Missed-Question Notebook and Domain Repair
Key Takeaways
A missed-question notebook should capture WHY the chosen answer was wrong, not just the correct option.
Weak-point repair is most effective when organized by domain, task, concept, and recurring scenario pattern.
Repeated misses usually reveal a reasoning gap such as confusing authentication with authorization or business continuity with disaster recovery.
Domain weights (24, 17.3, 20, 21.3, and 17.3 percent) help prioritize review time, but no domain should be ignored.
Shift practice from passive rereading to active retrieval, out-loud explanation, and mixed scenario drills.
Why a Reason-Based Notebook Wins
The final two weeks are not for rereading everything at equal effort; they are for finding weak patterns and repairing them. A missed-question notebook earns its keep only when it records the reason for the miss. "The answer was the second option" teaches nothing. "I picked multi-factor authentication, but the user was already logged in and the real issue was permission to approve payments" teaches a transferable rule: authentication proves identity, authorization decides what an identity may do.
Notebook Format
Keep it compact enough that you will actually maintain it across 14 days.
| Field | Example entry |
|---|---|
| Date | 2026-04-29 |
| Domain | Domain 3 — Identity and Access Management Concepts (20%) |
| Topic | Authorization and separation of duties |
| Why I missed it | Chose MFA; real problem was one person both approving and paying a vendor |
| Correct rule | MFA verifies identity; separation of duties prevents one person holding conflicting powers |
| Repair action | Do 10 mixed access-control items, write 3 of my own scenarios |
The repair action is the engine. If a miss involved business continuity versus disaster recovery, do not just reread the glossary; write one mini-scenario about keeping operations running (BC) and one about restoring a failed system (DR). If a miss involved DNS, log the clue "IP works, name fails." Active retrieval makes a concept usable under a clock.
Prioritizing With Domain Weights
A weak high-weight domain (Security Principles 24%, Networking and Cloud Security 21.3%, Identity and Access Management 20%) deserves urgent attention. But Security Governance (including BC and DR) and Security Operations and Incident Response each sit at 17.3% — easy points you must not surrender by ignoring them. Weight tells you where to spend more time, never where to spend zero.
Map Misses to Repairs
| Weak pattern | Likely repair |
|---|---|
| Confusing CIA goals (confidentiality vs integrity vs availability) | Label the single main harm in 20 short scenarios |
| Mixing BC, DR, and IR | Sort 15 actions into continuity, recovery, and response columns |
| Missing access-control clues | Drill AAA and non-repudiation (subdomain 1.1) |
| Forgetting ports/protocols | Tie each port to a symptom, not rote memorization alone |
| Poor operations triage | Practice the verbs: first, best, most likely action |
Scenario Pattern Library
Build one page of if-this-then-that clues and rehearse them until they are reflexive:
- Connects by IP but not by name → DNS.
- Former employee can still log in → deprovisioning / least privilege.
- Repeated requests that overwhelm a public site → availability (but verify the evidence in the stem).
- Backups exist but no restore test → recovery confidence is unproven.
- One person can both request and approve payment → separation of duties.
- A file's hash changes unexpectedly → integrity violation.
- A device on the guest network reaches finance servers → segmentation failure.
Three-Part Repair Sessions
Every repair session should run recall, apply, verify. First, close the notes and write everything you remember about the topic. Second, answer scenario items or invent your own. Third, check the source and correct your rule in the notebook. Keep sessions short and specific: "Study networking" is too broad; "Explain DNS, Dynamic Host Configuration Protocol (DHCP), HTTPS, Secure Shell (SSH), Remote Desktop Protocol (RDP), and VPN clues on one page" is actionable.
A Common Trap
Do not let the notebook become a scoreboard of failure that you avoid. It is a map of where points leak. After a few days, sort misses by cause: if most come from rushing, drill slowing down on the final sentence; if from definitions, use flash recall; if from interpretation, practice decision tables. Repairing the cause fixes many future items at once, which is far more efficient than memorizing individual answers.
Turning One Miss Into Five Saved Points
Most CC misses cluster into a small number of root confusions, so each repaired root protects several future items. Consider the most common clusters and the leverage each repair provides. Confusing confidentiality, integrity, and availability is a root that can affect questions in several domains, because many controls are chosen by the goal they protect. Confusing authentication with authorization affects Identity and Access Management items and some triage items, so one repair can pay off in more than one domain.
Sorting business continuity, disaster recovery, and incident response is one skill that supports the lower-weight Security Governance and response items.
Because of this leverage, rank your repair effort by root rather than by count. If your notebook shows ten misses but only three roots, schedule three focused repair sessions, not ten scattered ones. Write the root rule at the top of each session in your own words, then prove it against fresh mixed questions until you can explain why each correct answer is correct without peeking. When you can teach the rule aloud in two sentences, it is repaired.
This explanation step matters: being able to justify a right answer is stronger than recognizing it, because plausible distractors can fool recognition alone.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), the five domains and subdomains used to label each missed question, checked 2026-10-22.
What is the most useful entry in a missed-question notebook?
The reason the chosen answer was wrong plus the rule that fixes it
Only the correct option, copied out so that it can be memorized later
A guess about the public pass rate, written as a reminder for later review
A list of unrelated acronyms that might appear on the exam someday
A learner keeps choosing MFA when the real issue is one person both creating AND approving payments. What concept needs repair?
DNS resolution
Firewall port rules
Separation of duties
Business continuity planning
Which repair action is the most active and scenario-driven?
Reread the same paragraph silently several times without testing recall of the material at all during the session, and then move on
Memorize a pass-rate claim from a forum post and repeat it to your study group each evening session before any practice
Skip the topic entirely because it felt difficult, and return to it only if it appears again later in a practice test
Write three examples distinguishing business continuity from disaster recovery, then answer mixed questions
Sections you finish are checked off in the contents.