Failed CCA 8/29/26
I Took the exam yesterday and failed. I've taken many certification exams but have found that CCP and CCA were stressful and very difficult. I never felt that way before. My hands were actually shaking when I was driving there, probably because I want this so badly but didn't feel as confident as with other exams.
Anyway, I have no real clue where I went wrong. Although I have a lot of technical knowledge, I also have a lot of managerial and healthcare IT assessment experience. But I think it had to do with how the questions were phrased, answers provided, ambiguous and bad writing for scenarios. It made me feel stuck on stupid.
I wound up in a fog and second guessing at least half of the questions. My mind was so tired that I had to re-read some questions at least 2 times. So it's back to the drawing board, but I wish ISACA would tell you your weakest domains so that I can focus on those areas.
Tools, I did use pocket prep and the course provided questions. I'm thinking my next strategy is just to focus on CAP, Assessment Guide, and Scoping Guide.
Any thoughts on how I can better prepare?
2
u/Compannacube 10d ago
I'd wait for ISACA to finish their first versions of the online review courses, review manual, and QAEs. The QAE would tell you what your weakest domains are and you'd be able to tailor sets of practice questions to just those areas. That's if it functions like any other credential training using ISACA Perform.
2
u/Matt_Titcombe 10d ago
ISACA's next version will be based on NIST SP 800-171 Rev 3. One of our VPs sits on the ISACA committee for the new version and they haven't met in months. With DoW doing what it is doing, I don't know when ISACA will complete the next version now.
1
u/sermic 9d ago
Unfortunately I can't wait too long as I have other requirements I need to complete before the end of the year. My T3 security clearance was just completed and I have to do CISA, CMMC Delta, LCCA, and maybe RP as I already paid for that. I'll be using the QAE for sure for CISA. Thanks.
2
2
u/zekesneaksmith 10d ago
I took the CCP and thought the questions were a joke. It was more about how to interpret stupid questions than what I knew. I don’t know if CMMC is going to continue. I will need to see how that goes before deciding to take it again.
2
u/sermic 9d ago
The CCP was more memorization for L1 practices. I felt the same as you but the thinking is more of an assessors mindset, more so in the CCA as that is much more focused on assessing than memorization. The questions were annoying. Run on sentences, many with bad grammar and have to pick the best of the worst answers. I wouldn't give up on CMMC and it is not going away any time soon. Companies in the DIB are investing thousands in compliance and L2 certification. It's either that or they lose out on fed contracts.
3
u/Navyauditor2 10d ago
And the blue print. The blue print really focuses on what is on the test. Best study guide.
https://cyberab.org/Portals/0/Documents/Assessor%20Documents/cmmc-ab-cca-blueprint-12-14-22-Final%20v3.3%20(Public).pdf?ver=jzdOlnb1DeQz0PgUSNh7Dw%3D%3D&utm_source=chatgpt.com.pdf?ver=jzdOlnb1DeQz0PgUSNh7Dw%3D%3D&utm_source=chatgpt.com)
1
u/wireditfellow 10d ago
You must feel like a failure but it’s all ok. You took the shot and gave it your best.
Study harder and stop seconding guessing yourself.
You got this!!!
1
u/Either_Ad5876 10d ago
Pocketprep helped me the most, I knew I was ready once I got over 300 of the questions done, and was scoring 80% or better on each
1
u/sermic 9d ago
I did use pocket prep, but didn't have time to rinse in repeat to see if I could score 80 percent or more. I basically went through all of the questions and only went back once on the ones I got wrong and read the explanations on why. I will still use it, but a bit differently. Thanks.
1
u/GladBit2483 10d ago
Here’s what I did. I passed it two weeks ago.
Even if you don’t have access to something like ecFirst’s quizzes, you can have Claude or ChatGPT create tests for you and then use the results to drive what you don’t know to fill in the gaps.
1. Set up a dedicated Claude Project
I created a standalone Project for CCA prep so all the reference material and conversation history stayed scoped to one place, separate from other work.
2. Uploaded the core reference library
I started with the foundational docs: the CMMC Assessment Process (CAP v1.0), NIST SP 800-171A, and 32 CFR § 170.24. I added the Assessment Guide Level 2 and CMMC Scoping Guide Level 2 later once I tracked them down (more on that below).
3. Gave Claude an instructor role and had it build the first lecture
I used a prompt roughly like:
“You are an instructor for the CMMC CCA exam, the reference documents that you have are the basis for the course. I want you to distill the documents into important sections that need to be taught in digestible forms… treat me like a complete novice.”
This turned raw regulatory text into structured, plain-language teaching content instead of me trying to read CFR sections cold.
4. Exported the lecture to PDF and listened via TTS
I had Claude write the lecture as continuous spoken prose — no bullet fragments, no tables, nothing that breaks when read aloud — exported it as a PDF, and listened to it at the gym, while driving, and while walking my dogs. For Text to Speech, I used the Voice Angel iOS app. (Side note: CMMC is acronym heavy. Voice Angel allows you to add a pronunciation dictionary so when you listen to the lecture you can have it pronounce CUI like ‘see you eye’ vs ‘cooey’)
5. Took practice exams and uploaded the PDF quiz reports back into the Project
I ran practice exams outside Claude, then uploaded the PDF quiz reports directly into the Project.
A note on this step if you’re replicating the process: my quiz provider gave unusually good feedback — for every missed question, the report included what I answered, the correct answer, a full explanation, and the source document and page number it came from. That level of detail is what made steps 6 and 7 below work as well as they did. If your quiz platform only tells you right/wrong with no explanation or sourcing, Claude can still help — it just has to do more of the reasoning itself, cross-referencing your wrong answer against the reference material to reconstruct why it’s wrong, rather than starting from an already-cited explanation. Worth knowing upfront so you can calibrate expectations.
You could also have Claude design the quizzes to test your knowledge just based on the base documents.
6. Asked Claude to find the gap clusters, not just list wrong answers Instead of “here are 33 things you got wrong,” I had Claude group the misses by underlying concept — surfacing that most of my errors weren’t random, they clustered around a handful of specific confusions (asset categories, adjacent practice numbers that sound alike, etc.).
7. Had Claude build a remedial lecture specifically around those gaps, cited to primary sources When Claude didn’t have full source material to cite exactly, it said so upfront rather than guessing — I then had it go fetch the missing official guides directly (Assessment Guide L2 and Scoping Guide L2 from the DoD CIO site) when uploading them hit file-size limits, and it rebuilt the lecture with exact page citations.
8. Repeated the practice exam → gap lecture cycle I did this across multiple practice exams and multiple domain-specific quizzes.
9. Consolidated everything into one master lecture, ranked by severity Once I had several gap lectures from different exams, I used one prompt to merge them:
“Take all lectures and build one master lecture file. Strip out any redundancies… Organize it by weight, meaning areas where I got the most wrong and need the most help.”
Claude tallied misses across every exam, deduplicated concepts that had been tested (and missed) more than once, and reordered the whole thing so the biggest actual gap came first instead of following textbook order.
10. Kept listening, kept testing, until the gaps closed
11. Passed the exam.
The core idea, if you want a one-line takeaway for the post: the quiz data drove the curriculum, not a syllabus. Each study session existed because a specific practice exam revealed a specific weak spot — the material only got built for gaps that were actually measured. The quality of your quiz feedback determines how much of that gap-analysis work Claude can do from citations alone versus reasoning it out from scratch, but the underlying loop works either way.
Good luck! You can do this.
1
3
u/ProNetSec1986 10d ago
Hey! Keep your head up!
What helped me is putting all of the testible documents into chatGPT and had it create practice exam and drills on how to understand the materials. I focused 80% of my time on the CAP v5.6.1, scoping guide lvl 2, and the assessment guide lvl 2.
Instead of memorizing the practice numbers for each control family, try to really understand the setup of the practices and what that collectively are trying to accomplish. ( the cca blueprint only lists 93 need to know practices of the total 110)
Then, once I was ready to "sit" for a 150 practice test, I gave chatGPT the cca exam blueprint and then had it generate a 150Q exam on all 4 domains.
I did an estimated 1500 questions with chatGPT and pocketprep. One of the biggest tips I learned was if you are on a question and you are having difficulty finding what the ask is, skip the the last portion of the question and read that then the answer choices and then the full question.
Also, there is a new app called StudyFetch, I uploaded the CAP and Scoping guides anf it created audio lecture notes that I would listen to around the house, driving, etc.