ISC2 Certified in Cybersecurity (CC): exam guide, passing score and how to prepare
Every question and every answer is checked twice before you see it.
What the ISC2 CC exam covers, what to check before you book, the ideas people mix up, and a simple way to prepare. Last updated .
Start the ISC2 CC practice tests on Udemy →See what is inside- 30-day money-back guarantee
- Full lifetime access
Before exam day: what to know about ISC2 CC
The real exam is run by the provider. These are the details people look for before they book.
Source: the provider’s official page, checked on 1 November 2026. The provider can change these details at any time.
Your exam-day checklist
- Confirm the details above on the provider’s page the day you book. Formats and rules change.
- Match your name and ID. The name on your registration usually has to match your identification. Check the provider’s ID rules.
- Test your set-up early if you take the exam online: camera, microphone, internet and a clear desk. Providers publish a system test.
- Know the rules for breaks and materials before you sit. Read the candidate agreement.
- Rehearse at exam pace. Take your last practice test with a timer and no notes.
What the ISC2 CC exam covers
The ISC2 Certified in Cybersecurity (CC) exam is about entry-level cybersecurity principles, access control, network security and operations. Always check the provider’s official exam guide for the current objectives, fees and format.
Roles this can lead to
- Junior security analyst
- SOC analyst (tier 1)
- IT support with security duties
- Security awareness or compliance assistant
Easy to mix up on the ISC2 CC exam
Exam questions often use two ideas that sound alike. Learn the difference once and several questions become easy.
| Pair | The key difference | How to choose |
|---|---|---|
| Authentication or Authorization | Authentication proves who you are, while authorization decides what you are allowed to do. | Check a password or token to authenticate; check role permissions afterwards to authorise an action. |
| Business continuity plan or Disaster recovery plan | A business continuity plan keeps essential business functions running during disruption, while a disaster recovery plan restores IT systems and data after an incident. | Use the continuity plan for how the business keeps operating; use the disaster recovery plan for how servers and data are brought back. |
| IDS or IPS | An intrusion detection system observes and alerts on suspicious activity, while an intrusion prevention system sits inline and can block it. | Use an IDS when you want visibility without risking blocked traffic; use an IPS when you want automatic blocking. |
| Encryption or Hashing | Encryption is reversible with the right key, while hashing is a one-way function used to verify integrity. | Encrypt data you need to read again later; hash passwords or files when you only need to compare values. |
Study notes written by us. Always check the provider’s exam guide for the current objectives.
How to prepare in four steps
- Read the official exam guideNote the domains and their weights on the provider’s page.
- Take Test 1 as a baseline100 questions in 120 minutes, no notes.
- Fix the gapsRead every explanation and keep an error log.
- Repeat to 80%Two timed tests in a row, then book the exam.
See how we explain every option
Each option in our tests has a reason: why the right answer is right and what trap each wrong option sets.
Try the ISC2 CC tests on Udemy →- 30-day money-back guarantee
- Full lifetime access
An employee moves from the finance team to marketing but keeps access to the finance system. Which security principle has been neglected?
Illustration from the cybersecurity topic area. An original question written for this exam’s topics, not an actual exam question.
Frequently asked questions
What is the ISC2 CC exam?
The ISC2 Certified in Cybersecurity (CC) exam is about entry-level cybersecurity principles, access control, network security and operations. We rate it entry level level in our guide to help you choose.
What is the passing score for ISC2 CC?
700 out of 1000 points. Source: the provider, checked 1 November 2026. The provider can change this at any time.
How long is the ISC2 CC exam?
2 hours, with 100-125 items. Source: the provider, checked 1 November 2026.
Who should take ISC2 CC?
It suits people in or moving toward roles such as Junior security analyst, SOC analyst (tier 1), IT support with security duties. A certificate supports an application but does not guarantee a job.
How should I prepare for ISC2 CC?
Read the provider's official exam guide, take one timed practice test as a baseline, fix the topics you missed, then repeat until you reach about 80 percent twice in a row. Our ISC2 CC study plan shows the pace.
Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.