The CDP Exam — format, registration & exam-day logistics
The Certified DevSecOps Professional (CDP) from Practical DevSecOps is a hands-on, task-based exam: 5 live challenges to solve inside a 6-hour window, followed by a separate 24-hour window to submit a written report proving what you did. There is no multiple choice anywhere in it. This page is the logistics briefing — what the exam actually is, how to register, what it costs, and the exam-day habits that keep a candidate who knows the material from losing points to the clock or a missed report deadline. It is not the study plan — for the content itself, mapped to a week-by-week schedule, go to the CDP study plan; this page assumes you're already building that skill and just needs to know how the day itself runs.
Most tests hand you a question and four bubbles to fill in. This one hands you a broken, messy computer system and says "fix it — you have six hours." No bubbles to guess between, no partial credit for a lucky pick. Then, right after the six hours end, it asks for something extra: a short write-up, due within a day, proving what you actually did and why it worked. Knowing the material gets you through the six hours. Remembering to write it all down as you go is what gets the write-up done without a last-minute scramble.
What the CDP actually is
☺ Like you're 10: A real broken environment, five things to fix, a six-hour timer, then a whole extra day just to write down what you did.
The CDP is run by Practical DevSecOps, a training and certification provider built specifically around hands-on DevSecOps skill. The exam itself is 100% practical and task-based — candidates work through 5 challenges, each containing multiple tasks, against a live environment, not a simulated quiz interface. Chatbots and AI assistants are explicitly not allowed during the exam window, which is exactly why chapters 1–2 of the exam blueprint exist as a fluency gate: on the day, there's no tab to open and no assistant to ask, so the vocabulary and the tool commands need to already be reflexes.
| Item | Detail |
|---|---|
| Full name | Certified DevSecOps Professional (CDP) |
| Format | 100% practical / task-based — no multiple-choice questions anywhere |
| Structure | 5 challenges, each with multiple tasks, against a live environment |
| Challenge window | 6 hours to work through all 5 challenges |
| Report window | A separate 24 hours after the challenge window closes to submit a written report — PDF, Markdown, or screenshots as evidence |
| Passing score | 80 out of 100 (80%) |
| Cost | US$899 (vendor list price) |
| Certification validity | Lifetime — no stated expiration or mandatory recertification |
| CPE credits | 36 CPE credits, useful toward maintaining other certifications whose governing body accepts third-party continuing-education hours |
| AI / chatbot policy | Not allowed during the exam window |
| Prerequisites | None formally required; the vendor's own CDP course content is the expected preparation |
| Provider | Practical DevSecOps |
The $899 price, the 80/100 passing score, lifetime validity, and the 36 CPE credits are Practical DevSecOps' own published numbers, not this site's. Vendor certification pages change price and terms with little notice — the same caveat this course's own certifications page already makes about CDP, CKS, and the AWS Security Specialty exam applies here too. Before you register or plan around any figure on this page, confirm the current price, passing score, retake policy, and validity on Practical DevSecOps' own exam page, linked at the bottom of the next section.
Registration & logistics
☺ Like you're 10: You buy it on the vendor's site, you get a live environment for six hours, and then you get a whole extra day just for the write-up — don't let that second clock sneak up on you.
Registration runs through Practical DevSecOps' own site — either as a standalone exam attempt or bundled with their CDP training course. The two windows are the whole shape of exam day, and confusing them is the single most avoidable mistake: the 6-hour window is for solving the 5 challenges against the live environment, and the separate 24-hour window that starts when the challenge window closes is for writing and submitting the report that proves what you did. A candidate who solves every challenge but forgets the report window exists has not passed anything.
Walk it in order and nothing surprises you:
- Register & pay on Practical DevSecOps' site, standalone or bundled with their training.
- Confirm the current logistics — scheduling process, any environment/proctoring requirements, and system prerequisites — on the vendor's own exam page before you commit a date.
- Prepare your space: a stable connection for the full 6-hour window, and a plan for where you'll be for the 24 hours after, since the report is due on a clock that keeps running regardless of sleep.
- During the 6-hour window, capture evidence as you close out each challenge — screenshots, commands run, findings — rather than trying to reconstruct six hours of work from memory afterward.
- Submit the written report inside the 24-hour post-challenge window: PDF, Markdown, or screenshots as evidence, per the vendor's current submission format.
- Wait for results — check the vendor's own page for the current stated turnaround, since this isn't a figure worth guessing at.
↗ Practical DevSecOps official page
What the 5 challenges likely draw on
☺ Like you're 10: Nobody publishes the exact recipe for the five challenges — but the ingredients are the same skills this whole course is built to practice.
Practical DevSecOps doesn't publish an official domain breakdown or percentage weighting for the 5 challenges the way, say, the CKS publishes weighted domains — so treat anything below as a study heuristic drawn from the vendor's own course syllabus and this course's 9-chapter exam blueprint, not as a confirmed exam spec. What is consistent across candidate reports and the vendor's own course description is that the 5 challenges span the secure SDLC end to end rather than clustering in one skill:
- Static analysis & secrets detection — finding a real vulnerability or a leaked credential in source, not just naming the vulnerability class. See chapter 5.
- Software composition analysis — tracing a CVE to the dependency that carries it and judging real exploitability, not just reading a scanner's severity label. See chapter 4.
- Dynamic analysis — running a DAST scan against a live target and interpreting what it hands back. See chapter 6.
- Infrastructure-as-code hardening — spotting and fixing a misconfiguration before it's ever applied. See chapter 7.
- Vulnerability management & triage, and compliance evidence — not just fixing something but showing, in writing, that it's fixed and staying fixed. See chapter 9 and chapter 8.
The most direct hands-on rehearsal for that spread isn't a reading list — it's the capstone lab track, which takes one pipeline through threat modeling, SAST/secrets, an SCA gate, container hardening and signing, IaC policy, a real DAST run, and compliance evidence in seven parts. A candidate who's built all seven has hands-on reps in every category above, which is closer to exam rehearsal than any page of prose can be.
Exam-day tactics for a task-based, not multiple-choice, exam
☺ Like you're 10: There's no bubble to guess between here — so the habits that win points are about not wasting the clock, not about outsmarting a question.
A task-based exam rewards different habits than a knowledge exam does. None of these require guessing at unpublished exam content — they're about how the two windows actually get used.
The report is due within 24 hours of a challenge window that just consumed 6 hours of concentration. Reconstructing what you did from memory, after the fact, is where candidates who solved the technical work still lose points. Screenshot the vulnerable state, the fix, and the proof it's fixed the moment you close out each task — not at hour 5:45, and not during the report window.
- Skim all 5 challenges before committing to challenge 1. A fast first pass tells you where the challenges you're already strong on sit, so you can bank those points early instead of discovering a comfortable challenge with twenty minutes left.
- Verify, don't just apply. A fix that isn't proven is a fix a report can't defend. Re-run the scan and show it clean; try the exploit again and show it blocked. "I changed the config" is not the same claim as "I changed the config, and here is the scan showing it worked."
- Time-box each challenge. If one is fighting you well past its fair share of the 6 hours, note where you are, move to the next challenge, and come back if time allows. A partially worked challenge with clear evidence likely beats a perfect challenge that ate the whole window and left four others untouched — but confirm the current partial-credit policy on the vendor's own page rather than assuming it.
- No chatbot means your terminal muscle memory is the whole toolkit. This is exactly what Know It Cold and the command & tool reference exist to drill beforehand — the exam window is the wrong place to be looking up syntax for the first time.
- Draft the report in parallel with the work, in whatever format you'll submit. A short paragraph and a screenshot per task, written the moment the task closes, turns the 24-hour window into an assembly-and-polish pass instead of a from-scratch write-up done on no sleep.
Your path to exam-ready
☺ Like you're 10: This page is the rules of the day. Everything that gets you ready for the day itself lives on the other exam-prep pages.
This page covers the day itself — what the exam is, how to register, and how to run the clock. The content that gets you ready for it lives elsewhere on purpose, so each page can do one job well: the CDP study plan maps the 9-chapter blueprint onto an actual week-by-week schedule; the practice challenge bank and the four mock exam sets are where you rehearse the 6-hour pressure before the real one; Know It Cold and the command & tool reference are the from-memory drills chapters 1–2 of the blueprint assume you've already done; and the triage playbook is what to reach for when a challenge isn't behaving the way you expected. If you haven't started the blueprint itself, begin with chapters 1–2, Foundations & the CDP Toolchain, and when you want hands-on reps across everything the 5 challenges likely draw on, work the capstone lab track start to finish.
Foxy: Six hours on live challenges, no multiple choice to hide behind, and then I still have to write a report? When am I supposed to sleep?
Professor Owl: The report window is 24 hours, not "immediately after." But treat it as a deadline that starts the second the challenge window closes, not a comfortable buffer.
Timmy: Which is why you screenshot the fix and the proof it worked the moment you close each task — not at hour six, when you're trying to remember what you even did to challenge two.
Nutty: That's exactly my job on a normal Tuesday — file the evidence the instant it exists, because digging it up later costs ten times as long. Same rule applies with a clock running.
Foxy: Fine. And the eighty out of a hundred — that's from the report, not just from what I clicked?
Professor Owl: Both. A fix nobody can see proof of is a fix the report can't defend. Verify it, screenshot it, write it down — in that order, every time.
1. How many challenges does the CDP have, how long is the challenge window, and how long is the separate report window? 2. What score is needed to pass, and where does that score come from — only the challenge window, or the report too? 3. Name one thing the exam explicitly does not allow during the challenge window, and why chapters 1–2 of this course's exam blueprint exist because of it. 4. Why does this page recommend capturing evidence the moment each task is closed out, rather than during the 24-hour report window? 5. Where should you go next for the actual content the CDP tests, as opposed to the logistics on this page?
Check your answers
- 5 challenges, each with multiple tasks, inside a 6-hour challenge window — followed by a separate 24-hour window, starting once the challenge window closes, to submit a written report.
- 80 out of 100 (80%). The score is drawn from the report as much as the live work — a fix with no evidence behind it is a fix the report can't prove happened.
- AI assistants and chatbots are not allowed during the exam window. Chapters 1–2 of the blueprint (Foundations & the CDP Toolchain) exist precisely because that rule means the baseline vocabulary and tool commands have to already be automatic — there's no tab to open and no assistant to ask mid-challenge.
- Because the report window comes after six hours of concentrated work across five separate challenges — reconstructing exactly what was done, and proving it, from memory afterward is where candidates who solved the technical work still lose points. Capturing it the moment each task closes turns the report into assembly, not a from-scratch write-up.
- The CDP study plan for a week-by-week schedule across the 9-chapter blueprint, plus the practice challenge bank, the mock exam sets, and the capstone lab track for hands-on rehearsal.