Book companion · Edition 1

Certified in Cybersecurity CC Exam Study Guide

A Five-Domain Study Guide with 101 Diagrams, 19 Cheat Sheets, and Exam Reasoning

An unofficial study guide by Nex Arc Learning. Not affiliated with, endorsed by, or sponsored by ISC2 or any exam provider. CC, ISC2 and related names are trademarks of their respective owners.

About the book

This is the reader companion for Certified in Cybersecurity CC Exam Study Guide, edition 1, published by Nex Arc Learning as a Kindle ebook. The book prepares you for the CC Certified in Cybersecurity exam and follows the CC exam guide, September 2026. It has one chapter for each of the five exam domains, in the order of the online study guide.

Buying the book does not unlock the premium practice exams or the online study guide.

What the book covers

  1. Chapter 1 Security Principles Understand Cybersecurity Concepts · Understand Risk Management Concepts · Understand Governance Concepts · Understand Cybersecurity Controls · Maintain Professional and Ethical Conduct
  2. Chapter 2 Security Governance Plan Governance, Risk, and Compliance · Understand Redundancy and Business Resilience · Understand Security Awareness · Measure Cybersecurity Effectiveness
  3. Chapter 3 Identity And Access Management (IAM) Concepts Manage the Identity Life Cycle · Apply Logical Access Controls
  4. Chapter 4 Networking and Cloud Security Concepts Understand Network Security · Understand Network Security Architecture · Understand Cloud Security
  5. Chapter 5 Security Operations and Incident Response Understand Data Security · Understand Security Operations · Understand Incident Response · Understand Asset Protection · Understand Security Testing

Each chapter title links to the free overview of that domain in our online study guide.

Free practice questions

Check yourself with the free CC sample questions. Pick an answer and select Check answer to see why each option is right or wrong. No account needed, nothing is stored.

Loading the practice questions…

Prefer exam conditions? Take the same questions in the free CC practice exam.

Colour figures

On black-and-white Kindle e-readers the book's decision trees appear in greyscale. Here are all 23 overview decision trees in full colour, numbered as in the book. Follow a tree from the top question to the answer that fits your scenario.

Chapter 1: Security Principles

Figure 1.1 Decision tree: Understand Cybersecurity Concepts
Is it about verifying an identity, permittingaccess, recording activity or a false denial?No: information side (CIA, privacy)Yes: actor side (AAA, non-repudiation)Was information disclosed tosomeone not authorized?ConfidentialityYesNoWas information changed ordestroyed improperly?IntegrityYesNoDid authorized users losetimely, reliable access?AvailabilityYesNoIs personal information collected,used or kept inappropriately?PrivacyYesNoNone fits:re-read the scenarioDoes someone falsely denyan action they took?Non-repudiationYesNoIs a claimed identitybeing verified?AuthenticationYesNoIs access to something beingpermitted or denied?AuthorizationYesNoIs it about a record ofwhat someone did?AccountingYesNoNone fits:re-read the scenarioPersonal information involved? Privacy applies alongside whichever concept the tree reaches.
Read this topic in the online study guide
Figure 1.6 Decision tree: Understand Risk Management Concepts
Is the risk withinrisk tolerance?Acceptauthorized decision, then monitorYesNoCan safeguards bring itwithin tolerance?Mitigatethen recheck residual riskYesNoCan the remaining consequencesbe shifted to another party?Transfere.g. insurance; likelihood unchangedthen recheck residual riskYesNoAvoidstop or never start the activityAlways: an authorized decision maker decides, responses can be combined, and monitoring continues
Read this topic in the online study guide
Figure 1.10 Decision tree: Understand Governance Concepts
A law or regulationfrom a government?Laws and regulationsrequired by governmentYesNoOutside guidance, not law,adopted or required?Frameworks and published standardschosen or requiredYesNoInternal governance documentsSets direction andresponsibility?Policymanagement directionYesNoGives the exact stepsfor one task?Procedurestep-by-step tasksYesNoMandatory withinits scope?Standardmandatory specificsYesNoGuidelinerecommended practice
Read this topic in the online study guide
Figure 1.15 Decision tree: Understand Cybersecurity Controls
Done by a tangible barrier, camera,motion or door sensor, or facility protection?Runs in the system's hardware,software or firmware?Directs or checks whatpeople do?Physical controlseven when electronicTechnical controlsfirewalls, permissionsAdministrative controlspolicies, training, auditsReassess the mechanismnone of the three typesfits yetYesNoYesNoYesNoStands in for a recommended control with equivalent or comparable protection?Then it is a compensating control: classify it by what performs the protection
Read this topic in the online study guide
Figure 1.18 Decision tree: Maintain Professional and Ethical Conduct
Ask every question: one scenario can engage more than one canonThe questions follow the published canon order, not a rankingHarm to the publicor infrastructure?Canon I:Protect societyYesEither answer: ask the next questionAbout your own honestyor lawfulness?Canon II:Act honorablyYesEither answer: ask the next questionDuty owed to anemployer or client?Canon III:Serve principalsYesEither answer: ask the next questionAffects the professionor fellow practitioners?Canon IV:Advance the professionYesSaw another member breach any canon?Report it through the ISC2 ethics complaint procedure
Read this topic in the online study guide

Chapter 2: Security Governance

Figure 2.1 Decision tree: Security Governance
Tracking a metric againsta target, or reporting results?MeasurementMeasure Cybersecurity EffectivenessYesNoKeeping work going, or bringingsystems back, after a disruption?ResilienceUnderstand Redundancy and Business ResilienceYesNoShaping how peoplehandle threats?AwarenessUnderstand Security AwarenessYesNoGRC planningPlan Governance, Risk, and Compliance
Read this topic in the online study guide
Figure 2.2 Decision tree: Plan Governance, Risk, and Compliance
Comparing current outcomeswith desired outcomes?Current and Target Profilegap analysis, action planYesNoRecording prioritized risksand who decides?Risk registerrisk owner decidesYesNoTracking corrective workon a known gap?POA&Mmitigation: open until reassessedYesNo: relating guidanceControl mappingrelationships, not evidenceEach record supports decisions; none of them proves protection on its own
Read this topic in the online study guide
Figure 2.6 Decision tree: Understand Redundancy and Business Resilience
Is the primary facilitystill usable?Restore in placefrom backupsYesNoShort RTO: quick takeoverat another site needed?Hot siteequipment and support readyYesNoDoes the RTO allow time toobtain and install equipment?Cold sitespace and power, no equipmentYesNoWarm sitepartly equipped, finish setupAlways: away from the primary site's hazards, with tested backups it can read
Read this topic in the online study guide
Figure 2.12 Decision tree: Understand Security Awareness
Already clicked a link ordisclosed information?Report the exposure promptlychange any affected password via a trusted processYesNoDoes it ask foryour password?Never share the passworddecline; contact the help desk yourselfYesNoCould a sensitive requestbe genuine?Verify through an independent routeuse contact details you found yourselfYesNoReport without interactingno links, attachments, or unsubscribeAlways: report through the established channel and follow the playbook
Read this topic in the online study guide
Figure 2.16 Decision tree: Measure Cybersecurity Effectiveness
Is the planned controlin place, and how widely?Implementation measurecoverage of the controlYesNoDoes the control achieveits intended result?Effectiveness measureoutcomes, e.g. test resultsYesNoHow quicklyis the work done?Efficiency measuree.g. mean time to remediateYesNoWhat does security meanfor the mission or budget?Impact measuree.g. incident costsYesNoNone of these: restate the question before choosing a metric
Read this topic in the online study guide

Chapter 3: Identity And Access Management (IAM) Concepts

Figure 3.1 Decision tree: Identity And Access Management (IAM) Concepts
Which part of IAM applies to the scenario?Does the scenario followan identity over time?joining, transferring, leaving, reviewYesIdentity life cycleroles definition, provisioning,review, deprovisioningNo: one requestIs the problem verifyingwho the subject is?YesLogical access controls:authenticationverifying the identity ofa user, process or deviceNoLogical access controls:authorizationleast privilege, separation of duties,access control models, default deny
Read this topic in the online study guide
Figure 3.2 Decision tree: Manage the Identity Life Cycle
Which life cycle stage does the scenario call for?Has the need ended?departure, contract end, bot retiredYesDeprovisioningdisable every access pathNoDefining a job's access?before anyone is assignedYesRoles definitionlist operations and criteriaNoMoving to a new job?internal transferYesReview, then provisioningremove unneeded access, grant newNoGaining access not yet held?new joiner or approved requestYesProvisioningapprove, plus required proofing and agreementNoReviewrevalidate access already heldAlways: frameworks and toolsfor people, bots and service accounts
Read this topic in the online study guide
Figure 3.6 Decision tree: Apply Logical Access Controls
All four questions are asked; more than one can be answered yesIs access left to the discretionof the object's owner?Discretionary access control (DAC)subjects may grant their privileges to othersYesEither wayDoes a uniformly enforced policy decide,for example by labels and clearances?Mandatory access control (MAC)subjects constrained from granting privilegesYesEither wayIs access based on the defined role(job function) of the subject?Role-based access control (RBAC)can be mandatory or discretionaryYesEither wayIs access based on attributes of thesubject, object and environment?Attribute-based access control (ABAC)can be mandatory or discretionaryYesWhatever the model: least privilege, separation of duties, default deny
Read this topic in the online study guide

Chapter 4: Networking and Cloud Security Concepts

Figure 4.1 Decision tree: Networking and Cloud Security Concepts
Does the scenario turn on whata cloud provider runs and whatthe customer secures?Responsibility questionUnderstand Cloud SecurityYesNoDoes it ask where boundariessit and what may cross them?Boundary questionUnderstand Network SecurityArchitectureYesNoTraffic questionUnderstand Network SecurityNetwork firewalls control the flow of traffic between networks or hosts;attacks sent from one internal host to another often do not pass through them (NIST SP 800-41r1)
Read this topic in the online study guide
Figure 4.2 Decision tree: Understand Network Security
Protect traffic crossingan untrusted network?VPNprotected tunnelYesNoAllow or block bywritten rules?Yes: firewallNo: detectsuspicious activityDoes the decision needapplication content?Block identified activityautomatically?YesNoApplication-awareinspectionapplication firewall or proxyDoes it depend on anexisting connection?YesNoStateful inspectiontracks connectionsPacket filteraddresses, protocol, portsYesNoIPScan blockIDSalerts for reviewSound firewall policy: deny by default, in both directions (ingress and egress)
Read this topic in the online study guide
Figure 4.9 Decision tree: Understand Network Security Architecture
Step 1: choose the segmentPublic-facing server,such as web or email?DMZcommon placementYesNoVisitors needingInternet access only?Guest networkseparate segmentYesNoInternal segmentVLAN with filtering, or internal firewallStep 2: for a system in any segmentIndividual workloadsmust be restricted?Micro-segmentationboundary per workloadYesSegment boundaryno per-workload boundaryNoAlways: Zero Trust still evaluates each request, and defense in depth adds layers
Read this topic in the online study guide
Figure 4.14 Decision tree: Understand Cloud Security
Distinct clouds bound togetherfor data and application portability?Hybrid cloudmembers stay distinctYesNoOpen to the general public?Public cloudanyone may subscribeYesNoExclusive to a singleorganization?Private cloudone organization, on or off premisesCommunity cloudorganizations with shared concernsYesNoLocation alone never decides the model: a private cloud can be off premises
Read this topic in the online study guide

Chapter 5: Security Operations and Incident Response

Figure 5.1 Decision tree: Security Operations and Incident Response
Which page of the domain does the scenario belong to?Incident declared, or the responseplan tested or rehearsed?Understand Incident Responsedeclared incident: Respond and Recoverexercises and tests: Improvement (ID.IM-02)YesNoEvents or alertsbeing analyzed?Understand Security Operationsincident response layer (Detect)YesNoDefenses being testedon purpose?Understand Security TestingImprovementYesNoProtecting the information,or the asset holding it?Understand Data Securitypreparation layer (Protect)InformationAssetUnderstand Asset Protectionpreparation layer (Identify and Protect)Always: act within the documented authority, then verify the result
Read this topic in the online study guide
Figure 5.2 Decision tree: Understand Data Security
Is confidentiality protection required?Yes: encryption, then integrity protectionNo: integrity protection onlySymmetric key already shared between entities?YesNoSymmetric encryptionsymmetric-key cryptography aloneHybrid cryptographyan asymmetric-key system establishes the symmetric keyAll sensitive information requires integrity protectionMust anyone verify who signed?YesNoDigital signatureanyone that knows the public key can verify itIs the risk of an adversary altering the dataand computing a new hash value very low?NoYesMessage authentication code (MAC)verified by any entity that knows the keyHash function alonesome assurance of data integrityAlways: protect secret and private keys against unauthorized disclosureif a key needed to recover data is lost, the data is lost unless the key can be recovered;have a transition strategy for advances such as quantum computers
Read this topic in the online study guide
Figure 5.8 Decision tree: Understand Security Operations
May anyone receive it?TLP:CLEARno limit on disclosureYesNoMay the community receive it?TLP:GREENcommunity, not publicYesNoMay the organization receive it?TLP:REDindividual recipients onlyNoYesMay its clients receive it?TLP:AMBERorganization and clientsYesTLP:AMBER+STRICTorganization onlyNoAlways: sharing beyond the label needs the source's explicit permission
Read this topic in the online study guide
Figure 5.13 Decision tree: Understand Incident Response
Have personnel beentrained on their roles?Training firstbefore any exercise or testIs the doubt whether a systemor component really works?Testquantifiable metricsMust participants performactions, not only discuss?Functional exercisesimulated environmentTabletop exercisediscussion-based onlyNoYesYesNoYesNoEach exercise or test: objectives set in design, after-action report from evaluation
Read this topic in the online study guide
Figure 5.18 Decision tree: Understand Asset Protection
Which asset protection practice does the scenario call for?What exists, or who owns it?records, versions, discoveryAsset inventorycomplete, individual, currentYesNoSupport status or asset age?buying, EOL notice, retiringLifecycle planningacquire, operate and maintain, retireYesNoA system being altered?proposed or emergency changeChange managementanalyze, test, approve, validateYesNoDefining the approved state?new build, hardening, exceptionsConfiguration baselineapproved and hardened stateYesNoConfiguration monitoringcompare live settings, find drift
Read this topic in the online study guide
Figure 5.26 Decision tree: Understand Security Testing
What does the test target?Detection and responseSoftware and systemsEntry controls and staff proceduresShare each techniquewith defenders as you go?What exists to examine?Physical penetration testphishing, tailgating, impersonationYesNoPurple teamingshared learningRed team exercisetests the blue teamA designSource codeRunning applicationDeployed systemsThreat modelingbefore code existsStatic analysiswithout running itDynamic analysisobserves it runningNeed proof a weaknesscan be exploited?NoYesVulnerability scanningsuspected weaknessesPenetration testattempts exploitationFirst, always: the test type is authorized in the rules of engagement
Read this topic in the online study guide

Errata for edition 1

No known errata for this edition.

Found a mistake in the book? Report it and quote the chapter and figure or section number.

Get the book

  • Kindle ebook Kindle edition on Amazon. The store link appears here once the Amazon listing is live.

Keep studying

How this book was made

The book's text was generated using AI and reviewed through Nex Arc Learning's editorial and fact-checking process. Nex Arc Learning assumes editorial responsibility for the published content. Exam objectives change over time; check the official exam page for the current objectives. More on our methods: About Nex Arc Learning.