CAT Format and Beginner Security Judgment
Key Takeaways
The outline states that the CC exam uses Computerized Adaptive Testing (CAT) for its listed languages.
The item count is 100-125 and the time limit is 2 hours.
Scenario items are answered from the outline topics: CIA, AAA, risk, controls, and ethics.
Choose the action that protects the stated security objective and follows the stated policy, rather than the most technical-sounding option.
Source: ISC2 CC Exam Outline effective September 1, 2026, checked 2026-10-22.
The Format Facts
The outline says CC uses Computerized Adaptive Testing (CAT) for the English, Simplified Chinese, Japanese, German, and Spanish exams. The exam has 100-125 items and runs for 2 hours. Items are multiple choice and advanced item types. The outline does not describe how the adaptive algorithm selects items, so plan around the stated length and time, not around a formula.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), CC CAT Examination Information, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
A Beginner Decision Method
For each scenario, name the security objective first (confidentiality, integrity, or availability, from subdomain 1.1). Then ask who is acting and whether the action can be traced (AAA, subdomain 1.1). Then check the control and policy involved (subdomains 1.3 and 1.4). Finally, check the answer against the ISC2 Code of Ethics (subdomain 1.5). The answer that protects the stated objective within policy is usually the correct one.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- Length: 2 hours
- Items: 100-125; multiple choice and advanced item types
- Passing grade: 700 out of 1000
- Delivery: CAT, in person at Pearson testing centers (ISC2 FAQ)
Common Traps
A common trap is relying on rumored pass rates or unofficial claims. Use the outline and the ISC2 pages for format, length, and policy details, and treat the 700 out of 1000 passing grade as a scaled score.
A CC scenario describes an employee sharing a password with a colleague. Which objective should you name first?
Accountability, because the action can no longer be traced to one person
Network speed, because the password was typed on a slow device over a congested connection
Availability, because the colleague may need the account to keep the service running later on
Physical security, because the password was written on a paper note left at the desk
Match each scenario clue to the outline topic it points to.
Match each item on the left with the correct item on the right
Who is allowed to do what
Ensuring data is not changed without approval
A policy the organization must follow
Sections you finish are checked off in the contents.