- The Four Formal RCCE Exam Domains
- Domain 1: Cybersecurity Policies and Governance
- Domain 2: Risks/Threats/Vulnerability Assessment
- Domain 3: Risks/Threats/Vulnerability Management
- Domain 4: Security Incident Response and Recovery Plan
- Four Domains vs. 25 Preparation Modules
- Exam Format, Time Limit and Passing Score
- Sequencing Your Study Around the Domains
- Fees, Proctoring and Eligibility
- Frequently Asked Questions
- The RCCE Level 1 exam is organized around four domains, from policy and governance through incident response and recovery.
- Rocheston publishes no percentage weights, so never assume each domain carries 25% of the exam.
- The current Level 1 page lists 100 questions, 120 minutes and a 62% passing score.
- The 25 course modules are preparation topics, not 25 official exam domains.
The Four Formal RCCE Exam Domains
The Rocheston Certified Cybersecurity Engineer - Level 1 (RCCE) exam, administered by the Rocheston Department of Certification (RDoC), is built on four examination domains. They appear in the RCCE Candidate Handbook, which the current Level 1 exam page links directly from its certification-exam section. In order, they are:
- Cybersecurity Policies and Governance
- Risks/Threats/Vulnerability Assessment
- Risks/Threats/Vulnerability Management
- Security Incident Response and Recovery Plan
Read together, they describe a lifecycle: you set the rules, find where you are exposed, treat what you find, and respond when something goes wrong anyway. That arc is useful for study, because most questions can be tied to a stage of it. If you are new to the credential itself, start with What Is RCCE Certification? before digging into the domain detail below.
Domain 1: Cybersecurity Policies and Governance
The first domain is the administrative foundation. Candidates who come from hands-on technical backgrounds often underestimate it, yet it is where an engineer learns to connect technical controls to organizational rules, accountability and compliance expectations.
What to master in Governance
Expect to reason about why policies exist, who owns them and how they shape technical decisions, not just recite definitions.
- The purpose and structure of cybersecurity policies and how they differ from standards and procedures
- Governance responsibilities: who approves, enforces and reviews security rules
- How policy ties into identity and access management, patching and acceptable-use expectations
- How governance supports risk decisions and incident readiness
The course curriculum includes a dedicated Cybersecurity Policies and Governance module, along with Identity and Access Management and Patch Management modules that supply the technical context policies are written to control. Think of Domain 1 as the layer that makes everything else defensible: a vulnerability program without a patching policy, or an incident plan without defined authority, is just a set of good intentions.
How governance questions tend to appear
Because the exam can include short-answer items according to the current Level 1 page, be ready to explain a governance concept in your own words, not only to recognize it among distractors. Practice stating, in one or two sentences, what a policy is for and what it obliges people to do.
Domain 2: Risks/Threats/Vulnerability Assessment
The second domain is about finding and characterizing exposure. It is the most naturally technical part of the outline, and it overlaps heavily with the attacker-centric modules in the Rocheston course, which is known for hands-on offensive and defensive labs.
What to master in Assessment
Assessment is about understanding threats and weaknesses well enough to rank and communicate them.
- Distinguishing a threat, a vulnerability and a risk, and how they combine
- Common attack categories: web application attacks, denial of service, malware, wireless and mobile targets
- Reconnaissance and how attackers gather information before acting
- The role of scanners, hacking frameworks and log or network analysis in discovering weaknesses
- Ethical limits: assessment activity belongs only in authorized environments
Several course modules map naturally onto this territory in spirit, including Cyber Vulnerabilities; Reconnaissance, ML and Artificial Intelligence; Web Application Attacks; Web Shells, Spyware and Backdoors; Denial of Service Attacks; Hacking Frameworks; Android Hacking; Wireless Hacking; and Risk Assessment. Rocheston does not publish an official module-to-domain mapping, so use these as a study aid and not as a guarantee of exam coverage.
Domain 3: Risks/Threats/Vulnerability Management
Where Domain 2 finds problems, Domain 3 handles them. This is the treatment side of the lifecycle: prioritizing, mitigating, monitoring and keeping defenses current.
What to master in Management
Management questions ask what you do after the findings are in hand.
- Prioritizing remediation and choosing among mitigation, transfer, acceptance and avoidance
- Patch management as an ongoing operational process
- Defensive controls such as firewalls and intrusion detection systems
- Monitoring through log management and network analyzers
- Architectural approaches like zero-trust and sound cloud security practice
- Cryptography as a control for protecting data and communications
The curriculum modules that most plausibly support this domain include Patch Management; Firewalls and IDS; Log Management and Network Analyzers; Identity and Access Management; Cryptography; Cloud Security; Zero-Trust Architecture; Virtualization with QEMU and Private Cloud; IoT Security Testing and Certification; and Risk Management. Again, this is a study aid, not an official mapping.
Assessment versus management: keep them distinct
The two risk domains share vocabulary, which is exactly why candidates blur them. A reliable rule of thumb: if the scenario is about discovering, measuring or classifying, you are in assessment territory; if it is about deciding, fixing, monitoring or maintaining, you are in management territory. Many exam scenarios will touch both, so practice naming which stage a described activity belongs to.
Domain 4: Security Incident Response and Recovery Plan
The final domain covers what happens when prevention fails. It is both procedural and strategic: you need to know the phases of handling an incident and how recovery planning keeps an organization operating.
What to master in Incident Response and Recovery
Be able to walk through an incident from first signal to restored operations.
- The lifecycle of incident handling: preparation, detection, containment, eradication, recovery and lessons learned
- Roles, communication and escalation during an incident
- How logs, analyzers and malware analysis feed investigation and evidence
- Recovery planning and restoring services after an event
- How governance (Domain 1) defines authority and how management (Domain 3) reduces recurrence
The course's Security Incident Response and Recovery Plan module aligns directly with this domain, and Malware Analysis, Log Management and Network Analyzers, and Cybersecurity Policies and Governance support it. For a broader plan that covers all four domains together, see the RCCE Study Guide 2026.
Key Takeaway
Treat the four domains as one continuous loop. Governance sets the rules, assessment finds exposure, management treats it, and incident response handles what slips through, feeding lessons back into governance.
Four Domains vs. 25 Preparation Modules
One of the most common sources of confusion is the difference between the exam domains and the course curriculum. The current Level 1 page lists 25 unweighted preparation modules, in this order: Cybersecurity Threats, Attacks and Defenses; Cyber Vulnerabilities; Reconnaissance, ML and Artificial Intelligence; Web Application Attacks; Web Shells, Spyware and Backdoors; Denial of Service Attacks; Hacking Frameworks; Android Hacking; Wireless Hacking; Log Management and Network Analyzers; Firewalls and IDS; Malware Analysis; Patch Management; Identity and Access Management; Cybersecurity Policies and Governance; Security Incident Response and Recovery Plan; Cryptography; Blockchain and Cryptocurrency; Quantum Computing; Cloud Security; Zero-Trust Architecture; Virtualization with QEMU and Private Cloud; IoT Security Testing and Certification; Risk Assessment; and Risk Management.
| Aspect | Four Exam Domains | 25 Course Modules |
|---|---|---|
| Role | Formal examination outline in the Candidate Handbook | Preparation curriculum on the Level 1 course page |
| Weighting | No published percentages | Unweighted |
| Coverage claim | Defines what the exam is organized around | Supported preparation topics, not an exhaustive exam-coverage guarantee |
| Mapping | No official module-to-domain mapping is published | |
Exam Format, Time Limit and Passing Score
The current exact Level 1 page and its linked handbook agree on the core specification: 100 questions in two hours (120 minutes), with a passing score of 62%. The split between scored and unscored items is not published. For deeper detail on thresholds, see RCCE Passing Score 2026, and for a realistic sense of challenge, How Hard Is the RCCE Exam?
| Item | Current Specification |
|---|---|
| Questions | 100 |
| Time | 120 minutes |
| Passing score | 62% |
| Delivery | Online proctoring (Rocheston Ramsys named on the Level 1 page; the handbook also names Cyberclass) |
| Validity | Two years |
A format conflict worth knowing about
The Level 1 page describes multiple-choice, true/false and short-answer items, while the generic handbook describes objective multiple-choice only. Because the sources disagree, prepare for both: be fluent at eliminating distractors and also able to write a concise explanation when asked. Do not assume the exam is purely multiple-choice, and do not assume it includes a separate timed hands-on practical. The five-day labs and capstone belong to the training course, not to a separate timed certification practical.
Older figures you may encounter
Older materials, including a legacy versions page and an older Level 1 brochure, cite roughly 90 questions and thresholds of 70% or 72%. These describe earlier forms and do not override the current 100-question, 62% specification. A 62% passing threshold is a cut score, not a pass rate; for what is and is not known about candidate outcomes, read RCCE Pass Rate 2026.
Sequencing Your Study Around the Domains
You only need one structured plan here, and it should follow the lifecycle logic of the domains. Governance first gives you the vocabulary that every later domain reuses; assessment before management ensures you understand what you are fixing; incident response last lets you tie everything together. Adjust the length to your own background and available time.
Governance foundations (Domain 1)
- Policies, governance roles, identity and access management
- Write a one-paragraph summary of what each policy type controls
Assessment (Domain 2)
- Attack categories, reconnaissance, vulnerabilities and risk assessment
- Practice distinguishing threat, vulnerability and risk
Management (Domain 3)
- Patching, firewalls and IDS, logging, cryptography, zero-trust and cloud
- Practice choosing among risk treatment options
Incident response and full review (Domain 4)
- Response lifecycle, malware analysis, recovery planning
- Timed practice sets mixing all four domains
For a compact refresher once you have worked through the domains, the RCCE Cheat Sheet condenses the must-know facts, and you can pressure-test your recall with realistic questions on the RCCE practice test site.
Fees, Proctoring and Eligibility
Knowing the domains is only half of readiness; you also need to understand the mechanics of sitting the exam.
Fees and retakes
The generic official exam policy lists USD 499 for the examination and USD 499 for a retake, with no member or non-member tiers. The Level 1 page, however, asks for a regional and format quote and does not publish a universal training price, so confirm whether the exam is bundled with a course. Retake rules also conflict across sources: the handbook describes one free attempt after failure or a missed sitting, while the exam policy lists paid retakes. Confirm the rule that applies to your booking before you pay. The full picture is in RCCE Certification Cost 2026.
Proctoring conditions
The exam is not open-book. Online identity verification, a room inspection and a secure browser are required, and outside books, notes and electronics are not permitted. The public Proctoring Candidate Manual (version 1.0, dated July 15, 2021) describes Windows with Safe Exam Browser, no extra screens or headphones, and calculators only when the exam instructions allow them. Because that manual is dated, treat its device details as subject to the instructions for your booked sitting. Pearson VUE maintains a Rocheston program page, but availability of the current 100-question Level 1 form through Pearson was not verified, so do not assume interchangeable bookings.
Who can sit the exam
The Level 1 course page says basic IT knowledge, including networking, operating systems, command line and web concepts, is the starting point, and that no prior hacking experience is required for the course. The eligibility page permits two routes: authorized RCCE training with an attendance certificate, or self-study plus two years of cybersecurity work experience and a supervisor or employer letter. The handbook alone states a two-year experience minimum without the training exception. Check RCCE Requirements 2026 and confirm your route with RDoC.
Accreditation and where this fits
ANAB's directory lists Rocheston Pvt. Ltd. with RCCE in its accreditation scope through June 21, 2027. That is credential-specific and does not mean every legacy Level 1 form is identical to the accredited version. For career context, including how employers view the credential, see RCCE Jobs and Is the RCCE Certification Worth It?. No certification-specific salary premium has been verified, so approach earnings claims with caution.
Frequently Asked Questions
The Candidate Handbook lists four: Cybersecurity Policies and Governance; Risks/Threats/Vulnerability Assessment; Risks/Threats/Vulnerability Management; and Security Incident Response and Recovery Plan.
Rocheston does not publish domain weights, so no percentage is verified. Do not treat the four domains as equal 25% shares; prepare each one thoroughly.
No. The 25 modules are unweighted preparation topics from the Level 1 course page. The four domains are the formal examination outline, and no official mapping between them is published.
The current Level 1 specification is 100 questions in 120 minutes with a 62% passing score. Older materials cite different figures for earlier forms, which do not override the current specification.
Sources differ. The Level 1 page cites multiple-choice, true/false and short-answer items, while the handbook describes objective multiple-choice only. Prepare for both styles and confirm your sitting's instructions.