- The Number: 80% of 25 Questions
- How CSD-110 Scoring Works
- Domain Math: Where Your 20 Correct Answers Come From
- Question Style and What It Means for Your Score
- The Complimentary Retake and Delivery Mechanics
- High-Value Topics That Protect Your Score
- A Domain-Weighted Prep Timeline
- After You Pass: Validity and Renewal
- Frequently Asked Questions
- The Cyber Secure Software Developer exam (CSD-110) requires 80%, which means 20 correct answers out of 25 questions.
- You can miss at most 5 questions, so domain gaps in Develop Secure Code (33%) are the most costly.
- The exam mixes multiple-choice and multiple-response items, and partial knowledge on multiple-response items is risky.
- One complimentary retake is included, but treat your first attempt as the real one.
The Number: 80% of 25 Questions
The Cyber Secure Software Developer (CSSD) credential from CertNexus is earned by passing exam CSD-110, which launched on May 11, 2026. The passing score is 80%. On a 25-question assessment, that translates to 20 correct answers. Anything below 20 does not pass.
That sounds simple, but the math carries real strategic weight. With only 25 questions, each item is worth 4 percentage points. You have a margin of just five incorrect answers across the entire exam. There is very little room to be "mostly prepared" in one area and strong in another, because a handful of misses in a single heavily weighted domain can consume your whole error budget.
If you are still deciding whether this credential fits your path, our guide on what CSSD certification is covers the basics, and how hard the CSSD exam is puts the 80% bar into practical context.
How CSD-110 Scoring Works
Percentage-based, not scaled
CertNexus states the requirement as a percentage: 80%, or 20 of 25 questions. This article does not describe a scaled-score model, a numeric scale, or any weighting formula beyond what the issuer publishes, because none is documented in the sources we checked. The practical reading is straightforward: count your correct answers and compare them to 20.
What counts as "correct" on multiple-response items
The exam includes both multiple-choice and multiple-response questions. CertNexus does not publish a partial-credit policy in the materials we reviewed, so the safe assumption is that a multiple-response item must be answered fully correctly to count. Plan your preparation accordingly: for any topic that could appear as "select all that apply," you need to know the complete set of correct options, not just one or two.
Why you should not hunt for a "cut score" trick
With no published domain-level minimums in the sources we checked, the passing decision rests on the overall percentage. That means you cannot rely on being weak in one domain and making it up elsewhere unless your overall count reaches 20. Because the exam is short, the variance from a few unlucky or unfamiliar questions is high. Aim for a comfortable cushion above 20 in your practice results rather than a bare pass.
Domain Math: Where Your 20 Correct Answers Come From
The official CSD-110 blueprint (version 1.12, issued December 15, 2024 and modified June 1, 2026) assigns weights to five domains. Those weights tell you where the questions are concentrated. For a full walkthrough of each area, see our complete guide to all five CSSD exam domains.
| Domain | Weight | Passing Implication |
|---|---|---|
| 1. Understand the Fundamentals of Secure Software Development | 15% | Foundational vocabulary and principles; cheap points if well studied |
| 2. Explain the Secure Software Development Lifecycle | 22% | Second-largest slice; process and lifecycle reasoning |
| 3. Develop Secure Code | 33% | Largest slice; weakness here is the fastest route to failing |
| 4. Defending Against Cyberattacks | 15% | Applied defensive knowledge |
| 5. Engage in Governance, Risk Management, and Compliance | 15% | Often underestimated by hands-on developers |
Treat the percentages as proportional guidance for how much of the exam each domain represents, not as a promise of an exact question count on any given attempt. With 25 questions, rounding means individual domains will appear in approximately, not exactly, those proportions.
Question Style and What It Means for Your Score
Scenario-flavored security judgment
CSD-110 targets people who write, test, and deploy software, so expect questions that ask you to choose the secure option in a development situation rather than recite definitions. A question might describe a code pattern, a pipeline step, or a design decision and ask which control addresses the risk. Understanding why a control works is more valuable than memorizing its name.
Multiple-response questions raise the stakes
Because a multiple-response item asks for several correct selections, guessing is less forgiving than on a single-answer question. If you can eliminate wrong options with confidence, you improve your odds, but the reliable path is knowing the topic cold. When a question says to select more than one answer, read the instruction carefully before choosing.
The blueprint examples are not the whole exam
CertNexus notes that the detailed examples in the blueprint are not an exhaustive list of everything that may be tested. Use them as a map of the territory, not a boundary fence. If a related concept sits next to a listed topic, make sure you understand it well enough to reason through an unfamiliar question.
Domain 3 Focus: Develop Secure Code (33%)
This is the heaviest domain, so questions here deserve the most practice. Be ready to reason about:
- Input validation and output encoding, and which defends against which class of attack
- Authentication and authorization, and how they differ in implementation
- Secrets management in code, configuration, and pipelines
- Reviewing AI-generated code for security flaws before it ships
The Complimentary Retake and Delivery Mechanics
The exam is delivered online through CHOICE, and the course access key includes the CHOICE credential process. CertNexus provides one complimentary retake. That is a genuine safety net, but it should not change how you approach attempt one. A retake still requires you to re-prepare, and the retake is a second sitting at the same 80% standard.
On the administrative side, the sources we checked list no formal registration prerequisites, no application fee, no supporting-documentation requirement, and no eligibility verification. CertNexus recommends foundational security knowledge and experience across software development, design, testing, and deployment, without prescribing a particular programming language. For the full eligibility picture, see our CSSD requirements guide.
What about cost?
We have not verified a separate exam-only fee. What is published are courseware-bundle prices from a training publisher: USD 514.50 for the student digital course bundle without lab, and USD 561.75 for the version with lab. These are courseware prices, not exam-only fees. Our CSSD certification cost breakdown explains how to read these numbers.
Key Takeaway
Do not schedule your first attempt as a "trial run" because a retake exists. Use the free retake as insurance, and prepare as though you only get one shot. A focused first attempt saves time and keeps your momentum.
High-Value Topics That Protect Your Score
Since you can miss only five questions, concentrate on the topics that CertNexus explicitly lists as supported. The blueprint names a wide range of concepts; the clusters below map to the domains and are worth drilling.
Domains 1 and 2: Fundamentals and Lifecycle (37% combined)
Build fluency with the language of secure development and where security activities sit in the lifecycle.
- CIA triad, AAA, and least privilege
- Threat modeling and abuse cases
- How security activities map to lifecycle phases
- SAST, DAST, IAST, and SCA, including when each is appropriate and what each can and cannot find
Domain 4: Defending Against Cyberattacks (15%)
Connect attack techniques to the controls that stop them.
- Dependency security and software supply chain security
- Secure CI/CD practices
- Matching a described weakness to the right defensive measure
Domain 5: Governance, Risk Management, and Compliance (15%)
Developers sometimes skim this area, which is exactly why it is a risk to your 20-question target.
- Governance and risk concepts as they apply to software teams
- Compliance considerations that influence development decisions
Our CSSD cheat sheet condenses many of these must-know facts into a one-page review, and the full CSSD study guide lays out a complete preparation approach.
A Domain-Weighted Prep Timeline
Rather than studying every domain equally, allocate time in proportion to weight and to your personal gaps. Here is a four-week sequence that front-loads the largest domain while keeping the smaller ones from being neglected.
Fundamentals and Lifecycle Foundations
- Cover Domain 1: CIA, AAA, least privilege, threat modeling, abuse cases
- Begin Domain 2: map security activities to lifecycle phases
Develop Secure Code (33%)
- Input validation, output encoding, authentication, authorization
- Secrets management and reviewing AI-generated code
- Finish Domain 2 testing tools: SAST, DAST, IAST, SCA
Defense and Governance
- Domain 4: dependency security, supply chain, secure CI/CD
- Domain 5: governance, risk, and compliance concepts
Practice and Gap Repair
- Take timed practice sets and score yourself against the 20-of-25 line
- Revisit any domain where you consistently miss multiple-response items
Practice tests are the best way to calibrate against the real standard. Try our CSSD practice tests and track whether you are landing at or above 80% consistently, not just once. For preparation strategy beyond this timeline, the CSSD training overview may help you choose resources.
After You Pass: Validity and Renewal
CertNexus's general maintenance policy states that certifications are valid for three years, with renewal by passing the current exam. Continuing education is available to eligible holders under the CertNexus program. That page does not establish CSSD-specific continuing-education eligibility or requirements, so check CertNexus directly for what applies to your credential before relying on it.
If you are weighing whether the credential pays off, see our analysis of whether the CSSD certification is worth it, plus the guides on CSSD salary and CSSD jobs for career context.
Frequently Asked Questions
The passing score for Cyber Secure Software Developer exam CSD-110 is 80%. On the 25-question assessment, that means you need at least 20 correct answers.
You can miss up to five questions. Missing a sixth drops you below 20 correct and under the 80% requirement.
Yes. CertNexus provides one complimentary retake. The retake is held to the same 80% passing standard, so you still need to prepare for it.
The estimated completion time is 30 to 60 minutes. This is a planning estimate and not a verified fixed exam timer, so confirm timing details during your CHOICE delivery setup.
Develop Secure Code is the largest at 33%, followed by the Secure Software Development Lifecycle at 22%. Together they account for 55% of the exam, so they deserve the most attention, though the other three domains still carry enough weight to cause a failure if neglected.
For related details on scheduling and difficulty, read our guides to CSSD exam dates and the CSSD pass rate, and use the practice test site to measure yourself against the 20-of-25 standard before you sit the real exam.