ISC2 Certified in Cybersecurity (CC)
ISC2 Certified in Cybersecurity (CC) is ISC2's entry credential and the lowest-friction path into the ISC2 certification ladder. The exam covers five domains spanning security principles, business continuity, access controls, network security, and security operations. ISC2 keeps the exam fee at $50 for first-time test-takers via the One Million Certified in Cybersecurity initiative, which makes CC the cheapest accredited cybersecurity credential in the catalog. The exam is 100 multiple-choice questions in 120 minutes with a passing score of 700 on a scaled 100-1000 scale.
Exam fee at last check: $50, per the vendor. The official objectives are at www.isc2.org/Certifications/CC. Verified 2026-05-22.
New CC exam outline effective 2026-09-01, with AI topics added throughout.
- ISC2 published an updated Certified in Cybersecurity outline effective 2026-09-01.1
- New domain weights: Security Principles 24%, Security Governance 17.3%, Identity And Access Management (IAM) Concepts 20%, Networking and Cloud Security Concepts 21.3%, Security Operations and Incident Response 17.3%.1
- ISC2 states that AI topics are added across the domains.1
The practice questions on this page were written before the 2026-09-01 outline. Check the weights above against the ISC2 outline before relying on the domain percentages shown below.
Sources, checked 2026-10-04
Get an email if the ISC2 Certified in Cybersecurity (CC) exam changes
Common questions about the exam change
- When does the new ISC2 Certified in Cybersecurity (CC) exam start?
- New CC outline takes effect: 2026-09-01. Source: ISC2: inside the updated CC exam, checked 2026-10-04.
- What changed in the ISC2 Certified in Cybersecurity (CC) exam?
- ISC2 published an updated Certified in Cybersecurity outline effective 2026-09-01. New domain weights: Security Principles 24%, Security Governance 17.3%, Identity And Access Management (IAM) Concepts 20%, Networking and Cloud Security Concepts 21.3%, Security Operations and Incident Response 17.3%. ISC2 states that AI topics are added across the domains. Source: ISC2: inside the updated CC exam, checked 2026-10-04.
- Which version of the ISC2 Certified in Cybersecurity (CC) exam do the practice questions follow?
- The practice questions on this page were written before the 2026-09-01 outline. Check the weights above against the ISC2 outline before relying on the domain percentages shown below.
- Starts New CC outline takes effect
- Security Principles24%
- Security Governance17.3%
- Identity And Access Management (IAM) Concepts20%
- Networking and Cloud Security Concepts21.3%
- Security operations and incident response17.3%
Source: ISC2: inside the updated CC exam. Checked 2026-10-04. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Security Principles 26%
Foundational vocabulary the rest of the exam builds on. CIA triad, authentication / authorization, privacy, risk-management process, security controls, and governance.
- CIA triad plus privacy
- Authentication, authorization, non-repudiation
- Risk-management process: identification, assessment, treatment (mitigate, transfer, avoid, accept)
- Security control categories: administrative, technical, physical
- Governance: policies, standards, procedures, guidelines
- Ethics: ISC2 Code of Ethics
Primary sources: ISC2 Certified in Cybersecurity exam outline, ISC2 Code of Ethics, NIST SP 800-53 Rev. 5
Business Continuity, Disaster Recovery, and Incident Response 10%
Process and concepts for keeping operations going during and after disruptions, plus the canonical incident-response lifecycle.
- Business continuity plan (BCP) purpose, scope, ownership
- Disaster recovery plan (DRP), RTO, RPO
- Backup strategies: full, differential, incremental; on-site, off-site, cloud
- Incident-response lifecycle (NIST SP 800-61 Rev. 2): preparation, detection and analysis, containment / eradication / recovery, post-incident
- Communication during incidents: internal, external, regulatory
Primary sources: NIST SP 800-61 Rev. 2 Computer Security Incident Handling Guide, NIST SP 800-34 Rev. 1 Contingency Planning Guide
Access Controls Concepts 22%
How identity is established and what each identity is allowed to do. Physical and logical access controls plus the canonical access models.
- Subjects and objects in access control
- Authentication factors: knowledge, possession, inherence
- Authorization models: DAC, MAC, RBAC, ABAC
- Least privilege, segregation of duties, need to know
- Physical access controls: badges, biometrics, mantraps, locks
Primary sources: NIST SP 800-162 Guide to Attribute-Based Access Control, NIST SP 800-63B Authentication and Lifecycle Management
Network Security 24%
Network architecture and the controls that protect data moving across networks. Threats, defenses, and the OSI / TCP-IP layering.
- OSI 7-layer model and TCP/IP 4-layer model
- Common network threats: DDoS, MITM, spoofing, sniffing, port scanning
- Network controls: firewall, IDS/IPS, network segmentation (VLAN, DMZ), VPN
- Wireless security: WPA3, SSID broadcasting, MAC filtering limits
- Cloud network security: shared responsibility model, security groups, ACLs
Primary sources: NIST SP 800-41 Rev. 1 Guidelines on Firewalls and Firewall Policy, NIST SP 800-77 Rev. 1 Guide to IPsec VPNs
Security Operations 18%
Day-to-day defense at the operational layer. Data handling, system hardening, configuration management, awareness, and monitoring.
- Data classification and labeling
- Encryption: symmetric, asymmetric, hashing, digital signatures, PKI basics
- Configuration management and change control
- System hardening: removing unnecessary services, default credential change, patching
- Security awareness training, social engineering recognition
- Logging and monitoring, SIEM basics
Primary sources: NIST SP 800-128 Guide for Security-Focused Configuration Management, NIST SP 800-92 Guide to Log Management
Exam-day strategy
Read each question for the specific verb. ISC2 CC questions often turn on 'best', 'first', 'least', or 'most accurate' qualifiers.
Eliminate two distractors before choosing between the remaining options. The right answer is usually the most policy-aligned and least surprising.
Watch for ISC2 Code of Ethics traps. When the scenario hints at a conflict between operational expediency and ethics, the exam expects the ethical choice.
Pace at roughly 60 seconds per question on the first pass. The 120-minute clock is generous; do not rush.
On uncertain questions, flag and return. Your first informed guess is usually correct; don't overthink unless new information changes the picture.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of ISC2. CC (Certified in Cybersecurity) is a trademark of ISC2. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.