These three get compared constantly, and most of the comparisons miss the thing that actually separates them. The real difference is what happens after you pass.
I have taken all three. Here is the short version: Security+ is the one employers ask for by name. SC-900 is the one that costs you nothing to keep. CC is the one to think hardest about. It’s the only one that bills you every year for the rest of your career.
The numbers, side by side
| Security+ | ISC2 CC | SC-900 | |
|---|---|---|---|
| Certification body | CompTIA | ISC2 | Microsoft |
| Exam code | SY0-701 | CC | SC-900 |
| Questions | Maximum of 90 | 100 to 125 | Microsoft does not publish a count |
| Time allowed | 90 minutes | 2 hours | 45 minutes |
| Question types | Multiple choice and performance-based | Multiple choice only | Multiple choice, drag-and-drop, case studies |
| Passing score | 750 on a scale of 100 to 900 | 700 out of 1000 | 700 out of 1000 |
| Experience expected | Network+ and two years in a security or sysadmin role (recommended, not required) | None | None |
| Exam fee | $439 USD | $199 USD | $99 USD |
| Cost after you pass | None. Renew with 50 CEUs over three years | $50 every year, plus 45 CPEs over three years | Nothing, ever |
| Expires | Three years | Three years, if you keep paying the annual fee | Never |
| Worth knowing | SY0-701 retires 11 June 2027 for the English exam | Was free under ISC2’s One Million Certified campaign. That has ended | Fundamentals credentials sit outside Microsoft’s renewal system entirely |
Checked against CompTIA, ISC2 and Microsoft Learn on 16 September 2026. Exam fees change without notice and vary by region, so confirm the current figure with the certification body before you book.
The part that decides it
Only one of these three ever stops costing you money
ISC2 charges a $50 Annual Maintenance Fee. You pay it every year, for as long as you hold the certification. Over three years, CC costs $199 for the exam plus $150 in fees. That’s about $349 all in, and the meter keeps running after that.
Security+ costs more up front and nothing afterwards. You renew with 50 continuing education units across three years, which you can earn free.
SC-900 is the outlier. Microsoft Fundamentals credentials don’t expire at all. No renewal, no fee, no CEUs. The confusion comes from Microsoft’s role-based certifications, which expire every year. Fundamentals sit outside that system. Ninety-nine dollars, once, and it is yours.
Security+ is the only one that clears HR filters on its own
This is the unglamorous reason it wins. Security+ appears by name in job postings and in US federal workforce requirements. CC and SC-900 don’t, at least not yet. If you are trying to get past an automated screen for your first security role, that difference outweighs everything in the table above.
If you are going to take Security+, mind the clock
CompTIA retires the English SY0-701 exam on 11 June 2027. If you’re studying now, that’s plenty of time. If you plan to start in late 2026, check whether CompTIA has announced the replacement. Do that before you buy study material for the outgoing version.
So which one
Take Security+ if you want a job in security
It is the most expensive of the three and the hardest, and it is still the right answer for most people. You get ninety minutes for up to 90 questions. The performance-based items put you in a simulated interface instead of asking you to recognize a definition. CompTIA recommends Network+ and two years of experience first. Plenty of people ignore that and pass anyway, but the networking material is where they struggle.
Full breakdown: CompTIA Security+.
Take SC-900 if your employer runs on Microsoft
Forty-five minutes, $99, never expires. It’s less a security credential than a map of Microsoft’s security, compliance and identity products. That’s exactly what you need if your organization lives in Entra and Microsoft 365. It won’t get you hired on its own. It makes you useful faster in a shop that already made the Microsoft bet. Once you count what you never pay again, it’s also the cheapest thing on this page by a distance.
Full breakdown: Microsoft SC-900.
Take CC if you want to find out whether you like this work
No experience is required and there are no prerequisites. Its five domains are also the broadest survey of the three. As an orientation exercise, it’s good. It isn’t a hiring signal. And at $199 plus $50 a year, it’s no longer the risk-free experiment it was when ISC2 gave it away. If you already know you want this career, the same money is better spent on Security+.
Full breakdown: ISC2 CC.
Doing more than one
If you work in a Microsoft environment, the sequence that makes sense is SC-900, then Security+. SC-900 is a weekend, it never expires, and the identity material gives you a head start on the Security+ IAM objectives.
Taking CC and Security+ both is harder to justify. They cover much the same ground at the same level. And the one with the annual fee is the one employers aren’t asking for.
None of the three is a prerequisite for any of the others. If you can only do one and you want a job in security, take Security+.
Self-taught security pro. No degree, just certs, labs, and a lot of late nights.