CAT Pacing and 100-125 Item Strategy

CAT Pacing and Item Strategy

Your final review must mirror the real delivery format. The current ISC2 Certified in Cybersecurity (CC) exam outline took effect September 1, 2026. The exam now uses computer adaptive testing (CAT), allows 120 minutes, delivers 100 to 125 items, and applies a scaled 700 out of 1000 passing grade. The registration fee is US$199. The five domain weights are Security Principles 24%, Security Governance 17.3%, Identity and Access Management 20%, Networking and Cloud Security 21.3%, and Security Operations and Incident Response 17.3%.

Do not rely on forum pass-rate claims, and never convert 700/1000 into a flat percentage.

How CAT Differs From a Linear Exam

CAT picks each next item based on your running ability estimate. A correct answer tends to raise difficulty; a miss tends to lower it. Items can feel hard even when you are doing well. The CAT FAQ says item review is not permitted, and once a candidate finalizes an answer it may not be reviewed or changed.

Pacing Arithmetic

120 minutes across 100 items is about 72 seconds per item; across 125 items it is about 58 seconds. That is arithmetic on the outline figures, not a quota.

The stem verb is decisive. First, best, most likely, and most appropriate each demand a different answer from the same fact set. "First action during active malware spread" is containment, even if eradication is technically superior, because eradication is not first.

A Four-Step Reading Script

Use a fixed internal script so anxiety does not rewrite the question for you.

Worked example. "A user connected to VPN can reach an internal server by IP address but not by hostname." The networking backdrop tempts a firewall upgrade, but the symptom ("IP works, name fails") is name resolution, so the answer is internal Domain Name System (DNS) configuration. Worked example. "An attacker silently alters invoice routing numbers." The harm is to integrity, not availability, so the control protects integrity (hashing, change detection).

Worked example. "A contractor still has system access after the project closed." The issue is account lifecycle management and least privilege, fixed by deprovisioning, not by stronger authentication.

Common Traps

• Choosing the longest or most technical option by reflex.
• Treating availability incidents (Distributed Denial of Service) and integrity incidents (data tampering) as interchangeable.
• Answering the scenario you imagined instead of the final sentence actually asked.

The goal of the final review is steady accuracy under a clock. Practice with mixed question sets, not single-domain drills, because consecutive items can move between domains.

Marking the Decision, Not the Doubt

When two options survive elimination, do not flip back and forth hoping for certainty that will not arrive. Instead, name the discriminator in one short phrase and let it decide.

For an access-control item, the discriminator is often "does the stem describe proving who someone is, or deciding what they may do?" For an incident item, it is "is the threat still active, or already over?" For a network item, it is "is the symptom about reachability, about name resolution, or about a flood of traffic?" Naming the discriminator turns a vague feeling into a testable rule, and a rule produces a faster, more defensible choice than re-reading the same four options a sixth time.

A final note on confidence: feeling sure on every question is the wrong target. The right target is to apply the same disciplined method on every item regardless of how the previous one felt, so that one shaky question never spills its anxiety into the next three. Steady method beats streaky confidence on a CAT exam.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), CC CAT Examination Information (2 hours, 100-125 items), checked 2026-10-22.