Phishing and Password Protection
Key Takeaways
Subdomain 2.3 names phishing and password protection as security awareness concepts.
Phishing uses a deceptive message to get a person to reveal information or act.
Password protection means not sharing passwords and not reusing them where they can be exposed.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 2.3, checked 2026-10-22.
Phishing
Subdomain 2.3 names phishing as an awareness concept. Phishing is a deceptive message that tries to get a person to reveal information, click a link, or act. The safe response is to report the message through the approved process and not act on its instructions.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 2.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Password Protection
Subdomain 2.3 also names password protection. Passwords should not be shared, written where others can see them, or reused across systems where one exposure exposes the others. A scenario that asks how to protect a password should be answered with the awareness behavior, not with a tool the outline does not name.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 2.3: Organizational culture (e.g., importance of security, security leadership)
- 2.3: Concepts (e.g., social engineering, password protection, phishing)
Common Traps
A common trap is treating awareness as only a technical control. The outline counts culture, leadership, social engineering, and password protection as awareness concepts, so answer with the people behavior the scenario calls for.
An email asks an employee to log in through a link to confirm a payroll change. What is the best action?
Report the message through the approved process and do not use the link
Log in quickly to confirm the change before the payroll cycle closes today
Forward the link to the whole team so that everyone can check the change
Enter the password on the page, then report it to the team afterward
Sections you finish are checked off in the contents.