ISC2 Certified in Cybersecurity (CC)
ISC2-CC
The entry-level cybersecurity certification from ISC2 for launching a security career — no experience required. CC covers security principles, security governance, identity and access management, networking and cloud security, and security operations and incident response, with foundational AI security woven in.
100
120 min
700/ 1000
202+
Target Audience
Built for career changers moving into security, students and recent graduates, and IT generalists — help desk, support, sysadmin — who want their security knowledge on paper. It also suits non-security staff in adjacent roles (audit, compliance, project management) who need a working command of the vocabulary, and anyone planning to work toward the CISSP who wants a credential before accumulating the required experience.
Prerequisites
No work experience and no prior certification are required — this is ISC2's designated entry point into cybersecurity. Basic IT literacy helps: how networks, operating systems and user accounts fit together. The exam is conceptual rather than hands-on, so it tests whether you can reason about security principles, access control models, network defences, incident response and business continuity, not whether you can configure a specific product.
Question Types
Language & Recognition
Official Exam Languages
PasslyExam Languages
Recognition Scope
ISC2 Certified in Cybersecurity (CC) is a globally recognized entry-level credential, ANAB-accredited to ISO/IEC 17024 and approved by the U.S. Department of Defense under DoDM 8140.03. It is maintained with 45 CPE credits over a three-year cycle plus an annual maintenance fee, and is the recognized on-ramp to ISC2's higher certifications such as the CISSP.
Exam Domains
Security Principles
Security Governance
Identity and Access Management (IAM) Concepts
Networking and Cloud Security Concepts
Security Operations and Incident Response
Recommended Study Plan
- Week 1 · Overview and vocabulary. CC is entry-level (no experience required): 100–125 multiple-choice questions, 2 hours, pass 700/1000. Five domains: Security Principles (24%), Security Governance (17%), Identity and Access Management/IAM (20%), Networking and Cloud Security (22%), and Security Operations and Incident Response (17%). Prioritize memorizing terms and definitions.
- Week 2 · Principles and governance. Master the CIA triad, AAA and non-repudiation, threat vs vulnerability vs risk and treatment (avoid/mitigate/transfer/accept), control categories vs types, the policy > standard > procedure > guideline hierarchy, the ISC2 Code of Ethics (canon ORDER matters), and GRC with GDPR/HIPAA/PCI-DSS.
- Week 3 · IAM, networking, and cloud. Access models DAC/MAC/RBAC/ABAC, least privilege vs separation of duties, the identity lifecycle, and real MFA. Networking basics (ports, IDS vs IPS, firewall/VPN), IaaS/PaaS/SaaS and shared responsibility, Zero Trust, and WPA3.
- Week 4 · Security operations and incident response. Data states, encryption vs hashing vs masking, hardening and change management, monitoring/SIEM, the incident-response ORDER (preparation → detection → containment → eradication → recovery → lessons learned), and BC vs DR with RTO/RPO.
- Final days · Timed mock exams. Drill the confusable pairs (DAC vs MAC, IDS vs IPS, RTO vs RPO, MFA factors), review AI security at an awareness level, and lock in your answering pace.
Question Validation Process
Try the practice set directly and judge real-exam similarity yourself.
Frequently Asked Questions
Q. What is the CC exam format, and do I need experience?
A. No experience is required — it is ISC2’s entry-level certification. It is 100–125 multiple-choice questions in 2 hours, passing at 700/1000. A great first step before Security+ or cloud certifications.
Q. Which domains carry the most weight?
A. Security Principles (24%) and Networking & Cloud Security (22%) are largest, followed by IAM (20%); Security Governance and Security Operations & Incident Response are 17% each. AI security is integrated at an awareness level.
Q. Do I need math or programming?
A. No. CC tests conceptual understanding, not engineering: distinguishing terms (threat vs risk, DAC vs MAC, encryption vs hashing) and choosing the best option. There is no math or command syntax.
Q. How do practice questions and the timed mock exam differ?
A. Practice questions are solved by topic with answer explanations to shore up weak areas; the timed mock exam is taken like the real thing. Both use original questions with AI tutor explanations.
Q. Is this similar to exam dumps?
A. PasslyExam does not provide leaked dumps. Our content is built from official guides and public exam objectives, then tuned to reflect realistic question patterns and difficulty distribution. The focus is practical readiness with explanation-based learning, not memorization of leaked items.