Why I Added SC-900 to My Plate (While Studying for the CC Retake)
A decision that looked, from the outside, like I'd lost my mind — and was actually one of the more calculated calls I made all summer.
Here's the setup. Back before my first ISC2 CC attempt, I'd snagged a free exam voucher through the Microsoft AI Skills Fest 2026. The plan then was SC-200 — the Security Operations Analyst cert, the one that maps straight to the SOC roles I'm aiming at. Voucher in hand, CC booked for June 20, everything lined up.
Then June 20 happened. My CC exam terminated at 90 questions — below the minimum — and instead of a result, I got an anomaly and a formal inquiry. Eventually, a retake.
Suddenly I'm holding a free Microsoft voucher, a CC I have to study for all over again, and a summer already packed wall-to-wall with the kids' camps. That's the real backdrop to this decision. Not a clean strategy session — a genuinely full plate and a voucher I refused to let expire.
If you're juggling cert paths and wondering whether stacking is ambition or self-sabotage, this is the honest version of how I made the call.
First, I had to sit with being annoyed
I'll be straight about the part most people skip: I was not happy. Having to re-study for an exam I'd already prepped hard for — through no fault of my own — was frustrating. I actually talked it through out loud, went back and forth, because "just add a second exam" is easy to say when you're not the one whose June and July are already spoken for by camp drop-offs and pickups.
So the first real decision wasn't about SC-900 at all. It was: do I let this voucher go, or do I find a version of this that actually fits my life? Letting a free exam expire felt like a waste. But forcing SC-200 — a hands-on, Sentinel-and-KQL-heavy associate exam — into an already-overloaded summer felt like a setup for failure.
That tension is where the real choice got made.
Why SC-200 became SC-900
Here's the pivot. SC-200 is the right destination — but it's not a warm-up. It's an associate-level operations exam that assumes real hands-on depth. Stacking that on top of a CC retake, during camp season, was asking to do two hard things badly.
So I made a deliberate swap: use the voucher for SC-900 instead. Same Microsoft security track, but the fundamentals tier — Security, Compliance, and Identity. It's the on-ramp to the whole cloud-security world I'm building toward, and it slots under SC-200 on the path rather than competing with it. Nothing wasted; the voucher still moves me forward, just at a rung that fits the summer I actually had.
It also reframed the whole thing. SC-200 on top of the CC retake = two competing heavy lifts. SC-900 alongside the CC retake = one reinforcing study block, because the material overlaps more than people think. (More on that below.)
The cold baseline that sealed it
Before I committed, I did what the atmospheric-science brain always does: I took a reading. Three days after the anomaly — CC frustration still raw — I sat a cold SC-900 practice assessment, no studying, and scored 40%.
That timing matters. I didn't wait until I'd calmed down and made a clear-headed plan. I turned the annoyance straight into a data point, because a baseline is more useful angry than it is a week later when you've talked yourself into or out of something.
Most people see 40% and close the tab. I saw the shape. The gaps clustered — Microsoft Compliance was my biggest cold spot, clean and obvious — and clustered gaps are drillable gaps. A messy, evenly-spread 40% would've scared me off. A clustered 40% with Compliance flagged was a study plan in disguise. The score wasn't the signal; the map was.
That's the same instinct I've run since forecasting: the anomaly isn't the problem; it's the route to the problem.
The timing actually worked
On the calendar side, two things made it sane instead of reckless.
First, the retake timing was partly in my hands. ISC2 makes you wait 30 days before a retake, but I didn't book the earliest possible date — I picked August 15 on purpose, because June and July were consumed by the kids and camps, and August 15 was the first point I honestly believed I'd be ready, not just eligible. Choosing the date around my real life instead of forcing the soonest slot is a big part of why none of this collapsed.
Second, that left a real window between the CC on August 15 and SC-900 after — enough runway for the every-other-day cadence I know works for me, without cannibalizing my CC home stretch. If those two exams had been jammed a week apart, this post would be titled "Why I Did NOT Add SC-900."
The overlap most people underestimate
Here's what turned "two exams" into "one reinforcing block": CC and SC-900 overlap more than they look like they do.
One's vendor-neutral ISC2 fundamentals; the other's Microsoft's Security, Compliance, and Identity path. Different worlds on the surface. Underneath, same questions in different accents:
Access control models. The CC drilled me on DAC, MAC, and RBAC. SC-900 asks the same authorization logic in Microsoft's language — Conditional Access, role-based access in Entra. Same muscle, different accent.
Identity as the perimeter. Both certs hammer that identity is the new security boundary. Learning it once for the CC meant I was consolidating, not learning cold, when SC-900 raised it again.
Core security concepts. Encryption, shared responsibility, defense-in-depth — these aren't CC concepts or SC-900 concepts. They're security concepts, and every hour counted twice.
So the study blocks didn't compete. They compounded. CC prep made SC-900 land faster; previewing SC-900 deepened the CC fundamentals I was about to be tested on.
What I'd tell you if you're eyeing a second cert
I'm not here to tell you to stack certs. For a lot of people in a lot of seasons, the disciplined answer is no. But if you're tempted, run the checks I ran:
Match the exam to the season you actually have, not the one you wish you had. SC-200 was right on paper and wrong for that summer. SC-900 fit. Swapping the tier instead of forcing the timing saved the whole plan.
Don't waste a free voucher — but don't let "free" bully you into the wrong exam either. Free changes the math; it doesn't change whether the fit is right.
Baseline cold and read the shape, not the score. Clustered gaps are drillable. Scattered gaps are a warning.
Own your calendar. I chose my retake date around my kids, not around the earliest slot. Protecting the window is what made two exams survivable.
Look for overlap honestly. If the material compounds, two exams can be one block. If it doesn't, you're just doubling the load and calling it strategy.
One more first
Worth naming: SC-900 on September 20, 2026 is my first-ever online proctored exam. After the in-person anomaly that derailed my first CC attempt, sitting an exam from my own machine is a whole new variable — so I've already downloaded the proctoring software and run the system test on my setup. No surprises on exam day if I can help it. (That's its own post coming.)
The CC is done now. Passed on August 15, 2026. SC-900's booked for the 20th with the full course already behind me. What looked like piling a second exam onto a bad summer was really one voucher, one honest look at my calendar, and one swap to the exam that actually fit.
How I'd explain this in a SOC interview
Ask me about a time I had to reprioritize under pressure with incomplete information, and this is the story I'd tell: an unexpected disruption blew up my original plan, so I took a cold baseline reading to get objective data, read the pattern in the failures rather than reacting to the headline number, weighed cost against constraints and available time, and swapped my approach to the one that fit reality instead of forcing the plan I'd started with. That's triage.
In a SOC, you don't get to run every alert to ground with unlimited time — you baseline, you read where the anomalies cluster, you weigh severity against the resources you've got, and you commit to the response that fits the window you're actually in. Same instinct, different console.
Storm to SOC — read the map, then move. 💜
Comments