ISC2 Certified in Cybersecurity (CC)
ISC2-CC
The entry-level cybersecurity certification from ISC2 for launching a security career — no experience required. CC covers security principles, security governance, identity and access management, networking and cloud security, and security operations and incident response, with foundational AI security woven in.
100
120 min
700/ 1000
202+
Question Types
Language & Recognition
Official Exam Languages
PasslyExam Languages
Recognition Scope
Exam Domains
Security Principles
Security Governance
Identity and Access Management (IAM) Concepts
Networking and Cloud Security Concepts
Security Operations and Incident Response
Recommended Study Plan
- Week 1 · Overview and vocabulary. CC is entry-level (no experience required): 100–125 multiple-choice questions, 2 hours, pass 700/1000. Five domains: Security Principles (24%), Security Governance (17%), Identity and Access Management/IAM (20%), Networking and Cloud Security (22%), and Security Operations and Incident Response (17%). Prioritize memorizing terms and definitions.
- Week 2 · Principles and governance. Master the CIA triad, AAA and non-repudiation, threat vs vulnerability vs risk and treatment (avoid/mitigate/transfer/accept), control categories vs types, the policy > standard > procedure > guideline hierarchy, the ISC2 Code of Ethics (canon ORDER matters), and GRC with GDPR/HIPAA/PCI-DSS.
- Week 3 · IAM, networking, and cloud. Access models DAC/MAC/RBAC/ABAC, least privilege vs separation of duties, the identity lifecycle, and real MFA. Networking basics (ports, IDS vs IPS, firewall/VPN), IaaS/PaaS/SaaS and shared responsibility, Zero Trust, and WPA3.
- Week 4 · Security operations and incident response. Data states, encryption vs hashing vs masking, hardening and change management, monitoring/SIEM, the incident-response ORDER (preparation → detection → containment → eradication → recovery → lessons learned), and BC vs DR with RTO/RPO.
- Final days · Timed mock exams. Drill the confusable pairs (DAC vs MAC, IDS vs IPS, RTO vs RPO, MFA factors), review AI security at an awareness level, and lock in your answering pace.
Question Validation Process
Try the practice set directly and judge real-exam similarity yourself.
Frequently Asked Questions
Q. What is the CC exam format, and do I need experience?
A. No experience is required — it is ISC2’s entry-level certification. It is 100–125 multiple-choice questions in 2 hours, passing at 700/1000. A great first step before Security+ or cloud certifications.
Q. Which domains carry the most weight?
A. Security Principles (24%) and Networking & Cloud Security (22%) are largest, followed by IAM (20%); Security Governance and Security Operations & Incident Response are 17% each. AI security is integrated at an awareness level.
Q. Do I need math or programming?
A. No. CC tests conceptual understanding, not engineering: distinguishing terms (threat vs risk, DAC vs MAC, encryption vs hashing) and choosing the best option. There is no math or command syntax.
Q. How do practice questions and the timed mock exam differ?
A. Practice questions are solved by topic with answer explanations to shore up weak areas; the timed mock exam is taken like the real thing. Both use original questions with AI tutor explanations.
Q. Is this similar to exam dumps?
A. PasslyExam does not provide leaked dumps. Our content is built from official guides and public exam objectives, then tuned to reflect realistic question patterns and difficulty distribution. The focus is practical readiness with explanation-based learning, not memorization of leaked items.
View dump-alternative guide