DEV Community: DailyDebian

What IT certification exams actually cost in 2026: exam, retake and renewal

DailyDebian — Mon, 09 Nov 2026 10:11:39 +0000

First published by DailyDebian. The full, sortable table with a source link for every row is the IT Certification Price Index.

Most people budget for one number: the exam fee. That number is real, but it is rarely the whole bill. A retake can cost the same again. Some certifications charge every year just to stay active. A few vendors quote a different price for members. If you plan a certification path without these, the total can surprise you.

The figures below come from each vendor's own pricing page, read on 8 November 2026. They are US list prices in US dollars for a first attempt, before tax. Vendors charge different amounts in some countries, so check the vendor page before you book.

The headline exam fees

Here is a quick sample across the big vendors:

Exam	Vendor	Exam fee (USD)
A+ 220-1201 and 220-1202	CompTIA	$274 each (two exams)
Network+ N10-009	CompTIA	$399
Security+ SY0-701	CompTIA	$439
SecurityX CAS-005	CompTIA	$544
CCNA 200-301	Cisco	$300
350-401 ENCOR	Cisco	$400
Cloud Practitioner CLF-C02	AWS	$100
Solutions Architect Associate SAA-C03	AWS	$150
Solutions Architect Professional SAP-C02	AWS	$300
AZ-900	Microsoft	$99
AZ-104	Microsoft	$165
Associate Cloud Engineer	Google Cloud	$125
CISSP	ISC2	$749
CISA, CISM, CRISC	ISACA	$575 member, $760 non-member
GSEC	GIAC	$999
PMP	PMI	$324 member, $575 non-member

Two things stand out. First, A+ is two exams, so the real entry price is $548, not $274. Second, the spread is huge. A cloud fundamentals exam costs about $100, while a GIAC exam costs close to $1,000.

Retakes: the cost most people forget

Failing once is common, and most vendors charge the full fee again.

CompTIA charges the full exam price for each attempt. You can buy a voucher bundled with a retake instead. For Security+ that bundle is $579, against $439 for the voucher alone. If you think there is a real chance you will need a second try, the bundle costs less than two vouchers.
Microsoft charges again for each attempt. After a first fail you wait 24 hours. After later fails you wait 14 days between attempts.
Cisco gives no retake fee on the page, but you must wait 5 days before trying again.
ISC2 charges the full fee for each attempt unless you bought its retake protection. Waits grow to 30, 60 and then 90 days.
ISACA charges the full registration fee each attempt, with waits of 30 and 90 days.
GIAC lists a retake at $899 for GSEC, almost the price of the first attempt.

Waiting periods matter as much as money. A 90-day wait can push a job start or a promotion back by a full quarter.

Renewal: the yearly bill

Passing is not the end. Many certifications must be renewed, and the price models differ a lot:

CompTIA: most core certifications carry a continuing education fee of $150 every 3 years if you renew by uploading CEUs ($75 for A+, Data+ and SecAI+). Tech+ has no CE fee; you renew it by passing the latest exam.
ISC2: an annual maintenance fee of $135. It is one fee however many ISC2 certifications you hold, so CISSP plus CCSP still costs $135 a year.
ISACA: an annual maintenance fee of $45 for members and $85 for non-members.
Cisco: certifications are valid for 3 years. You recertify by exam or by continuing education credits.
AWS: valid for 3 years. You recertify by taking the latest version of the exam.
Microsoft: associate, expert and specialty certifications renew through a free online assessment. Fundamentals certifications such as AZ-900 do not expire.
Google Cloud: for Associate Cloud Engineer, the renewal exam is $75.
GIAC: GSEC renewal is $499.

Over three years, an ISC2 certification adds $405 in maintenance fees. An AWS certification adds the price of the next exam. A Microsoft associate certification adds nothing but your time.

Small print that changes the total

Member prices. ISACA and PMI quote lower prices to members. PMP is $324 for members against $575 for everyone else. Membership costs money too, so do the sum before you join just for the discount.
Delivery method. EC-Council lists the CEH v13 remote-proctored voucher at $950 and a Pearson VUE voucher at $1,199. The index also lists a $100 eligibility application fee, so check whether it applies to you.
Bundles. PMI sells CPMAI as a prep course and exam bundle, not as an exam-only fee. Compare it with care.

How to budget a certification

A simple rule: plan for the exam fee, plus one retake, plus three years of renewal. For Security+ that is $439 + $439 + $150 = $1,028 in the worst case. Buying the retake bundle brings it to $579 + $150 = $729. For CISSP it is $749 + $749 + $405 = $1,903. That is not a reason to avoid either one. It is a reason to prepare well enough to pass the first time.

How these prices were checked

Every price comes from the vendor's own page. No third-party price lists were used. If a vendor does not publish a figure, the index says "Not published by vendor" instead of guessing. Each row shows the date it was last checked. The sources are re-read every quarter, and the next full update is due on 1 January 2027.

The full table covers 137 exams from CompTIA, ISC2, ISACA, Cisco, AWS, Microsoft, Google Cloud, GIAC, EC-Council and PMI. You can filter it by vendor, and every row has a source link: IT Certification Price Index 2026.

If you also want questions, time limits and pass marks for each exam, see the IT certification exam facts table.

Subnetting in four steps: the method that works under exam pressure

DailyDebian — Mon, 09 Nov 2026 10:10:02 +0000

First published by DailyDebian. The one-page version, with a free PDF, is the Subnetting Cheat Sheet.

Subnetting is on both CompTIA Network+ and Cisco CCNA. It also turns up in every network job you will ever have. Most people find it hard because they learn it as binary arithmetic and then try to do binary in their head on a timer. There is a faster way. You only need one number, the block size, and four short steps.

The one table worth memorising

Every step down in prefix length doubles the number of addresses. If you know that a /24 has 256 addresses, you can build the rest:

CIDR	Mask	Usable hosts
/30	255.255.255.252	2
/29	255.255.255.248	6
/28	255.255.255.240	14
/27	255.255.255.224	30
/26	255.255.255.192	62
/25	255.255.255.128	126
/24	255.255.255.0	254
/23	255.255.254.0	510
/22	255.255.252.0	1,022

"Usable hosts" is the total number of addresses minus two. The first address in a subnet is the network address and the last is the broadcast address, so neither can go to a host. The formula is 2 to the power of h, minus 2, where h is the number of host bits.

Two exceptions are worth knowing. A /32 is one single host address. A /31 gives 2 usable addresses, but only on a point-to-point link.

The block size, or "magic number"

The block size is 256 minus the mask value in the octet that is not 0 or 255. Subnets always start on a multiple of the block size.

Mask value	Block size
128	128
192	64
224	32
240	16
248	8
252	4
254	2

Once you have the block size, you never need to convert anything to binary.

The four steps

Take 192.168.10.77/26 as the example.

1. Find the mask. A /26 is 255.255.255.192. The fourth octet is the one that is neither 0 nor 255, so that is where the work happens.

2. Find the block size. 256 minus 192 is 64. Subnets in that octet start at .0, .64, .128 and .192.

3. Find the network address. Take the highest multiple of 64 that is not above 77. That is 64, so the network is 192.168.10.64.

4. Find the broadcast and the host range. The next subnet starts at .128, so the broadcast is one less: 192.168.10.127. The usable hosts are .65 to .126, which is 62 hosts.

That is the whole method. With practice it takes well under a minute, and it works the same in any octet.

Going the other way: "how many hosts do I need?"

Exams love this question. You get a number of hosts and must choose the smallest subnet that fits. Always round up:

Up to 14 hosts: /28
Up to 30 hosts: /27
Up to 62 hosts: /26
Up to 126 hosts: /25

So a subnet for 50 hosts cannot be a /27, because that only gives 30. The answer is /26, with 62.

Ranges you should recognise on sight

10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private (RFC 1918). The 172 range runs from 172.16.0.0 to 172.31.255.255. That makes 172.32.0.1 a public address, which is a favourite trick question.
127.0.0.0/8 is loopback. 127.0.0.1 is the local machine.
169.254.0.0/16 is APIPA, or link-local. If a device has one of these, it failed to get a DHCP address. It does not mean the network is fine.
100.64.0.0/10 is the shared space used for carrier-grade NAT.
224.0.0.0/4 is multicast, the old class D.

Common exam traps

The network and broadcast addresses cannot be assigned to a host.
A wildcard mask, used in access lists and OSPF, is 255.255.255.255 minus the subnet mask. For a /26 that gives 0.0.0.63.
Classful addressing is no longer used for routing, but exams still ask about classes. Class A starts at 1 to 126, B at 128 to 191 and C at 192 to 223.
IPv6 has no broadcast at all. It uses multicast (ff00::/8) instead, and a normal LAN subnet is a /64.

How to make it stick

Reading the method once is not enough. What works is doing 10 to 20 random questions a day for a week, until the block sizes come without thinking. Then check yourself against a calculator, so you know your answers are right and you are not drilling a mistake.

Some free tools for that:

Subnetting practice: unlimited random questions at three levels, with worked answers.
Subnet calculator: network, broadcast, host range, mask, wildcard and binary for any IPv4 address.
CIDR calculator and VLSM planner: for splitting one block into several subnets of different sizes.
Wildcard mask calculator: for Cisco access lists.

The full cheat sheet, with every prefix from /32 to /8, an IPv6 quick reference and a printable one-page PDF, is here: Subnetting Cheat Sheet.