How to pass ISC2 Certified in Cybersecurity (ISC2-CC)
20 min read5 domains coveredFree practice, no sign-up
The ISC2 Certified in Cybersecurity (CC) is an entry-level certification that tests whether you understand the foundations of security: the core principles, how organisations recover from disruption, how access is controlled, how networks are attacked and defended, and how day-to-day security operations run. There is no configuration and no command line. Almost every question is a short scenario about a small organisation or an end user that asks for the best concept, control, classification, or first action.
It suits people starting in security or moving into it from an adjacent role: help-desk and IT staff, career changers, students, and anyone who needs a recognised grounding before an associate-level credential. If you can already explain the CIA triad and tell the four access-control models apart, much of the exam will feel familiar. If those are new, the gap is closable in a few focused weeks because the outline is broad and conceptual rather than deep and technical.
The exam rewards precision and judgement over recall. Many options are true statements about security but wrong for the scenario as written, so the skill being tested is matching the right idea to the situation, not reciting a definition. Practise on scenario questions with worked explanations so you learn why each wrong option is tempting and why it fails, not just which letter is correct.
CC rewards precise foundations and the single best first action for a scenario, not memorised definitions or a blanket rule.
Difficulty
Foundational
Best for
Newcomers to cybersecurity and IT staff moving into security: help-desk technicians, career changers, students, and anyone who wants a recognised first credential before an associate-level exam.
Prerequisites
None. Basic familiarity with computers and networks helps but is not assumed, and ISC2 sets no experience requirement for CC.
100 to 125
Questions
120 min
Time allowed
700 / 1000
Pass mark
$199
Exam cost (USD)
321
Practice questions
How this exam thinks
Three habits separate a pass from a fail on CC, and none of them is about knowing more facts.
First, the exam asks for the single best answer, not merely a correct one. The questions are short scenarios, and several options will be accurate statements about security. Only one fits the situation as written. Read the requirement in the last line first, then judge each option against that requirement rather than against general truth. At this level the best answer is usually the most precise concept or the best FIRST action, not a sweeping rule, so an option that is true in the abstract is still wrong if it does not answer what the scenario asked.
Second, the exam keeps returning to a small set of distinctions it expects you to make automatically: which pillar of the CIA triad a control or a breach actually affects, which of the four access-control models a scenario describes, and the order of the incident-response phases. When one of these is in play, resolve it on sight instead of reasoning it out each time. A control that keeps data from being altered is protecting integrity, not confidentiality; a system that decides access by comparing a document's label with a user's clearance is mandatory access control, not role-based.
Third, the exam distrusts absolutes and rewards the measured choice. Options that say a single control protects all three CIA pillars, that a technology is always or never appropriate, or that one step removes all risk are usually the distractor, because real security is about reducing risk to an acceptable level, not eliminating it. When two options look right, prefer the one that names the precise mechanism, the correct order, or the best first action over the one that promises completeness.
What each domain tests and how to study it
The ISC2-CC blueprint is split across 5 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.
What you must be able to do. Reason from the CIA triad and the risk-management vocabulary: name which pillar a control protects, place a control in the right type and function, choose a risk treatment, and apply the ISC2 Code of Ethics.
In one sentenceThe shared foundation the rest of the exam assumes: the CIA triad, the AAA framework, the risk terms and treatment options, control types and functions, and the ISC2 Code of Ethics.
Recall check: answer these from memory first
State the CIA triad and give one control that protects each pillar, then name a breach that harms only one of them.
Name the four risk-treatment options and give a one-line example of each, and say what residual risk means.
List the four canons of the ISC2 Code of Ethics in order and say why their order matters.
What it tests. The core vocabulary and mental models: confidentiality, integrity, and availability and which one a given control or breach affects, the AAA framework of identification, authentication, authorisation, and accountability, and the risk terms of asset, threat, vulnerability, likelihood, and impact. It tests the four risk-treatment options of avoid, mitigate, transfer, and accept, the difference between inherent and residual risk, control types (administrative, technical, physical) and functions (preventive, detective, corrective, deterrent, compensating), and the four canons of the ISC2 Code of Ethics.
How to study it. Get the terms exact first, because every later domain builds on them. Be able to say in one sentence which pillar each control protects, and practise on scenarios that isolate a single pillar so you stop reaching for all three. Learn the four risk treatments as a decision, not a list: transfer is insurance or a contract, mitigate is a control, avoid is not doing the risky thing, accept is a documented decision. Memorise the order and precedence of the Code of Ethics canons, because a question can turn on which canon wins when two conflict.
Easy to confuse
Which CIA pillar a control protects. Confidentiality keeps data from being seen by the wrong people, integrity keeps it from being altered, and availability keeps it reachable when needed. A hash detects tampering, so it serves integrity; encryption hides content, so it serves confidentiality. The exam plants a scenario that isolates one pillar and offers a control aimed at a different one.
Threat versus vulnerability versus risk. A threat is a potential cause of harm, a vulnerability is a weakness the threat could exploit, and risk is the combination of how likely that is and how much it would hurt. The exam swaps these terms in the options, so match the definition to the word rather than trusting a familiar-sounding phrase.
Risk mitigation versus transfer versus acceptance. Mitigation reduces the likelihood or impact with a control, transfer shifts the financial consequence to another party such as an insurer, and acceptance is a documented decision to live with the residual risk. Buying insurance is transfer, not mitigation, which is the swap the exam tests.
Inherent versus residual risk. Inherent risk is the exposure before any control is applied; residual risk is what remains after controls are in place. The exam asks which one a scenario is describing, usually after a control has just been added, where the answer is residual.
Worked example from the ISC2-CC bank
lock_openFree sampleSecurity Principleseasy
A training officer at a clinic explains that one member of the CIA triad is about making sure information is not disclosed to people or systems that have no authorisation to see it. Which member of the triad does this description define?
AConfidentiality, because it limits disclosure of information to those parties that have been properly authorised to access it.check_circle Correct
BIntegrity, because it keeps stored records accurate and unaltered by anyone who lacks the proper authorisation to change them.
CAvailability, because it keeps information reachable so that authorised users can obtain it whenever they legitimately need it.
DNon-repudiation, because it prevents a party from denying that it accessed or disclosed a given piece of information.
Confidentiality is the CIA triad property that prevents disclosure of information to unauthorised people or systems. Confidentiality restricts who can view data, so its purpose is to keep information from being disclosed to parties that lack authorisation, which distinguishes it from integrity and availability.
Why A is correct: Confidentiality is the triad property that prevents disclosure of information to unauthorised people or systems, which is exactly what the description states.
Why B is wrong: Integrity is tempting because unauthorised change is also a concern, but integrity concerns accuracy and prevention of alteration, not the prevention of disclosure that the description names.
Why C is wrong: Availability sounds relevant because it also involves authorised users, but it addresses timely access to data rather than stopping unauthorised parties from seeing it.
Why D is wrong: Non-repudiation is tempting through its link to accountability, but it proves that an action occurred rather than preventing disclosure to unauthorised parties.
What you must be able to do. Tell the three plans apart, place the incident-response phases in order, and read the recovery metrics correctly so you can name the right objective or the right next step under disruption.
In one sentenceHow an organisation keeps running and recovers: business continuity versus disaster recovery versus incident response, the IR phase order, and the RTO, RPO, and MTD metrics.
Recall check: answer these from memory first
Distinguish business continuity, disaster recovery, and incident response by their trigger and goal in one line each.
List the incident-response phases in order and say what action belongs to containment versus eradication.
Explain RTO, RPO, and MTD in one line each and say which one a four-hour data-loss tolerance describes.
What it tests. The three overlapping disciplines and where each begins: business continuity keeping critical functions running during disruption, disaster recovery restoring IT systems and data afterwards, and incident response handling a security event as it unfolds. It tests the order of the incident-response phases (preparation, detection and analysis, containment, eradication, recovery, and lessons learned) and the recovery metrics: recovery time objective, recovery point objective, and maximum tolerable downtime, including which one a scenario is describing.
How to study it. Fix the three plans by their trigger and goal: continuity is about keeping the business functioning, disaster recovery is about restoring technology, incident response is about handling an event. Learn the incident-response phases as a fixed sequence and be able to name what comes next from any point, because out-of-order phases are a favourite distractor. Anchor the metrics to time versus data: RTO is how fast you must be back, RPO is how much data loss you can tolerate, MTD is the outer limit of downtime before the harm is unacceptable.
Easy to confuse
RTO versus RPO. RTO is a time-to-restore target: how quickly a process must be back after disruption. RPO is a data-loss target: how far back in time the last good backup can be. A scenario about backup frequency is RPO; a scenario about how long the outage may last is RTO, which is the swap the exam relies on.
RTO versus maximum tolerable downtime. MTD is the longest a function can be unavailable before the impact becomes unacceptable; RTO is the recovery target set inside that limit, so RTO is always less than or equal to MTD. When the stem says the maximum acceptable outage before harm becomes unacceptable, that is MTD, not RTO.
Containment versus eradication. Containment limits the spread of an incident, such as isolating a host, while eradication removes the cause, such as deleting the malware and closing the vulnerability. The exam asks for the correct next phase, so containment comes first and eradication follows.
Business continuity versus disaster recovery. Business continuity keeps critical business functions operating during a disruption, often with manual or alternate processes; disaster recovery is the subset focused on restoring IT systems and data. If the scenario is about keeping the business running, it is continuity; if it is about restoring servers and data, it is disaster recovery.
A new analyst at a logistics firm is asked to explain what a business continuity plan is fundamentally intended to achieve. Which statement best captures the core purpose of a business continuity plan?
AIt keeps the organisation's critical business functions running, or quickly resumed, during and after a disruptive event.check_circle Correct
BIt restores IT systems and data to a working state after a technical failure or outage.
CIt documents how the security team will detect, contain, and eradicate an active cyber attack.
DIt lists the hardware and software assets the organisation owns for insurance purposes.
A business continuity plan aims to keep critical business functions operating or swiftly resumed through a disruption. Business continuity planning is outcome-focused on the survival of the organisation's essential functions, treating technology recovery as one enabling piece rather than the goal itself.
Why A is correct: This is correct because the business continuity plan exists to sustain or rapidly restore the delivery of critical functions and services when normal operations are disrupted.
Why B is wrong: This describes disaster recovery, which focuses on technology restoration. It is tempting because DR is part of resilience planning, but the business continuity plan has a broader aim than rebuilding systems.
Why C is wrong: This describes incident response, which handles security events. It is tempting because incidents can trigger continuity plans, but detection and containment are not the plan's central goal.
Why D is wrong: An asset inventory supports several processes but is not the purpose of continuity planning. It is tempting because a plan draws on asset data, yet the plan is about maintaining operations, not cataloguing property.
What you must be able to do. Match a scenario to the right access-control model, distinguish physical from logical controls, and apply least privilege, need-to-know, and separation of duties as the specific fix a situation calls for.
In one sentenceWho gets access and how it is decided: the four access-control models, physical versus logical controls, and the principles of least privilege, need-to-know, and separation of duties.
Recall check: answer these from memory first
Give the one defining behaviour of DAC, MAC, RBAC, and rule-based access control in a single line each.
State the difference between least privilege and need-to-know, and name the control that stops one person owning a whole process.
Say whether a mantrap, a badge reader, and a file permission are physical or logical controls.
What it tests. How access decisions are made and enforced: the four logical models (discretionary, mandatory, role-based, and rule-based access control) and the scenario that pins each one, the difference between physical controls (locks, guards, badges, mantraps) and logical controls, and the guiding principles of least privilege, need-to-know, and separation of duties. It tests whether you can choose the model or principle that best addresses a described weakness rather than one that merely sounds relevant.
How to study it. Drill the four models until each has a signature: DAC lets the owner grant and pass on access at their discretion, MAC has the system enforce access by comparing labels with clearances and no user can override it, RBAC ties permissions to job roles, and rule-based applies system-wide conditions such as time or location to everyone alike. Practise picking the model from the scenario, because this is the single most error-prone area of the exam. Keep least privilege (only the access needed), need-to-know (only the information needed), and separation of duties (no single person controls a whole sensitive process) distinct, since scenarios often make one of them the best first control.
Easy to confuse
DAC versus MAC. In DAC the resource owner decides who gets access and can delegate it onward at their discretion; in MAC a central authority enforces access by comparing labels with clearances and neither the owner nor the user can change it. The tell is who holds the decision: an owner granting access is DAC, a system enforcing clearances is MAC.
RBAC versus rule-based access control. RBAC attaches permissions to a job role, so access follows the position a person holds; rule-based access control applies system-wide conditions such as time of day or source location to every user regardless of role. If the scenario ties access to a job function it is RBAC, if it applies a uniform condition to everyone it is rule-based.
Least privilege versus need-to-know. Least privilege limits the actions and system access a person has to the minimum their job requires; need-to-know limits access to the specific information required for a task, even among people with the same clearance. One is about capability, the other about the specific data, and the exam pairs the scenario with the tighter of the two.
Separation of duties versus least privilege. Separation of duties splits a sensitive process so no single person can complete it alone, defending against fraud; least privilege minimises each person's access. When one person can both create and approve a payment, the fix is separation of duties, not simply less access.
Worked example from the ISC2-CC bank
lock_openFree sampleAccess Controls Conceptshard
During a review of a design document, an analyst reads that the owner of each file decides who else may read or write it, and that a user who has been granted read access may then pass that access to a colleague. Which logical access control model does this describe?
ADiscretionary access control, because the resource owner sets permissions and access can be delegated onwardcheck_circle Correct
BMandatory access control, because a central authority enforces labels that users cannot change
CRole-based access control, because permissions follow the job function rather than the individual
DRule-based access control, because a system rule automatically evaluates each request
Recognise discretionary access control by its defining traits of owner-set permissions and the ability to delegate access onward. DAC is defined by owner discretion: the object owner assigns permissions, and subjects may pass their granted access to others, which is why uncontrolled propagation is a known DAC weakness.
Why A is correct: Correct: DAC lets the owner of an object set its permissions at their discretion, and a subject holding access can typically propagate that access to others, which is the defining behaviour described.
Why B is wrong: Tempting because MAC also governs who may read a resource, but MAC forbids owners and users from granting access; the described ability of an owner to decide and of a user to pass access on contradicts MAC entirely.
Why C is wrong: Tempting since RBAC is common, but the scenario ties permissions to an owner's personal decision about a specific file, not to a job role, so RBAC does not fit.
Why D is wrong: Tempting because a rule could permit reads, but rule-based control applies uniform system rules to all subjects rather than letting an owner personally grant and delegate access.
What you must be able to do. Use the OSI and TCP/IP layering and common ports to reason about traffic, recognise common network attacks, and pick the right infrastructure control for a described need.
In one sentenceHow networks work and how they are defended: the OSI and TCP/IP models, common ports and protocols, the frequent attacks, and the infrastructure controls such as firewalls, VPNs, and segmentation.
Recall check: answer these from memory first
Name the OSI layers in order and say which layer a router and a switch operate at.
Give the well-known port for HTTPS, SSH, and DNS, and the protocol each carries.
Match denial of service, on-path interception, and network segmentation each to the control or purpose that fits.
What it tests. Networking foundations and their defence: the OSI and TCP/IP layer models and what happens at each layer, well-known ports and the protocols that use them, and common threats and attacks such as denial of service, on-path interception, spoofing, and social-engineering-driven network attacks. It tests the infrastructure controls that mitigate them, including firewalls, intrusion detection and prevention, VPNs, network segmentation and VLANs, and secure wireless.
How to study it. Learn the layer models as a framework you can hang everything on, then attach the common ports and protocols to it so you can reason about where a control or an attack operates. Keep a short list of the frequent attacks with a one-line description and the control that counters each. For infrastructure, match the tool to the need: a firewall filters traffic by rules, segmentation limits lateral movement, a VPN protects data in transit over untrusted networks, and IDS or IPS detects or blocks known-bad activity.
Easy to confuse
OSI Layer 2 versus Layer 3. Layer 2 is the data-link layer that moves frames using MAC addresses, where a switch operates; Layer 3 is the network layer that routes packets using IP addresses, where a router operates. The exam asks which layer a device or an address belongs to, so tie MAC to Layer 2 and IP to Layer 3.
A protocol versus its well-known port. A protocol is the rules for the exchange and the well-known port is the default number it listens on, such as HTTPS on 443, SSH on 22, and DNS on 53. The exam plants a plausible but wrong port for a protocol, so verify the pairing rather than trusting a near-miss like SSH on 23.
Firewall versus intrusion detection or prevention system. A firewall permits or blocks traffic against a rule set at the boundary; an IDS detects and alerts on suspicious activity, and an IPS can block it inline. If the need is filtering by rules the answer is a firewall; if the need is spotting or stopping known-bad patterns it is IDS or IPS.
VPN versus network segmentation. A VPN protects the confidentiality and integrity of data as it crosses an untrusted network; segmentation divides a network so a compromise in one zone cannot reach another. One secures data in transit, the other limits lateral movement, and the exam matches the requirement to the right one.
Worked example from the ISC2-CC bank
lock_openFree sampleNetwork Securitymedium
A trainee is learning the OSI reference model and asks which layer is responsible for logical addressing and for selecting a path between networks so that a packet can reach a host on a different subnet. Which layer performs this function?
AThe data link layer (Layer 2), which frames bits and uses MAC addresses to move data between devices on the same physical segment.
BThe network layer (Layer 3), which uses logical IP addresses and routing decisions to forward packets between separate networks.check_circle Correct
CThe transport layer (Layer 4), which segments data and provides reliable end-to-end delivery using port numbers to identify applications.
DThe session layer (Layer 5), which establishes, manages and tears down dialogues between two communicating applications.
The OSI network layer (Layer 3) provides logical IP addressing and routing to move packets between separate networks. Routing between subnets requires logical addresses that are independent of hardware, which is exactly what the network layer supplies through IP addressing and forwarding decisions, while lower layers only move data within one segment.
Why A is wrong: This is tempting because Layer 2 also does addressing, but it uses hardware MAC addresses and only moves frames within a single local segment, not between separate networks.
Why B is correct: Correct: Layer 3 handles logical addressing with IP and makes routing decisions, allowing a packet to travel from one subnet to another.
Why C is wrong: This is tempting because Layer 4 does end-to-end delivery, but it identifies applications with ports and does not perform logical network addressing or path selection.
Why D is wrong: This is tempting as it sits near the middle of the stack, but Layer 5 manages conversations between applications and plays no role in addressing or routing.
What you must be able to do. Apply the everyday controls that keep systems secure: data protection and the right use of encryption and hashing, system hardening and configuration management, and security awareness backed by policy.
In one sentenceThe day-to-day of keeping systems secure: data handling and encryption, hashing for integrity, system hardening and configuration management, and security awareness and policy.
Recall check: answer these from memory first
Distinguish symmetric from asymmetric encryption in one line each and say which solves key exchange.
Explain why hashing provides integrity but not confidentiality.
Name three steps of system hardening and say which policy defines permitted and prohibited use.
What it tests. The operational controls that protect data and systems: data classification and handling, encryption for confidentiality (symmetric versus asymmetric) and hashing for integrity, and secure configuration through hardening, patching, baselines, and change control. It tests security awareness and the policy framework, including acceptable use, and the human-facing controls that reduce risk from phishing and social engineering.
How to study it. Keep the cryptography distinctions clean: symmetric uses one shared key and is fast for bulk data, asymmetric uses a public and private key pair and solves key exchange and digital signatures, and hashing is a one-way function that proves integrity rather than hiding content. Learn hardening as reducing the attack surface: remove what is not needed, patch what remains, and lock configuration to a baseline under change control. For awareness and policy, match the control to the human risk, so phishing is countered by training and reporting, and acceptable use is the policy that defines permitted and prohibited behaviour.
Easy to confuse
Symmetric versus asymmetric encryption. Symmetric encryption uses a single shared secret key for both encryption and decryption and is efficient for bulk data; asymmetric encryption uses a mathematically linked public and private key pair, which solves key exchange and enables digital signatures. The exam pairs the requirement, such as sharing a key safely or signing, with the right scheme.
Hashing versus encryption. Encryption is reversible with a key and protects confidentiality; hashing is a one-way function that produces a fixed digest and protects integrity by detecting change, not by hiding data. Treating a hash as a way to keep data secret is the mistake the exam sets up.
Hardening versus patching. Hardening is the broad reduction of attack surface by removing unneeded services, accounts, and features and applying a secure baseline; patching is specifically applying vendor fixes to known flaws. Patching is one part of hardening, so the exam asks for the wider action when the scenario is about reducing exposure overall.
Data at rest versus data in transit. Data at rest is stored data, protected by disk or file encryption; data in transit is moving across a network, protected by transport encryption such as TLS or a VPN. The exam asks which protection a scenario needs, so match the state of the data to the control.
Worked example from the ISC2-CC bank
lock_openFree sampleSecurity Operationsmedium
A junior analyst at a logistics firm is comparing symmetric and asymmetric cryptography while planning how two servers will exchange data. Which statement most accurately captures the essential difference between the two approaches?
ASymmetric cryptography always uses a public and private key pair, whereas asymmetric cryptography relies on a single shared secret key for both parties.
BSymmetric cryptography can only protect data in transit across a network, whereas asymmetric cryptography can only protect data at rest on storage.
CSymmetric cryptography uses one shared secret key for both encryption and decryption, whereas asymmetric cryptography uses a mathematically linked public and private key pair.check_circle Correct
DSymmetric cryptography provides non-repudiation through key pairs, whereas asymmetric cryptography cannot support digital signatures.
Symmetric cryptography uses one shared key while asymmetric cryptography uses a linked public and private key pair. The core distinction is key structure: symmetric algorithms use an identical secret key at both ends, while asymmetric algorithms use a public key to encrypt and the matching private key to decrypt, which also underpins digital signatures.
Why A is wrong: Tempting because it uses the right vocabulary, but it reverses the two definitions, so it describes each model incorrectly.
Why B is wrong: Plausible if a learner ties each type to one data state, but both approaches can protect data in transit or at rest, so the restriction is false.
Why C is correct: Correct: symmetric schemes such as AES rely on a single shared key, while asymmetric schemes such as RSA use a related public and private key pair, which is the defining distinction.
Why D is wrong: Attractive because non-repudiation is a real property, but it is asymmetric cryptography that enables signatures and non-repudiation, so this statement is inverted.
A study plan that works
Map the outline and set a date
Day 1
Read the official ISC2 CC exam outline and the five domains with their weights. Book a provisional exam date now: a fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam.
Lock the security principles (Domain 1)
Week 1
Get the CIA triad, the risk vocabulary, control types and functions, and the ISC2 Code of Ethics solid before anything else, because every later domain assumes them. Use the recall prompts in this guide: cover the summary, answer from memory, then reveal.
Master access controls (Domain 3)
Weeks 1-2
This is the most error-prone area, so give it dedicated time. Drill the four access-control models until you can name each from a scenario, and keep least privilege, need-to-know, and separation of duties distinct. Practise on scenario questions, not definitions alone.
Work through network security (Domain 4)
Weeks 2-3
Learn the OSI and TCP/IP layers, the common ports and protocols, the frequent attacks, and the infrastructure controls. This domain carries real weight and rewards a framework you can reason from, so build the layer model first and hang everything on it.
Cover operations and continuity (Domains 5 and 2)
Week 3
Cover security operations (encryption versus hashing, hardening, awareness and policy) and the business continuity, disaster recovery, and incident response concepts. Fix the incident-response phase order and the RTO, RPO, and MTD metrics, which are common distractors.
Practise on scenarios with worked explanations
Week 4
Move to full practice sets and read the explanation for every question, including the ones you got right. The exam tests the single best answer among plausible options, so understanding why each distractor is wrong is where the marks are.
Find and close your weak domains
Week 4
Use your per-domain accuracy to drill the domains dragging you down rather than re-reading what you already know. Repeat until every domain clears the pass line with margin on questions you have not seen before.
Know when you're ready
Readiness for CC is a score on questions you have not seen before, not a feeling that the material is familiar. Those are different things, and the gap between them is where people fail. Re-reading notes builds fluency, and fluency feels like knowledge, so confidence rises while real recall does not. The fix is to test yourself: if you can answer fresh scenario questions and explain why the wrong options are wrong, you know it; if you can only nod along to an explanation, you do not yet.
Be especially wary of early confidence on a foundational exam. The material is broad rather than deep, so a first pass feels like mastery, but the questions reward precision between plausible options, which only practice exposes. The access-control models and the recovery metrics in particular reward drilling until they are automatic. Trust your measured per-domain accuracy over your gut, and set the bar at clearing every domain comfortably on unseen questions across more than one session, not scraping a target once.
This guide gives you the map. The practice bank is where you find out whether you can navigate it, with a worked explanation and a reason every distractor is wrong on every question. Readiness scoring tells you when you are there. Not before.
Ready to put this into practice?
Free ISC2-CC questions with worked explanations. No sign-up.
Read the last line of the question first. It tells you what is actually being asked, so you can read the scenario looking for the answer rather than memorising detail.
Choose the single best answer, not merely a correct one. Several options are often true; the exam wants the best fit or the best first action for the stated scenario.
Name the CIA pillar in play. Deciding whether the scenario is about confidentiality, integrity, or availability rules out options aimed at a different pillar.
Watch for absolutes and for a control that claims to cover everything. A single control rarely protects all three CIA pillars, and always or never is usually the wrong answer.
For access-control questions, find who makes the decision. Owner-granted is DAC, clearance-enforced is MAC, role-attached is RBAC, condition-based is rule-based.
Flag and move on. Do not lose time on one hard item when easier marks are waiting; cover every question first, then return to the flagged ones.
Frequently asked questions
Is ISC2 CC hard?
It is a foundational, entry-level exam, so it is broad and conceptual rather than deep or technical, with no configuration or command line. The difficulty is in choosing the single best option among plausible ones, which is why scenario practice with worked explanations matters more than memorising definitions.
How long should I study for ISC2 CC?
Most candidates are ready in a few focused weeks. Less background means more time on the security principles and access-control domains, which are foundational and the most error-prone, while people already working in IT often move faster.
Do I need experience or a technical background to pass?
No. ISC2 sets no experience requirement for CC and the exam is conceptual. Basic familiarity with computers and networks helps, but you are not asked to configure anything or write commands.
What is the pass mark for ISC2 CC?
The exam is scored on a scaled range and the published pass mark is in the facts panel above. Scoring is scaled, so your raw percentage and the scaled score are not the same thing; aim to clear every domain comfortably in practice rather than scraping a target.
Which domains should I focus on?
Security Principles, Access Controls Concepts, and Network Security carry the most weight and include the most error-prone topics, so they deserve the most time. The business continuity and security operations material is lighter but still tests specific distinctions such as the incident-response phase order.
What are the four access-control models I need to know?
Discretionary (DAC), mandatory (MAC), role-based (RBAC), and rule-based access control. DAC lets the owner grant and delegate access, MAC has the system enforce access by labels and clearances, RBAC ties permissions to job roles, and rule-based applies uniform conditions such as time or location to everyone. Telling them apart from a scenario is one of the most tested skills.
How many practice questions should I do before booking?
Enough that every domain clears the pass line with margin on questions you have not seen before, and that a full timed run feels comfortable on pacing. Quality of review matters more than raw volume: read the explanation on every question, including the ones you got right.
Is the ISC2 CC worth it?
It is a recognised first credential from ISC2, the body behind the CISSP, and a practical grounding for anyone starting in security or moving into it from IT. The breadth of the content makes it a solid first rung before associate-level credentials and more specialised security certifications.
Examworthy is not affiliated with or endorsed by ISC2. This guide is original study material based on the public exam blueprint. We never reproduce live exam items. ISC2-CC and related marks belong to their respective owners.
