Read every question twice.
A 2026 passer said most of their wrong guesses came from reacting to a familiar word instead of reading the whole question.
Certified in Cybersecurity (CC) Exam Guide
Validates foundational knowledge of security principles, governance, access control, network and cloud security, and security operations.
CC tests whether you understand the basic ideas of cybersecurity well enough to apply them to simple workplace situations: what to protect, how access is controlled, how networks are secured and what to do when something goes wrong. Learn the five domains with one course or book, then practise questions until you can explain each answer.
Understand the exam
Syllabus
1Security principles24%
- 1.1Understand cybersecurity concepts
- 1.2Understand risk management concepts
- 1.3Understand governance concepts
- 1.4Understand cybersecurity controls
- 1.5Maintain professional and ethical conduct
Example scenario: A colleague asks you to share your login so they can finish a report while you are away. Which principles does this break, and what should happen instead?
2Security governance17.3%
- 2.1Plan Governance, Risk, and Compliance (GRC)
- 2.2Understand redundancy
- 2.3Understand security awareness
- 2.4Measure cybersecurity effectiveness
3Identity and access management (IAM) concepts20%
- 3.1Understand identity life cycle management
- 3.2Understand logical access controls
Example scenario: An employee moved from finance to marketing but can still open payroll files. What went wrong in the identity lifecycle?
4Networking and cloud security concepts21.3%
- 4.1Understand network security
- 4.2Understand network security architecture
- 4.3Understand cloud security
5Security operations and incident response17.3%
- 5.1Understand data security
- 5.2Understand security operations
- 5.3Understand Incident Response (IR)
- 5.4Understand asset protection
- 5.5Understand security testing
Example scenario: A user reports a pop-up demanding payment to unlock files. What are the first incident response steps?
Official CC exam outline · Effective September 1, 2026
Format
- Questions
- 100–125
- Duration
- 2h
- Passing score
- 700 / 1000
- Delivery
- Test centre
- Languages
- English, Chinese, German, Japanese, Spanish
Question types
Choose the single best answer from the listed options; one is correct and the others are distractors.
CertUp example
An employee emails a customer's records to a personal account to work from home. Which security principle is most directly at risk?
Show answer
Confidentiality. The records have left the organization's control, so unauthorized people could read them.
Drag each item to its correct position or category; the item counts only when every placement is right.
CertUp example
Drag each control to its type: technical, administrative or physical.
Show answer
Security guard is physical, password policy is administrative, and firewall rule is technical. A policy sets expectations, a firewall enforces them in software, and a guard restricts physical access.
Click the area of a diagram, table or screen that answers the question; there are no written options.
CertUp example
A network diagram shows the internet, a firewall, a public web server and an internal file server. Click the device that should sit in a DMZ rather than on the internal network.
Show answer
The public web server. It is reachable from the internet, so keeping it in a separate zone limits what an attacker can reach if it is compromised.
Eligibility and booking
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, complete the application and pay the first $50 annual fee.
Make a study plan
Read the five domains first. If you are new to IT, give networking and access control extra time.
Most candidates spend 15–40 hours. Plan for the low end if you already work in IT or security; plan for the high end if networking and security basics are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.2 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.17 h
- 4Practice with mock examsTake timed practice tests and review every mistake.9 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.2 h
Learn the core concepts
Use one main resource: the study guide, the official course or a free video series. Add a question bank once you have covered the domains.
Best study guideCC Certified in Cybersecurity Study Guide, 2nd edition
Best official courseCC Online Self-Paced Training
Best beginner video courseCertified in Cybersecurity SpecializationLearn the terms precisely. Many questions turn on the exact meaning of a term, such as authentication versus authorization, or a policy versus a procedure.
Practice with mock exams
Practise by domain, then mix domains. Read every question fully before answering, because the exam does not let you return.
See all 4 CC practice tests →Are you ready?
- You can explain the key terms in each domain in your own words.
- You can say why each wrong answer is wrong, not only which answer is right.
- You can finish a timed set without needing to go back.
Prepare for exam day
CC is taken at a Pearson VUE test centre.
- Bring the accepted identification listed in your Pearson VUE confirmation, with a name that matches your booking.
- Arrive early for check-in and security checks.
- Read each question twice before you submit; you cannot return to it.
- Keep an eye on the two-hour clock. The exam can end before 125 questions.
- After passing, complete the application and pay the annual fee to receive the certification.
Advice from exam takers
Free videos plus questions can be enough.
Passers describe using Prabh Nair’s free videos with practice questions, skimming the study guide rather than taking the official course.
Know the frequently tested basics.
One passer listed the ISC2 Code of Ethics canons, cloud models, OSI layers and ports, and risk treatment types as topics to know well.