ISC2 Certified in Cybersecurity CC Study Guide & Practice Questions 

NEW 2026 Exam Outline | 100 Practice Questions & Answers | Entry-Level Cybersecurity Exam Prep

Instant PDF Download — $16.97

Preparing for the ISC2 Certified in Cybersecurity (CC) certification exam?

Start your cybersecurity journey with the Noble Exam Prep ISC2 Certified in Cybersecurity Study Guide, developed around the refreshed exam outline effective September 1, 2026.

This beginner-friendly digital exam prep guide combines complete domain review, 100 original practice questions with explanations, cybersecurity reference sheets, cloud security, IAM, incident response, security governance, networking, AI security concepts, and a structured four-week study plan.

Best of all, no prior work experience is required to sit for the CC exam, making Certified in Cybersecurity an accessible starting credential for people entering information security.

Only $16.97

One-Time Purchase • Instant Digital PDF Download

What's Included?

Your ISC2 Certified in Cybersecurity exam prep guide includes:

• Complete NEW September 2026 domain review

• All five current CC domains

• 100 original practice questions

• Detailed answer explanations

• Security Principles

• Security Governance

• Identity & Access Management

• Networking & Cloud Security

• Security Operations

• Incident Response

• CIA Triad & AAA

• Risk management

• Security control types

• ISC2 Code of Ethics review

• Business continuity & disaster recovery

• RPO vs. RTO

• Security awareness

• KRIs vs. KPIs

• Identity lifecycle management

• MAC, DAC, RBAC & ABAC

• Least privilege & separation of duties

• MFA fundamentals

• OSI & TCP/IP networking

• Common ports

• VPN & wireless security

• Zero Trust

• Defense in Depth

• NEW cloud security content

• IaaS, PaaS & SaaS

• Shared Security Model

• Encryption & hashing

• SIEM & event triage

• Threat actors & threat intelligence

• MITRE ATT&CK concepts

• Incident response

• Security testing

• AI security concepts

• High-yield reference sheets

• Four-week study plan

• CAT exam strategy

• Test-day checklist

The guide moves through all five current domains before presenting its 100-question practice exam, complete answer explanations, reference sheets, memorization material, and test-day checklist.

NEW ISC2 CC Exam Outline — Effective September 1, 2026

Don't Accidentally Study the Old CC Outline

This is probably the strongest selling point of this particular study guide.

ISC2 refreshed its Certified in Cybersecurity exam outline effective September 1, 2026.

According to the guide, the exam still contains five domains, but four of the five domain names changed, material moved between domains, and new cloud-security content was introduced.

Previous Outline vs. Current 2026 Outline

OLD: Security Principles
→ NEW: Security Principles — retained but modernized

OLD: Business Continuity, Disaster Recovery & Incident Response Concepts
→ NEW: Security Governance

OLD: Access Controls Concepts
→ NEW: Identity and Access Management (IAM) Concepts

OLD: Network Security
→ NEW: Networking and Cloud Security Concepts

OLD: Security Operations
→ NEW: Security Operations and Incident Response

The distinction matters because an older CC study guide can still contain useful cybersecurity fundamentals while organizing—and potentially omitting—material differently from the current exam outline.

How to Spot an Outdated ISC2 CC Study Guide

The uploaded guide provides a simple freshness check.

If a CC resource still calls Domain 2:

“Business Continuity, Disaster Recovery and Incident Response Concepts”

or uses the previous domain weighting set referenced by the guide, it was built for the prior outline.

The new structure instead places Incident Response in Domain 5, while Domain 2 is now centered around Security Governance.

That's a compelling reason to use preparation material explicitly built around the post-September 1, 2026 outline.

What Changed on the New ISC2 CC Exam?

The changes go beyond simply renaming sections.

The guide identifies several meaningful revisions.

Security Governance Expanded

Domain 2 now emphasizes:

• Governance

• Risk

• Compliance

• Business continuity

• Disaster recovery

• Awareness

• Security metrics

• KRIs

IAM Expanded

The former Access Controls domain now includes the full identity lifecycle:

Define roles → Provision → Review → Deprovision

Cloud Security Added

The Networking domain now explicitly includes:

• Cloud characteristics

• Service models

• Deployment models

• Shared security responsibility

Incident Response Moved

Incident response now belongs within Security Operations & Incident Response.

Security Testing Expanded

The guide includes concepts involving:

• Red teams

• Blue teams

• Purple teams

• Application testing

• Vulnerability scanning

• Threat modeling

• Physical penetration testing

AI Security Concepts Added Throughout

Rather than creating one standalone AI chapter, the guide explains AI-related security concepts within each relevant domain.

100 ISC2 CC Practice Questions

Don't just read cybersecurity terminology.

Test whether you understand it.

The guide includes 100 original practice questions covering all five current domains.

Its question distribution is:

• 22 Security Principles questions

• 17 Security Governance questions

• 15 IAM Concepts questions

• 23 Networking & Cloud Security questions

• 23 Security Operations & Incident Response questions

The guide is transparent that this distribution is based on domain breadth, with Domain 2 aligned to the confirmed 17.3% weighting discussed in the material; it tells readers to compare study-time allocation against ISC2's official outline.

Detailed Answers & Explanations

This isn't simply a 100-question test followed by an answer key.

The practice material includes explanations designed to reinforce why the answer is correct.

That allows the practice questions to serve as another layer of instruction.

Use them to identify weak areas in:

• Risk

• Governance

• IAM

• Networking

• Cloud

• Security operations

• Cryptography

• Incident response

Then return to those sections for targeted review.

Domain 1 — Security Principles

Build your cybersecurity foundation with concepts such as:

CIA Triad

Confidentiality

Restrict access to authorized parties.

Integrity

Protect information from unauthorized modification.

Availability

Keep systems and information accessible when needed.

AAA

Authentication → Who are you?

Authorization → What can you do?

Accounting → What did you do?

You'll also review:

• Non-repudiation

• Privacy

• Risk

• Controls

• Governance

• Ethics

The guide even connects these principles to modern AI security—for example, linking data integrity with protection against model poisoning and privacy with training-data handling.

Cybersecurity Risk Management

Know the risk-management lifecycle:

Identify → Assess → Treat → Monitor

Then understand the four major treatment approaches.

Avoid

Stop the activity creating the risk.

Transfer

Shift financial consequences, commonly through insurance.

Mitigate

Reduce likelihood or impact through controls.

Accept

Acknowledge and proceed with the risk.

The guide also distinguishes risk appetite from residual risk—the risk that remains after controls have been applied.

Technical vs. Administrative vs. Physical Controls

This is a highly learnable exam topic.

Technical Controls

Examples:

• Firewalls

• Encryption

• MFA

• Antivirus

Administrative Controls

Examples:

• Policies

• Procedures

• Security awareness

• Background checks

Physical Controls

Examples:

• Locks

• Fences

• Badge readers

• Guards

• Cameras

Understanding how controls are classified can help turn straightforward scenarios into easier points.

Policy vs. Standard vs. Procedure vs. Guideline

Know these distinctions.

Policy

Mandatory and high-level.

What does the organization require?

Standard

Mandatory and specific.

Procedure

Mandatory step-by-step instructions.

How do I perform this task?

Guideline

Recommended rather than mandatory.

You'll also review due care versus due diligence, another distinction that can appear straightforward once clearly understood.

ISC2 Code of Ethics Review

Because this is an ISC2 certification, professional ethics matter.

The guide reviews the four ISC2 ethics canons in priority order and emphasizes that protecting society and the public interest takes precedence over obligations to an employer or client in an exam scenario.

Domain 2 — Security Governance

One of the Biggest Changes to the New Outline

Domain 2 was previously centered around Business Continuity, Disaster Recovery, and Incident Response concepts.

The new Domain 2 is Security Governance.

Incident response has moved into Domain 5.

Review:

• Governance

• Risk management

• Compliance

• GRC planning

• Business continuity

• Disaster recovery

• Redundancy

• RPO

• RTO

• Security awareness

• Social engineering

• Security metrics

• KRIs

• KPIs

The guide identifies Domain 2 as 17.3% based on the confirmed weighting available to the author when the guide was prepared.

Business Continuity vs. Disaster Recovery

Know the distinction:

Business Continuity

Keep critical business functions operating during disruption.

This includes more than IT:

• People

• Facilities

• Processes

Disaster Recovery

Restore technology after failure.

Then understand:

RPO

How much data loss can the organization tolerate?

RTO

How much downtime can the organization tolerate?

The guide makes an excellent practical point:

An untested backup isn't yet proof of recovery capability.

Testing is required to determine whether restoration actually works within the required timeframe.

Security Awareness & Social Engineering

Review attacks involving:

• Phishing

• Vishing

• Smishing

• Pretexting

• Tailgating

• Impersonation

The guide also incorporates an updated AI angle: generative tools can produce much more convincing phishing content without the obvious spelling and grammar problems users may have been trained to recognize.

As a result, the guide emphasizes out-of-band verification for sensitive requests such as credential or payment changes.

KPIs vs. KRIs

Another useful distinction:

KPI — Key Performance Indicator

How well is something performing?

KRI — Key Risk Indicator

Is risk exposure increasing?

These metrics can feed dashboards, scorecards, and reports used to communicate security conditions to leadership.

Domain 3 — Identity & Access Management

The previous Access Controls Concepts domain has expanded into full Identity and Access Management Concepts.

The guide's identity lifecycle is:

Define Roles → Provision → Review → Deprovision

That means CC candidates should understand identity throughout its lifecycle, not merely how an ACL grants access.

Incomplete deprovisioning can leave behind orphaned accounts, creating unnecessary security exposure.

MAC vs. DAC vs. RBAC vs. ABAC

Know the Access Control Models

MAC — Mandatory Access Control

System-enforced labels and clearances.

Users cannot override the system.

Often associated with government or military environments.

DAC — Discretionary Access Control

The data owner decides who receives access.

Flexible, but harder to govern at scale.

RBAC — Role-Based Access Control

Permissions are assigned to job roles, and users receive appropriate roles.

ABAC — Attribute-Based Access Control

Decisions use attributes such as:

• Department

• Device

• Location

• Time

The guide connects ABAC with Zero Trust concepts.

Least Privilege, Separation of Duties & MFA

Least Privilege

Give someone only the access required—and only as long as required.

Separation of Duties

Prevent one individual from completing an entire sensitive process alone.

MFA

Requires factors from different authentication categories:

• Something you know

• Something you have

• Something you are

A password plus another knowledge question isn't genuine MFA.

The guide also discusses behavioral analysis identifying suspicious activity such as impossible travel.

Domain 4 — Networking & Cloud Security Concepts

Cloud Security Is NEW

This domain was previously called simply Network Security.

The September 2026 outline expanded it into:

Networking and Cloud Security Concepts

That means candidates now need foundational understanding of both traditional networking and cloud computing.

The guide explicitly warns that older CC study material may omit these new cloud concepts.

Cybersecurity Networking Fundamentals

Review concepts such as:

• OSI Model

• TCP/IP Model

• TCP vs. UDP

• IPv4

• IPv6

• VPN

• Firewalls

• Wireless security

• WPA3

• Bluetooth risks

• ICS

• IoT

The guide also highlights commonly used ports including:

22 — SSH

25 — SMTP

53 — DNS

80 — HTTP

443 — HTTPS

3389 — RDP

Zero Trust, Segmentation & Defense in Depth

Segmentation

Limits lateral movement after an attacker gains a foothold.

This can involve:

• Firewall zones

• VLANs

• Micro-segmentation

Defense in Depth

Use multiple independent controls so that the failure of one layer doesn't expose the entire asset.

Zero Trust

Remember:

Verify Explicitly

Use Least Privilege

Assume Breach

The guide also applies these concepts to AI environments by recommending separation between experimental AI-development systems and sensitive production data.

NEW Cloud Security Exam Content

Know the Five Cloud Characteristics

Review:

• On-demand self-service

• Broad network access

• Resource pooling

• Rapid elasticity

• Measured service

You'll also need to understand the major cloud service models.

IaaS vs. PaaS vs. SaaS

IaaS

The provider manages:

• Physical infrastructure

• Networking

• Virtualization

The customer remains responsible for areas such as:

• Guest OS

• OS patching

• Applications

• Data

PaaS

The provider manages through the platform/runtime level.

The customer focuses on:

• Applications

• Data

SaaS

The provider manages the infrastructure and application.

The customer continues to manage:

• Data

• Users

• Configuration

You'll also review:

• Public cloud

• Private cloud

• Hybrid cloud

• Community cloud

And an important distinction:

Hybrid cloud ≠ multicloud.

Hybrid combines private/on-premises infrastructure with public cloud.

Multicloud uses multiple public cloud providers.

Shared Security Model

A simple memory framework:

Always the Customer

Your data and who has access to it.

Always the Provider

• Physical facilities

• Hardware

• Underlying infrastructure

Everything between those ends shifts depending on the cloud service model.

The guide warns that many cloud exposures emerge from the gap where each party assumes the other side is responsible for a control.

Domain 5 — Security Operations & Incident Response

The updated Domain 5 combines security operations with Incident Response, while adding asset protection and security-testing concepts.

Review:

• Data classification

• Data labeling

• Data masking

• Data sanitization

• Symmetric encryption

• Asymmetric encryption

• Hashing

• Quantum-resistant cryptography

• SIEM

• Event triage

• Threat actors

• Cyber Threat Intelligence

• MITRE ATT&CK

• Incident response

• Security testing

• Asset lifecycle

• Change management

Encryption vs. Hashing

Know the distinctions.

Symmetric Encryption

One shared key.

Fast and appropriate for bulk data.

Asymmetric Encryption

Public/private key pair.

Helps solve key-distribution challenges but is slower.

Hashing

One-way.

Useful for:

• Integrity verification

• Password storage

Hashing isn't encryption.

The guide also introduces quantum-resistant algorithms in the context of future cryptographic risk.

Security Operations

Understand concepts involving:

SIEM

Aggregates and correlates logs from multiple sources.

Triage

Prioritizes security events so analysts can concentrate on what matters most.

Threat Actors

Know the general characteristics and motivations associated with:

• Nation-states

• Organized crime

• Hacktivists

• Insiders

• Unskilled attackers

Cyber Threat Intelligence

Analyzed and actionable threat information whose usefulness depends on:

• Timeliness

• Relevance

• Accuracy

MITRE ATT&CK

Provides a common vocabulary for adversary:

Tactics → Goals

Techniques → Methods

Incident Response Exam Prep

A strong incident-response program doesn't wait for a breach to decide who does what.

The guide explains that an incident response plan defines:

• Roles

• Procedures

• Escalation criteria

while playbooks provide repeatable steps for responders.

It also discusses tabletop exercises as discussion-based walkthroughs that reveal gaps in decision-making and communication.

One important principle:

Contain Before You Eradicate

And:

Preserve Evidence Before Remediation

Immediately reimaging a compromised device can destroy evidence needed to determine how the attacker entered.

Red Team vs. Blue Team vs. Purple Team

Know this easy-to-remember distinction.

Red Team

Attacks

Simulates adversarial behavior.

Blue Team

Defends

Detects and responds.

Purple Team

Combines Red + Blue

Attack activity is used directly to improve detection and defensive capability.

The guide also reviews:

• Static application testing

• Dynamic testing

• Vulnerability scanning

• Threat modeling

• Physical penetration testing

AI Security Concepts Throughout the New Exam

One thing that distinguishes this new outline is that AI isn't treated as one isolated topic.

The guide integrates AI-related security concepts across the domains.

Examples include:

Model Poisoning
Manipulated training data can compromise integrity.

Training-Data Privacy
Organizations must protect sensitive information used with AI.

Model Drift
Degrading AI performance can become a business-continuity concern.

AI-Generated Phishing
Generative tools can create convincing social-engineering content at scale.

Behavioral Authentication
AI-assisted analysis can detect anomalies such as impossible travel.

AI Network Security
Machine learning can identify unusual behavior beyond known signatures.

Public AI Data Leakage
Employees pasting confidential company information into public AI systems can create data exposure.

These concepts appear throughout the study material because the refreshed outline integrates AI into the broader cybersecurity environment.

Computerized Adaptive Testing — CAT

Study for the Exam Format, Not Just the Content

The guide identifies the Certified in Cybersecurity examination as Computerized Adaptive Testing.

That means the exam adapts based on your answers.

The guide highlights three practical consequences:

You Can't Skip and Return

Commit to an answer and move forward.

Early Questions Matter

Settle in before beginning rather than assuming you'll “warm up” during your first few questions.

Difficult Questions Aren't Necessarily Bad

An adaptive exam can become more difficult as it calibrates toward your ability.

The guide therefore recommends practicing without returning to earlier questions.

Four-Week ISC2 CC Study Plan

The guide includes a focused preparation schedule.

Week 1 — Security Principles

Review:

• CIA

• AAA

• Risk

• Controls

• Governance

• Ethics

Week 2 — Security Governance + IAM

Study:

• GRC

• Business continuity

• Disaster recovery

• RPO/RTO

• Awareness

• Metrics

• Identity lifecycle

• Access-control models

Week 3 — Networking & Cloud Security

Review:

• OSI

• TCP/IP

• Firewalls

• Wireless

• Segmentation

• Zero Trust

• Cloud characteristics

• Cloud models

• Shared responsibility

Week 4 — Security Operations & Incident Response

Study:

• Data protection

• Cryptography

• SIEM

• Triage

• Threat actors

• Threat intelligence

• Incident response

• Asset protection

• Security testing

Then complete the full 100-question practice exam.

Who Is This ISC2 CC Study Guide For?

This guide can be particularly useful for:

• Cybersecurity beginners

• IT career changers

• College students

• Help desk professionals

• IT support specialists

• Network technicians

• Aspiring SOC analysts

• Aspiring cybersecurity analysts

• Veterans transitioning into IT

• Professionals exploring cybersecurity careers

• Cloud professionals learning security

• People considering Security+ later

• Candidates pursuing their first cybersecurity certification

• Anyone preparing for the current ISC2 CC exam

The guide specifically identifies no work-experience prerequisite for the Certified in Cybersecurity exam.

A Strong First Cybersecurity Certification

If you're interested in cybersecurity but aren't ready to begin with a more advanced credential, Certified in Cybersecurity provides an approachable foundation.

A possible learning progression is:

ISC2 CC → CompTIA Security+ → CySA+ / Advanced Security Certifications

CC provides exposure to:

Security Principles

↓

Governance

↓

Identity & Access

↓

Networking & Cloud

↓

Security Operations

↓

Incident Response

That gives candidates a broad cybersecurity vocabulary and conceptual foundation before moving into more technical certifications.

Get the ISC2 Certified in Cybersecurity Study Guide

NEW September 2026 Exam Outline

Only $16.97

Your instant digital download includes:

✓ New September 1, 2026 exam outline
✓ All five current domains
✓ 100 original practice questions
✓ Detailed answer explanations
✓ Security Principles
✓ Security Governance
✓ IAM Concepts
✓ Networking & Cloud Security
✓ Security Operations & Incident Response
✓ CIA & AAA
✓ Risk management
✓ ISC2 ethics
✓ Business continuity & disaster recovery
✓ RPO / RTO
✓ Access-control models
✓ Zero Trust
✓ NEW cloud-security material
✓ IaaS / PaaS / SaaS
✓ Shared Security Model
✓ SIEM & threat intelligence
✓ MITRE ATT&CK concepts
✓ Incident response
✓ Security testing
✓ AI-security concepts
✓ CAT exam strategy
✓ High-yield reference sheets
✓ Four-week study plan
✓ Test-day checklist

$16.97 — One-Time Purchase

Instant PDF Download

Start Cybersecurity With the CURRENT Exam Outline

If you're going to spend time preparing for a certification, make sure you're preparing for the version that's actually being tested.

This study guide isn't simply labeled “2026.”

It is specifically organized around the ISC2 Certified in Cybersecurity outline effective September 1, 2026, including:

Security Governance

Identity & Access Management

Networking & Cloud Security

Incident Response

AI Security Concepts

and the updated five-domain organization.

Learn the concepts. Practice the questions. Review your mistakes. Prepare for the current CC exam.

Digital Product Information

Product: ISC2 Certified in Cybersecurity Study Guide
Certification: Certified in Cybersecurity — CC
Exam Outline: Effective September 1, 2026
Format: Digital PDF
Length: 44 pages
Practice Questions: 100
Answer Explanations: Included
Reference Sheets: Included
Price: $16.97
Delivery: Instant Digital Download
Publisher: Noble Exam Prep

This is a digital product. No physical book will be shipped.

Frequently Asked Questions

Is this guide built for the new September 2026 ISC2 CC exam?

Yes. The guide states that it is written around the refreshed Certified in Cybersecurity outline effective September 1, 2026.

What changed on the new CC outline?

Four of the five domain names changed, material moved between domains, cloud security was added, Incident Response moved into Domain 5, IAM expanded to include identity lifecycle management, and the guide says AI-security concepts are integrated across all five domains.

Does it include practice questions?

Yes. You'll receive 100 original practice questions, followed by answer explanations.

Does it cover cloud security?

Yes. Cloud security is specifically identified as new material in the updated Networking & Cloud Security domain. Topics include cloud characteristics, IaaS, PaaS, SaaS, deployment models, and shared security responsibility.

Does it include AI security?

Yes. The guide integrates AI concepts throughout multiple domains rather than treating AI as one standalone topic.

Do I need cybersecurity work experience?

No. The guide identifies the CC as having no work-experience prerequisite.

Does the exam use adaptive testing?

The guide identifies the exam format as Computerized Adaptive Testing (CAT) and includes strategy for preparing for that format.

Is this a physical book?

No. This is an instant-download digital PDF.

How much is it?

The complete study guide is $16.97 as a one-time purchase.

Is this an official ISC2 product?

No. It is independently developed by Noble Exam Prep and is not affiliated with, authorized by, endorsed by, or sponsored by ISC2.

Important Disclaimer

This study guide is independently developed by Noble Exam Prep for supplemental educational and  cyber securty + IT exam-preparation purposes.

ExamPrepStudyGuides.com and Noble Exam Prep are not affiliated with, authorized by, endorsed by, or sponsored by ISC2, Inc. ISC2, CC, and CISSP are registered marks of ISC2, Inc.

This product does not contain or claim to contain confidential, recalled, leaked, or proprietary ISC2 examination questions. Practice questions are independently created educational materials.

Purchasing or using this study guide does not guarantee a passing score, certification, employment, promotion, salary, or other professional outcome.

ISC2 can update examination outlines, policies, fees, certification requirements, continuing-education requirements, and testing procedures. Candidates should verify current requirements and the official exam outline directly with ISC2 before scheduling their examination.