ISC2 CC DOMAIN 5 OF 5

ISC2 CC: Security Operations and Incident Response

The provider lists this domain at 17.3% of the exam.

In plain English

The day-to-day work: protecting data, watching for trouble, responding when something happens, and testing that defences hold.

What the provider lists under it

  • Data handling and encryption
  • Logging, monitoring and event triage
  • Threat actors, threat intelligence and frameworks
  • Incident response planning and exercises
  • Asset lifecycle, configuration and change management
  • Security testing

Terms worth knowing

  • Encryption at rest and in transit: Scrambling data so it is unreadable without a key, while it is stored and while it moves.
  • IDS and IPS: An IDS detects suspicious traffic and raises an alert. An IPS sits in the path and can block it.
  • Observability: How well you can understand what is happening inside a system from the data it produces.

Quick answers

How much of the ISC2 CC exam is Security Operations and Incident Response?

The provider lists it at 17.3% of the exam, according to the ISC2 CC exam outline (effective 1 September 2026).

What topics are in Security Operations and Incident Response?

Data handling and encryption; Logging, monitoring and event triage; Threat actors, threat intelligence and frameworks; Incident response planning and exercises; Asset lifecycle, configuration and change management; Security testing.

The other ISC2 CC domains

Test yourself

Full-length ISC2 CC practice tests with an explanation for every answer option.

Browse the ISC2 CC practice testsAll domains

Domain names, weights and topic lists come from the ISC2 CC exam outline (effective 1 September 2026), checked 2 November 2026. Providers change their outlines, so confirm the current version before you book. The plain-English explanations are ours, not the provider’s. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.