierarchy of policies, standards, procedures and guidelines.
- Understand how governance assigns accountability and ties security to business objectives.
- Be ready to explain why a control exists, not just what it does.
Domain 2: Risks/Threats/Vulnerability Assessment
Assessment is the discovery and evaluation phase. Expect questions on identifying assets, enumerating threats and finding weaknesses.
- Distinguish threat, vulnerability, exploit and risk, and use the terms precisely.
- Understand reconnaissance and how attackers map targets, since the course covers it extensively.
- Be comfortable with how assessment outputs are prioritized and reported.
Domain 3: Risks/Threats/Vulnerability Management
Management is what you do after assessment: treat, transfer, mitigate or accept, and keep the environment current.
- Link findings to remediation decisions, including patching and compensating controls.
- Understand identity and access controls as risk-reduction measures.
- Know how ongoing monitoring feeds back into the risk picture.
Domain 4: Security Incident Response and Recovery Plan
This domain covers preparing for, handling and recovering from incidents.
- Know the lifecycle of an incident from preparation through lessons learned.
- Understand roles, escalation, evidence handling and communication during an event.
- Distinguish response (containing the incident) from recovery (restoring operations) and the plan documents behind each.
Four Domains vs. 25 Preparation Modules
This is the single most common point of confusion for candidates. The Level 1 course page lists 25 modules in order, and it is tempting to treat them as the exam blueprint. They are not. They are supported preparation topics; the four domains above are the formal outline. There is no official mapping between the two, and we will not invent one.
The module list, in the order the course presents it:
- Cybersecurity Threats, Attacks and Defenses
- Cyber Vulnerabilities
- Reconnaissance, ML and Artificial Intelligence
- Web Application Attacks
- Web Shells, Spyware and Backdoors
- Denial of Service Attacks
- Hacking Frameworks
- Android Hacking
- Wireless Hacking
- Log Management and Network Analyzers
- Firewalls and IDS
- Malware Analysis
- Patch Management
- Identity and Access Management
- Cybersecurity Policies and Governance
- Security Incident Response and Recovery Plan
- Cryptography
- Blockchain and Cryptocurrency
- Quantum Computing
- Cloud Security
- Zero-Trust Architecture
- Virtualization with QEMU and Private Cloud
- IoT Security Testing and Certification
- Risk Assessment
- Risk Management
Notice that four of these modules share names with the formal domains (policies and governance, incident response and recovery, risk assessment, risk management). Those are the obvious anchor points. The remaining modules, from web attacks to cloud and zero trust, supply the technical context that makes assessment and management questions answerable. Treat them as background that sharpens judgment, not as a checklist where each module equals an exam section.
Older brochure material describes a much larger 53-module curriculum and a different question count and passing score. Those legacy modules are not appended to the current list, so do not study from them as if they were current exam content. Our RCCE study guide explains how to use the current module list efficiently.
Key Takeaway
Anchor your preparation on the four formal domains first, then use the 25 modules to deepen each one. Never report to yourself that you have covered the exam simply because you finished every module.
Eligibility: Two Routes, One Conflict
Sources differ on who may sit the exam, and the honest answer is to preserve those differences rather than flatten them.
- Course page: basic IT knowledge is expected, including networking, operating systems, command line and web concepts. No previous hacking experience is required for the course itself.
- Eligibility/application page: two routes. Either complete authorized RCCE training and hold an attendance certificate, or use self-study plus two years of cybersecurity work experience supported by a supervisor or employer letter.
- Candidate Handbook: states a two-year cybersecurity work-experience minimum without describing the authorized-training exception.
Older Version 6 material mentions degree and experience language that should not be treated as a universal current requirement. The practical advice: read the dedicated application page before you pay for anything, decide which route you are on, and gather the attendance certificate or employer letter early. Our RCCE requirements article walks through qualifying in more detail, and the RCCE training overview covers the authorized-course route.
Fees, Retakes and Booking Mechanics
The generic official Certification Exam Policies and Procedures lists USD 499 for the examination and USD 499 for a retake, with no member and non-member tiers. However, the current Level 1 page asks candidates to request a regional and format-specific quote and to confirm whether the exam is bundled with training. No universal current training price is published. A partner's advertised voucher price does not replace the issuer's tariff, so confirm with Rocheston directly.
On scheduling: the current exact page specifies online Rocheston Ramsys proctoring. Pearson VUE maintains a Rocheston program page (updated September 17, 2026) that mentions Levels 1 and 2, but availability of the exact current 100-question Level 1 form through Pearson was not verified. Do not assume bookings are interchangeable between providers or that formats are identical. For timing questions, check the RCCE exam dates page and confirm with your provider.
Online Proctoring Realities
This is not unrestricted open-book testing. The linked policies require online identity verification, a room inspection and a secure browser, and outside books, notes and electronics are not permitted. The public Proctoring Candidate Manual (version 1.0, dated July 15, 2021) describes several conditions worth planning for:
- A Windows environment running Safe Exam Browser.
- No extra screens and no headphones.
- No ordinary toilet breaks during the sitting.
- Calculators only when the exam instructions explicitly allow them.
Because that manual is dated 2021, treat these details as guidance to verify, not as independently renewed 2026 platform specifications. Your booked sitting's instructions and any approved accommodations take precedence. With a 120-minute limit and no routine breaks, rehearse sitting for the full duration in a clear, quiet room before exam day.
Version Naming and What Is Unverified
Candidates searching for RCCE material will run into inconsistent naming, and it is worth being clear about it.
| Source | What it says | How to treat it |
|---|---|---|
| Current Level 1 page and linked handbook | 100 questions, 120 minutes, 62%, four domains | Controls this article's outline |
| Legacy Exam Versions page | Older Level 1 at 90 questions/70%; planned accredited 100-question/62% exam; same four-domain scheme assigned to an "ANSI" version | Historical; does not override the current page |
| Version 6 program guide (undated) | 53 modules, roughly 90 questions, 72% | Older brochure; not current |
| Trainer labels such as "2026v2" and historical codes such as RCT-79 | Appear in trainer or announcement contexts | Not verified issuer exam versions or booking codes |
Several official documents could not be fully retrieved during research, including the current syllabus brochure, the exam brochure and the Level 1 study guide download, so their contents are not reflected here. Likewise, reposted study-guide previews are not authoritative. When you register, ask Rocheston to confirm the exact exam form and version you will sit.
Validity, Renewal and Accreditation
The certification is valid for two years. To maintain it, you earn 100 Rocheston Continuing Education (RCE) credits per certification per two-year cycle and submit supporting evidence through Roxy. Credits are not automatically the same as training hours. The RCE policy describes five activity categories worth 20 credits each, though its detailed table duplicates the mentoring row rather than clearly detailing the workshop and lab category, so we do not guess at that allocation. If the certification expires without enough credits, reinstatement requires passing the latest examination. A current numeric renewal fee was not verified, and lifetime-validity marketing claims should be disregarded.
On accreditation, the ANAB directory lists Rocheston Pvt. Ltd. (accreditation ID 8900) with RCCE in scope, for a period running through June 21, 2027. That is credential-specific accreditation. It is not blanket accreditation of every Rocheston credential, and it does not prove that every legacy Level 1 form is the same accredited exam.
Sequencing Your Preparation Around the Domains
Since the domains build on one another, a logical order helps. Governance supplies the vocabulary; assessment and management give you the risk lifecycle; incident response tests whether you can apply it under pressure. A sample plan, adjustable to your own schedule and background:
Governance foundations
- Study policies, standards and accountability (Domain 1).
- Read the governance and policy module and write your own one-paragraph summaries.
Assessment
- Work through threats, vulnerabilities and reconnaissance (Domain 2).
- Use the Rose OS labs where your course provides them to see assessment techniques in practice.
Management
- Cover patching, identity and access, and risk treatment decisions (Domain 3).
- Practice explaining why you would choose mitigation over acceptance in a given scenario.
Incident response and full review
- Memorize the incident lifecycle and recovery planning concepts (Domain 4).
- Take timed practice sets on the practice test site, sitting the full 120 minutes at least once.
This order reflects dependencies, not exam weighting. Because short-answer items may appear, rehearse writing concise definitions and justifications, not just selecting answers. For quick last-day revision, the RCCE cheat sheet condenses the must-know facts, and you can drill questions with the RCCE practice questions to find gaps.
Who Might Value It
Because the formal domains emphasize governance, risk and incident response, the credential maps naturally to roles that sit between technical and managerial work: security analysts, risk and compliance staff, junior incident handlers and IT professionals moving into security. Training providers and Rocheston-affiliated resources promote it for these audiences, and our RCCE jobs overview discusses how it appears in job listings.
A word of restraint on money: no verified certification-specific salary premium exists, and training-provider career pages are context, not proof that the credential causes higher pay. For a balanced view, read the RCCE salary guide and the is RCCE worth it analysis, and weigh the credential against your own role, employer recognition and budget.
Relative to other well-known certifications, RCCE Level 1 is a distinct Rocheston credential, so verify that employers in your target market recognize it before committing. It is also separate from Level 2, so do not assume content or format carries across levels.
Frequently Asked Questions
The current exact Level 1 page and the linked handbook both specify 100 questions in two hours (120 minutes). The split between scored and unscored questions is not published.
The current page, handbook and scoring policy state 62%. Older figures of 70% and 72% appear in legacy materials but do not override the current specification. Details are in our passing score article.
No. The four formal domains are governance, risk and vulnerability assessment, risk and vulnerability management, and incident response and recovery. The 25 modules are preparation topics with no official weighting or mapping to those domains.
The official exam policy lists USD 499 for the exam and USD 499 for a retake, though the Level 1 page asks for a regional quote and bundle confirmation. The handbook mentions one free attempt after a failure, which conflicts with the paid-retake policy, so confirm before booking.
Two years. Renewal requires 100 Rocheston Continuing Education credits with supporting evidence submitted through Roxy; without them, you must pass the latest examination to be reinstated.
Whichever route you take, confirm the live exam form, fee and retake terms with Rocheston directly, then build your preparation around the four formal domains and use the module list to fill in the technical depth.