Examworthyexamworthy.comISC2 Certified in Cybersecurity cheat sheet
ISC2
Free to share. Examworthy is not affiliated with or endorsed by ISC2; ISC2-CC and related marks belong to their respective owners.
At a glance
Format: Multiple choice and advanced item types
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
CC rewards precise foundations and the single best first action for a scenario, not memorised definitions or a blanket rule.
Spot the trap
Tempting wrong answers, and why they failTempting but wrong
Is preventing unauthorised parties from disclosing information the job of integrity?
Why it fails
No. Unauthorised change is a real concern, but integrity is about accuracy and preventing alteration, not about preventing disclosure. Restricting who may see data is confidentiality.
Security Principles
Tempting but wrong
The data link layer (Layer 2) does addressing, so it can move data between separate networks.
Why it fails
Layer 2 does address, but only with hardware MAC addresses that move frames within a single local segment. It cannot forward between separate networks, which requires Layer 3 logical addressing.
Network Security
Tempting but wrong
An owner deciding who reads a file, with users able to pass access on, describes mandatory access control.
Why it fails
Tempting because MAC also governs who may read a resource, but MAC forbids owners and users from granting access. The described ability of an owner to decide and of a user to pass access on contradicts MAC entirely.
Access Controls Concepts
Tempting but wrong
Symmetric cryptography uses a public and private key pair, while asymmetric uses a single shared secret key.
Why it fails
This uses the right vocabulary but reverses the two definitions. Symmetric uses the single shared key; asymmetric uses the public and private pair, so each model is described incorrectly.
Security Operations
Tempting but wrong
A business continuity plan exists to restore IT systems and data after a technical failure or outage.
Why it fails
Tempting because DR is part of resilience planning, but this describes disaster recovery, which focuses on technology restoration. The business continuity plan has a broader aim than rebuilding systems: sustaining critical functions overall.
Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts
Tempting but wrong
Does availability stop unauthorised parties from seeing data?
Why it fails
No. Availability also involves authorised users, but it addresses timely access to data, not stopping unauthorised parties from viewing it. Preventing disclosure is confidentiality.
Security Principles
Tempting but wrong
The transport layer (Layer 4) provides end-to-end delivery, so it performs the path selection between networks.
Why it fails
Layer 4 does handle end-to-end delivery, but it identifies applications with port numbers and performs no logical network addressing or path selection. Routing between networks is Layer 3's job.
Network Security
Tempting but wrong
Owner-set, delegable file permissions describe role-based access control because permissions follow the job function.
Why it fails
Tempting since RBAC is common, but the scenario ties permissions to an owner's personal decision about a specific file, not to a job role, so RBAC does not fit.
Access Controls Concepts
Key terms
Exam-day rules
- Read the last line of the question first. It tells you what is actually being asked, so you can read the scenario looking for the answer rather than memorising detail.
- Choose the single best answer, not merely a correct one. Several options are often true; the exam wants the best fit or the best first action for the stated scenario.
- Name the CIA pillar in play. Deciding whether the scenario is about confidentiality, integrity, or availability rules out options aimed at a different pillar.
- Watch for absolutes and for a control that claims to cover everything. A single control rarely protects all three CIA pillars, and always or never is usually the wrong answer.
- For access-control questions, find who makes the decision. Owner-granted is DAC, clearance-enforced is MAC, role-attached is RBAC, condition-based is rule-based.
Revision schedule
- Day 1Map the outline and set a date
- Week 1Lock the security principles (Domain 1)
- Weeks 1-2Master access controls (Domain 3)
- Weeks 2-3Work through network security (Domain 4)
- Week 3Cover operations and continuity (Domains 5 and 2)