PracticeVideosBlogFlashcards
All Practice Exams

Free Practice Questions for CC

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
237+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More ISC2 Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

CISSP

Practice Questions200 questionsStudy Guide76 topicsCheat Sheet80 factsFlashcards50 cardsGames20 termsFeedVideos2 videosBlogs2 blogsFree CE

ISC2 SSCP

Practice Questions200 questionsStudy Guide48 topicsFeedBlogs1 blog

CCSP

Practice Questions216 questionsStudy Guide41 topicsFeed

ISC2 Certified in Governance, Risk and Compliance (CGRC)

Practice Questions203 questionsStudy Guide48 topicsFeed

ISC2 Certified Secure Software Lifecycle Professional (CSSLP)

Practice Questions200 questionsFeed

ISC2 Information Systems Security Management Professional (ISSMP)

Practice Questions125 questionsFeed

More From This Family

Videos and articles for deeper review.

VideoISC2 CC After Passing: AMF, CPE, Badge, Next Steps (2026)This examVideoISC2 CC Certified in Cybersecurity Guide (2026)This examVideoISC2 CC Practice Test Strategy: 5-Domain Map (2026)This examVideoISC2 CC vs CompTIA Security+: Which First in 2026?This examArticleISC2 CC After Passing: AMF, CPE, Badge, Next Steps (2026)10 min readArticleISC2 CC Certified in Cybersecurity Guide (2026)24 min readArticleISC2 CC Practice Test Strategy: 5-Domain Map (2026)11 min readArticleISC2 CC vs CompTIA Security+: Which First in 2026?13 min read
Exam Review

Key Facts: CC Exam

100-125

Exam Items

ISC2

700/1000

Scaled Passing Grade

ISC2

2 hours

Exam Duration

ISC2

US$199

Standard Exam Fee

ISC2

CAT

Exam Format

ISC2

None

Experience Required

Entry-level

ISC2 CC is a 2-hour CAT exam with 100-125 multiple-choice and advanced items, a 700/1000 passing grade, and five weighted domains since September 1, 2026: Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). No prior work experience is required. The standard CC exam fee is US$199 in major ISC2 regions. Public enrollment in the One Million Certified in Cybersecurity program closed May 20, 2026; candidates with unexpired codes may schedule and test by December 31, 2026.

Sample CC Practice Questions

Try these sample questions to review concepts for the CC exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 237+ question experience with AI tutoring.

1Which of the following is the correct definition of confidentiality in the CIA triad?
A.Preventing unauthorized access to information
B.Ensuring data is accessible when needed
C.Verifying the accuracy and completeness of data
D.Tracking user actions for accountability
Explanation: Confidentiality ensures that information is accessible only to those authorized to have access. It prevents unauthorized disclosure of sensitive data. Availability ensures data is accessible when needed, integrity ensures accuracy, and accountability involves tracking actions.
2A company implements a system to verify that financial records have not been tampered with. Which security principle is being enforced?
A.Confidentiality
B.Integrity
C.Availability
D.Non-repudiation
Explanation: Integrity ensures that data is accurate, complete, and has not been modified without authorization. This includes protecting against unauthorized modification, deletion, or tampering. Financial record verification is a classic example of integrity protection.
3Which security principle is primarily concerned with ensuring systems and data are accessible to authorized users when needed?
A.Confidentiality
B.Integrity
C.Availability
D.Authentication
Explanation: Availability ensures that systems, data, and resources are accessible and usable by authorized users when needed. This includes protecting against denial-of-service attacks, hardware failures, and ensuring adequate capacity and performance.
4What type of security control is a firewall that blocks unauthorized network traffic?
A.Administrative control
B.Physical control
C.Operational control
D.Technical control
Explanation: Firewalls are technical (or logical) controls because they use technology to enforce security policies. Technical controls include hardware and software mechanisms like firewalls, encryption, and access control systems. Administrative controls are policies and procedures, while physical controls protect physical assets.
5Which of the following is an example of a technical control?
A.An antivirus program that blocks malware
B.A written acceptable-use policy that employees sign
C.A locked door to the server room
D.A required security awareness training session
Explanation: Subdomain 1.4 of the 2026 CC outline names technical, administrative, and physical controls. Technical controls are implemented in systems and software, so an antivirus program that blocks malware is a technical control. The signed policy and the training session are administrative controls, and the locked door is a physical control.
6A security guard monitoring building entrances represents which type of security control?
A.Technical control
B.Physical control
C.Administrative control
D.Logical control
Explanation: Security guards are physical controls because they protect physical assets and facilities. Physical controls include guards, fences, locks, and surveillance cameras. Technical controls are technology-based, and administrative controls are policy-based.
7Which of the following is an example of an administrative security control?
A.Encryption of sensitive data
B.Biometric access control system
C.Security awareness training program
D.Fire suppression system for the server room with sensors that release the agent automatically
Explanation: Administrative controls are policy, procedure, or training-based controls. Security awareness training is an administrative control. Encryption is a technical control, biometric systems are technical controls, and fire suppression is a physical control.
8In risk management, what term describes the process of identifying and evaluating potential threats to an organization?
A.Risk mitigation
B.Risk transfer, which shifts the financial loss from one party to another by contract
C.Risk acceptance
D.Risk assessment
Explanation: Risk assessment is the process of identifying potential threats, vulnerabilities, and the likelihood and impact of risks. Risk mitigation reduces risk, risk transfer shifts risk (like insurance), and risk acceptance acknowledges but does not address the risk.
9A company decides to purchase cyber insurance to offset potential financial losses from a data breach. Which risk treatment strategy is being used?
A.Risk transfer
B.Risk avoidance
C.Risk mitigation
D.Risk acceptance
Explanation: Risk transfer involves shifting the financial impact of risk to a third party, typically through insurance. Risk avoidance eliminates the risk entirely, risk mitigation reduces the risk, and risk acceptance means acknowledging the risk without taking action.
10According to the ISC2 Code of Ethics, which of the following is listed first among the four canons?
A.Maximize profits for their employer and shareholders each quarter
B.Protect society, the common good, and the infrastructure
C.Prioritize client requests above all else
D.Maintain technical certifications through any means
Explanation: The ISC2 Code of Ethics lists four canons in order. The first is to protect society, the common good, necessary public trust and confidence, and the infrastructure.

About the CC Exam

The ISC2 Certified in Cybersecurity (CC) is an entry-level cybersecurity certification for newcomers, career changers, students, and early IT professionals. Since September 1, 2026, the exam follows a new outline that covers Security Principles, Security Governance, Identity and Access Management (IAM) Concepts, Networking and Cloud Security Concepts, and Security Operations and Incident Response, with foundational AI security concepts across all five domains. The exam uses Computerized Adaptive Testing (CAT), allows 2 hours, and includes 100-125 multiple-choice and advanced items.

Exam sponsor: ISC2 / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

100-125 multiple-choice and advanced items

Time Limit

2 hours

Passing Score

700/1000 scaled score

Exam / Certification Fees

US$199 standard registration

Exam sponsor website

Reported exam pass rate: Not published. ISC2 does not publish a public CC pass-rate percentage. Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

24%

Security Principles

Confidentiality, integrity, availability, authentication, authorization, accounting, non-repudiation, privacy, the risk management lifecycle and processes, regulations and laws, frameworks, policies, standards, procedures, technical, administrative, and physical controls, due care, due diligence, and the ISC2 Code of Ethics

17.3%

Security Governance

Purpose, importance, frameworks, and tools for governance, risk, and compliance (GRC); redundancy through business continuity and disaster recovery; security awareness culture and concepts such as social engineering, password protection, and phishing; key metrics, key risk indicators, dashboards, scorecards, and reports

20%

Identity and Access Management (IAM) Concepts

Identity life cycle management (roles definition, provisioning, review, deprovisioning, frameworks and tools) and logical access controls (principle of least privilege, separation of duties, access control models)

21.3%

Networking and Cloud Security Concepts

OSI and TCP/IP models, IPv4, IPv6, VPNs, firewalls, wireless, embedded systems and IoT, network segmentation (firewall zones, VLANs, micro-segmentation), defense in depth, Zero Trust, cloud characteristics, service and deployment models, and the shared security model

17.3%

Security Operations and Incident Response

Data handling and encryption (including quantum-resistant cryptography), logging and monitoring, security event triage, threat actors, cyber threat intelligence, threat frameworks, incident response plans and exercises, asset life cycle and configuration and change management, and security testing (team exercises, application testing, physical penetration testing)

Preparing for the CC Exam

What You Need to Know

  • Passing score: 700/1000 scaled score
  • Assessment: 100-125 multiple-choice and advanced items
  • Time limit: 2 hours
  • Exam / certification fees: US$199 standard registration Official sources

Using Our Practice Resources

  • Work through all 237 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CC: Suggested Study Strategy

1Start with Security Principles because it is the largest domain and anchors the rest of the exam.
2Do not treat 700/1000 as a percentage; ISC2 uses scaled scoring.
3Practice CAT-style discipline: answer carefully, commit, and move forward because adaptive exams do not reward second-guessing.
4Use the domain weights to allocate time, but use missed-question patterns to decide what to study next.
5Memorize the difference between policy, standard, procedure, and guideline; CC asks many governance questions through short scenarios.
6Know access-control models and lifecycle steps: identification, authentication, authorization, accountability, provisioning, review, and deprovisioning.
7For network questions, map symptoms to OSI/TCP-IP layers, then choose the control or device that best fits the scenario.

Frequently Asked Questions

What is the ISC2 CC exam format in 2026?

The current ISC2 CC exam uses Computerized Adaptive Testing (CAT). ISC2 lists a 2-hour time limit, 100-125 multiple-choice and advanced item types, a 700 out of 1000 passing grade, and Pearson VUE test-center delivery. The current exam outline took effect September 1, 2026, replacing the outline that had applied since October 1, 2025.

Do I need experience for the ISC2 CC certification?

No. Certified in Cybersecurity is designed as an entry-level ISC2 certification with no professional experience requirement to sit for the exam. It is a fit for students, career changers, early IT workers, and candidates building a foundation before Security+, SSCP, or CISSP.

Is the ISC2 CC exam still free through 1MCC?

No longer for new candidates. ISC2 stopped accepting new participants in the One Million Certified in Cybersecurity program on May 20, 2026. Participants who already have unexpired exam codes may schedule and take the exam by December 31, 2026. Other candidates buy CC exam and education options like other ISC2 exams and courses.

What are the five domains of ISC2 CC?

Since September 1, 2026, the official CC domains are Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%).

How long should I study for the ISC2 CC exam?

Most new candidates should plan 40-80 focused study hours. Candidates with IT or security experience may need less, while complete beginners should spend extra time on networking and cloud basics, identity and access management, business continuity and incident response terminology, security operations vocabulary, and scenario-based practice.

Does ISC2 publish the CC pass rate?

No. ISC2 does not publish a public CC pass-rate percentage. A better readiness target is evidence-based: explain every official domain objective in your own words, score consistently on mixed practice sets, and review missed questions until you can identify why each wrong option is wrong.

What jobs can ISC2 CC help with?

CC is a foundation credential for entry-level cybersecurity and IT security support roles such as SOC analyst trainee, junior security analyst, help desk with security responsibilities, GRC coordinator, cybersecurity intern, and security operations support. It is strongest when paired with hands-on labs, networking fundamentals, and practice reading alerts, logs, policies, and access-control scenarios.