ISC2 Certified in Cybersecurity (CC) Practice Exams
About the ISC2 CC exam
Exam at a glance
ISC2's entry-level credential at the foundational tier — no work experience required.
Domain weighting
- Security Principles: 24%
- Security Governance: 17.3%
- Identity and Access Management (IAM) Concepts: 20%
- Networking and Cloud Security Concepts: 21.3%
- Security Operations and Incident Response: 17.3%
Core topics tested
- Security principles — cybersecurity concepts (CIA triad, AAA, non-repudiation, privacy), risk management, governance, cybersecurity controls, professional and ethical conduct.
- Security governance — governance, risk, and compliance (GRC) planning, redundancy, security awareness, measuring cybersecurity effectiveness.
- Identity and access management — identity life cycle management and logical access controls.
- Networking and cloud security — network security, network security architecture, cloud security.
- Security operations and incident response — data security, security operations, incident response, asset protection, security testing.
Prerequisites
None. CC is specifically designed for candidates with no professional cybersecurity experience. Strong candidates include career changers, students, IT support staff moving into security, and recent graduates.
Why take this certification
- Lowest barrier to entry. $50 fee, no work experience, taken in person at Pearson VUE test centers. CC opens the door to the ISC2 ecosystem and credentials your fundamentals.
- Resume signal for early-career roles. CC validates that you understand the cybersecurity vocabulary employers expect for SOC analyst, junior security analyst, IT support, and helpdesk-with-security positions.
- Concrete entry-level salary lift. Entry-level cybersecurity roles average $65,000–$85,000 USD in the United States. A CC-credentialled candidate is signalling commitment to the field — competitive vs uncertified peers.
- Stepping stone toward CISSP. CC covers many CISSP concepts at lower depth. Earning CC first gives you a structured introduction to the ISC2 study style and CBK terminology, smoothing the eventual CISSP path.
What you'll learn for the CC exam
CC focuses on concepts and vocabulary, not deep technical implementation. The exam expects you to know what each term means, what each control does, and when each defense applies — rather than how to configure a specific firewall product or write secure code.
Knowledge areas you'll be tested on
- Security principles: CIA triad, authentication / authorization / accounting (AAA), non-repudiation, privacy, risk management lifecycle and processes, regulations, frameworks and policies, technical / administrative / physical controls, the ISC2 Code of Ethics, due care and due diligence.
- Security governance: governance, risk, and compliance (GRC) purpose, frameworks and tools, redundancy through business continuity (BC) and disaster recovery (DR), security awareness (organizational culture, social engineering, password protection, phishing), and measuring effectiveness with key metrics, key risk indicators (KRIs), dashboards and score cards.
- Identity and access management: identity life cycle (roles definition, provisioning, review, deprovisioning), least privilege, separation of duties, access control models.
- Networking and cloud security: OSI and TCP/IP models, IPv4 / IPv6, VPNs, firewalls, wireless, embedded systems and IoT, network segmentation, defense in depth, Zero Trust, cloud characteristics, service and deployment models, the shared security model.
- Security operations and incident response: data handling and encryption, logging and monitoring, security event triage, threat actors, cyber threat intelligence and threat frameworks, incident response plans and exercises, asset lifecycle, configuration and change management, security testing (readiness, application and physical penetration testing).
What CC does NOT test
- Hands-on configuration of specific tools (firewalls, SIEMs, vulnerability scanners).
- Deep cryptographic mathematics or algorithm internals.
- Hands-on scripting, coding, or secure software development (application testing concepts such as vulnerability scanning and static/dynamic analysis are covered at concept level).
- Hands-on penetration testing execution (physical penetration testing and red/blue/purple teaming are covered at concept level).
- Industry-specific compliance details (PCI DSS specifics, HIPAA technical safeguards, etc.).
How the practice exams help
Each free question and every premium exam mirrors the concept-recognition style ISC2 uses on the live test. Detailed explanations cover the right answer and clarify why distractors miss the mark — vital for the close-call vocabulary questions CC favors. Every attempt randomizes question and answer order so you learn the reasoning, not the position.
How to prepare for the CC exam
CC requires less prep than higher-tier ISC2 exams. A typical candidate can be ready in 4–8 weeks with structured study and consistent practice questions. Recommended approach:
- Take the official ISC2 self-paced training (free, 2–3 weeks). ISC2 offers a free Certified in Cybersecurity training course as part of its One Million Certified in Cybersecurity initiative. The course maps directly to the exam outline and is the most efficient single resource.
- Read the official ISC2 CC study guide (2 weeks). The official guide reinforces vocabulary you need to recognize on multiple-choice questions. Take notes on each domain summary.
- Practice questions (1–2 weeks). Take timed practice tests across all five domains. Track which domain pulls your score down and revisit those study chapters. Aim for consistent 80%+ before scheduling.
- Final review (3–5 days). Skim domain summaries, focus on access-control models (DAC vs MAC vs RBAC), the CIA triad, common ports and protocols, and incident response lifecycle phases. These are heavy-yield refreshers.
Recommended timeline
4–8 weeks of focused study (5–10 hours per week) is typical for candidates with some IT background. Pure career-changers should plan 8–12 weeks.
Official resources
Visit the official ISC2 CC page for the latest exam outline, study resources, and any active free-voucher programs. ISC2's self-paced training (free) is the strongest single resource for new candidates.
Frequently asked questions
Are these actual exam questions?
No. All Nex Arc CC practice questions are original content based on the ISC2 published exam outline and standard cybersecurity-fundamentals reference material. We do not offer brain dumps or leaked questions — distributing real exam content violates the ISC2 Code of Ethics.
How many questions are on the CC exam?
The Certified in Cybersecurity exam uses Computerized Adaptive Testing (CAT): you see between 100 and 125 items — at least 75 scored items plus 25 unscored pretest items — within a 2-hour maximum. Items are multiple choice plus advanced item types, and once you finalize an answer you cannot go back to review or change it.
What's the CC passing score?
700 out of 1000 on the standard ISC2 scaled scoring model. CC uses the same scaling as CISSP and the other ISC2 exams — not every question carries equal weight.
How do I access the full CC practice exam?
Click the Buy Now button in the sidebar. After payment you get instant access to 12 full-length premium practice exams with detailed explanations on every answer.
Do I need work experience for the CC?
No. CC is ISC2's entry-level certification specifically designed for candidates with no prior professional cybersecurity experience. It is well-suited to career-changers, students, and IT professionals adding cybersecurity skills. No work experience or formal degree is required; ISC2 recommends basic IT knowledge. ISC2's expert-level certifications, the usual next step, do require experience in the field.
How long is the CC valid and how do I recertify?
CC certification is valid for three years. To recertify, you must earn 45 Continuing Professional Education (CPE) credits over the three-year cycle (with a minimum of 15 per year), pay the Annual Maintenance Fee (currently $50 USD), and continue to adhere to the ISC2 Code of Ethics. The CPE requirement is roughly one-third the CISSP load, reflecting CC's foundational scope.
What does the CC exam cost?
The standard CC exam fee is $50 USD globally — among the lowest in the cybersecurity industry. ISC2 has periodically offered free exam vouchers through its One Million Certified in Cybersecurity initiative and educational partnerships; check the ISC2 website for current voucher availability before paying.
Which CC domains carry the most weight?
Under the exam outline effective September 1, 2026, the five domains are: Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). Security Principles and Networking and Cloud Security Concepts together account for almost half the exam (45.3%), so the CIA triad, risk and governance terminology, and network and cloud security fundamentals are heavy-yield study areas.
How does CC compare to CompTIA Security+?
Both are entry-level certifications. CC is more concept-focused, has more items (100–125 vs up to 90 for Security+), is cheaper ($50 vs $404 list), and is run by ISC2. Security+ goes deeper into technical security controls and is widely required for DoD 8140 roles. CC is a strong stepping stone toward CISSP for those who want the ISC2 ecosystem; Security+ is a stronger fit for hands-on security analyst roles.
Can I retake the CC exam if I fail?
Yes. ISC2 requires a 30-day waiting period after a first failure, 60 days after a second, and 90 days after subsequent failures. Each attempt costs the standard $50 USD fee. ISC2 caps total attempts at four per 12-month period.