ISC2 Certified in Cybersecurity (CC) (CC)
exam objectives

52 practice questions in this domain

• 1.1Understand the security concepts of information assurance (confidentiality, integrity, availability, authentication including MFA, non-repudiation, privacy)
• 1.2Understand the risk management process (risk identification/assessment/treatment, qualitative vs. quantitative analysis, risk treatment options: accept/transfer/avoid/mitigate, inherent vs. residual risk)
• 1.3Understand security controls (categories: technical/administrative/physical; types: preventative/detective/corrective/deterrent/compensating)
• 1.4Understand the (ISC)² Code of Ethics (the four canons and their purpose)
• 1.5Understand governance processes (regulations, policies, procedures, standards, guidelines, and how they relate)

24 practice questions in this domain

• 2.1Understand business continuity (BC) (purpose, business impact analysis, BC plan components, testing)
• 2.2Understand disaster recovery (DR) (purpose, DR plan components, backup types: full/incremental/differential, recovery sites: hot/warm/cold, RTO/RPO)
• 2.3Understand incident response (purpose, runbooks/playbooks, SOAR, incident response process: preparation/detection-analysis/containment/eradication/recovery/lessons learned)

42 practice questions in this domain

• 3.1Understand physical access controls (badge systems, fencing/gates, mantraps, biometrics, lighting, CCTV, security guards/alarms, authorized vs. unauthorized personnel)
• 3.2Understand logical access controls (least privilege, need-to-know, separation of duties, MAC, DAC, RBAC, rule-based/attribute-based access control)

48 practice questions in this domain

• 4.1Understand computer networking (OSI and TCP/IP models, network types: LAN/WAN/WLAN, IP addressing, common ports/protocols/services, network topologies)
• 4.2Understand network threats and attacks (DoS/DDoS, spoofing, on-path/MITM, malware types, social engineering, insider threats)
• 4.3Understand network security infrastructure (firewalls, VPNs, network segmentation, IDS/IPS, NAC, defense in depth, zero trust, secure network design)

32 practice questions in this domain

• 5.1Understand data security (encryption at rest/in transit, symmetric vs. asymmetric encryption, data handling and classification, data destruction/retention)
• 5.2Understand system hardening (configuration/change management, patch management, disabling unnecessary services, baselining)
• 5.3Understand best-practice security policies (acceptable use policy, password policy, BYOD policy)
• 5.4Understand security awareness training (phishing, shoulder surfing, social engineering, security champions/gamification)