ISC2 Certified in Cybersecurity (CC) Practice Exams
About the ISC2 CC exam
Exam at a glance
ISC2's entry-level credential at the foundational tier — no work experience required.
Domain weighting
- Security Principles: 26%
- Business Continuity, Disaster Recovery & Incident Response Concepts: 10%
- Access Controls Concepts: 22%
- Network Security: 24%
- Security Operations: 18%
Core topics tested
- CIA triad and security governance — confidentiality / integrity / availability, ethics, security policies and standards.
- Risk management fundamentals — identification, assessment, treatment, risk-management terminology.
- Access controls — physical and logical, discretionary / mandatory / role-based, authentication factors.
- Network basics — TCP/IP, OSI model, common ports, secure protocols, network threats and defenses.
- Common attacks and defenses — malware, social engineering, phishing, firewalls, IDS/IPS, antivirus.
- Business continuity and incident response — BCP/DRP concepts, incident response lifecycle, backup strategies.
- Security operations — data handling, change management, asset management, basic cryptography concepts.
Prerequisites
None. CC is specifically designed for candidates with no professional cybersecurity experience. Strong candidates include career changers, students, IT support staff moving into security, and recent graduates.
Why take this certification
- Lowest barrier to entry. $50 fee, no work experience, taken from home via online proctoring. CC opens the door to the ISC2 ecosystem and credentials your fundamentals.
- Resume signal for early-career roles. CC validates that you understand the cybersecurity vocabulary employers expect for SOC analyst, junior security analyst, IT support, and helpdesk-with-security positions.
- Concrete entry-level salary lift. Entry-level cybersecurity roles average $65,000–$85,000 USD in the United States. A CC-credentialled candidate is signalling commitment to the field — competitive vs uncertified peers.
- Stepping stone toward CISSP. CC covers many CISSP concepts at lower depth. Earning CC first gives you a structured introduction to the ISC2 study style and CBK terminology, smoothing the eventual CISSP path.
What you'll learn for the CC exam
CC focuses on concepts and vocabulary, not deep technical implementation. The exam expects you to know what each term means, what each control does, and when each defense applies — rather than how to configure a specific firewall product or write secure code.
Knowledge areas you'll be tested on
- Security principles: CIA triad, IAAA (identification, authentication, authorization, accounting), privacy concepts, governance, professional ethics.
- Risk and compliance: risk identification and treatment, common frameworks (NIST CSF concepts at a foundational level), compliance terminology.
- Access controls: physical access controls, logical access controls, DAC / MAC / RBAC / ABAC, multi-factor authentication factors.
- Network security: OSI vs TCP/IP, common ports and protocols, threats (DoS, sniffing, MITM), network defense devices (firewalls, IDS/IPS, proxies), wireless security at a concept level (WPA versions).
- Incident response basics: incident response lifecycle, BCP/DRP concepts, backup strategies, RTO/RPO terminology.
- Security operations: data classification and handling, asset inventory, change management, configuration management, basic logging and monitoring concepts.
- Cryptography concepts: symmetric vs asymmetric at a concept level, hashing, digital signatures, certificates and PKI fundamentals.
What CC does NOT test
- Hands-on configuration of specific tools (firewalls, SIEMs, vulnerability scanners).
- Deep cryptographic mathematics or algorithm internals.
- Scripting, coding, or secure software development practices.
- Advanced penetration testing techniques.
- Industry-specific compliance details (PCI DSS specifics, HIPAA technical safeguards, etc.).
How the practice exams help
Each free question and every premium exam mirrors the concept-recognition style ISC2 uses on the live test. Detailed explanations cover the right answer and clarify why distractors miss the mark — vital for the close-call vocabulary questions CC favors. Every attempt randomizes question and answer order so you learn the reasoning, not the position.
How to prepare for the CC exam
CC requires less prep than higher-tier ISC2 exams. A typical candidate can be ready in 4–8 weeks with structured study and consistent practice questions. Recommended approach:
- Take the official ISC2 self-paced training (free, 2–3 weeks). ISC2 offers a free Certified in Cybersecurity training course as part of its One Million Certified in Cybersecurity initiative. The course maps directly to the exam outline and is the most efficient single resource.
- Read the official ISC2 CC study guide (2 weeks). The official guide reinforces vocabulary you need to recognize on multiple-choice questions. Take notes on each domain summary.
- Practice questions (1–2 weeks). Take timed practice tests across all five domains. Track which domain pulls your score down and revisit those study chapters. Aim for consistent 80%+ before scheduling.
- Final review (3–5 days). Skim domain summaries, focus on access-control models (DAC vs MAC vs RBAC), the CIA triad, common ports and protocols, and incident response lifecycle phases. These are heavy-yield refreshers.
Recommended timeline
4–8 weeks of focused study (5–10 hours per week) is typical for candidates with some IT background. Pure career-changers should plan 8–12 weeks.
Official resources
Visit the official ISC2 CC page for the latest exam outline, study resources, and any active free-voucher programs. ISC2's self-paced training (free) is the strongest single resource for new candidates.
Frequently asked questions
Are these actual exam questions?
No. All Nex Arc CC practice questions are original content based on the ISC2 published exam outline and standard cybersecurity-fundamentals reference material. We do not offer brain dumps or leaked questions — distributing real exam content violates the ISC2 Code of Ethics.
How many questions are on the CC exam?
The Certified in Cybersecurity exam is 100 multiple-choice questions delivered in a linear (non-adaptive) format. You have 2 hours to complete it.
What's the CC passing score?
700 out of 1000 on the standard ISC2 scaled scoring model. CC uses the same scaling as CISSP and the other ISC2 exams — not every question carries equal weight.
How do I access the full CC practice exam?
Click the Buy Now button in the sidebar. After payment you get instant access to 12 full-length premium practice exams with detailed explanations on every answer.
Do I need work experience for the CC?
No. CC is ISC2's entry-level certification specifically designed for candidates with no prior professional cybersecurity experience. It is well-suited to career-changers, students, and IT professionals adding cybersecurity skills. Once you pass, you have one year to gain qualifying experience to upgrade — until then, you hold the CC designation directly.
How long is the CC valid and how do I recertify?
CC certification is valid for three years. To recertify, you must earn 45 Continuing Professional Education (CPE) credits over the three-year cycle (with a minimum of 15 per year), pay the Annual Maintenance Fee (currently $50 USD), and continue to adhere to the ISC2 Code of Ethics. The CPE requirement is roughly one-third the CISSP load, reflecting CC's foundational scope.
What does the CC exam cost?
The standard CC exam fee is $50 USD globally — among the lowest in the cybersecurity industry. ISC2 has periodically offered free exam vouchers through its One Million Certified in Cybersecurity initiative and educational partnerships; check the ISC2 website for current voucher availability before paying.
Which CC domains carry the most weight?
The five domains are: Security Principles (26%), Business Continuity, Disaster Recovery & Incident Response Concepts (10%), Access Controls Concepts (22%), Network Security (24%), Security Operations (18%). Security Principles and Network Security together account for half the exam, so the CIA triad, governance terminology, and network fundamentals are heavy-yield study areas.
How does CC compare to CompTIA Security+?
Both are entry-level certifications. CC is more concept-focused and shorter (100 questions vs Security+ ~90), cheaper ($50 vs $404 list), and run by ISC2. Security+ goes deeper into technical security controls and is widely required for DoD 8140 roles. CC is a strong stepping stone toward CISSP for those who want the ISC2 ecosystem; Security+ is a stronger fit for hands-on security analyst roles.
Can I retake the CC exam if I fail?
Yes. ISC2 requires a 30-day waiting period after a first failure, 60 days after a second, and 90 days after subsequent failures. Each attempt costs the standard $50 USD fee. ISC2 caps total attempts at four per 12-month period.