ISC2 · CC
The ISC2 Certified in Cybersecurity (CC) validates foundational knowledge and skills required for entry- or junior-level cybersecurity roles. It covers security principles, access controls, network security, and incident response concepts.
Practice Questions
838
≈ 6 practice exams
Duration
120 minutes
Passing Score
700/1000
Difficulty
FoundationalLast Updated
Mar 2026
Use this CC practice exam to prepare for Certified in Cybersecurity (CC) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 838 questions for ISC2 CC, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Security Principles, Business Continuity, Disaster Recovery & Incident Response, Access Controls Concepts, Network Security, and Security Operations. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The ISC2 Certified in Cybersecurity (CC) is an entry-level certification developed by ISC2 — the world's largest association of certified cybersecurity professionals — to validate foundational knowledge and skills required for junior cybersecurity roles. The credential covers five core domains: Security Principles (including the CIA triad, risk management, and governance), Business Continuity and Disaster Recovery, Access Controls, Network Security, and Security Operations. It is accredited by ANAB to ISO/IEC Standard 17024, signifying its adherence to internationally recognized standards for personnel certification.
The CC was created specifically to address the global cybersecurity workforce shortage, which ISC2 estimated at nearly 4.8 million unfilled positions in 2024. It serves as both a standalone entry-level credential and a structured pathway to advanced ISC2 certifications such as the CISSP. Uniquely among professional certifications, ISC2 has offered free training and exam vouchers to qualifying candidates as part of its One Million Certified in Cybersecurity initiative, significantly lowering the barrier to entry for career changers and new graduates.
The CC is designed for individuals at the beginning of their cybersecurity careers, including career changers transitioning from unrelated fields, recent college graduates or current students in IT or computer science programs, and IT generalists looking to formalize their security knowledge. ISC2 explicitly states that no prior work experience in cybersecurity or IT is required to sit for the exam, making it one of the most accessible professional certifications available.
The credential is particularly well-suited for individuals in roles such as help desk technician, IT support specialist, or junior systems administrator who want to move into dedicated security positions like SOC Analyst, Security Analyst, or IT Security Specialist. Analytical, problem-solving individuals who are new to the field but want a recognized credential to validate their foundational knowledge will benefit most from pursuing the CC.
ISC2 does not impose any formal prerequisites for the CC exam — there is no minimum work experience requirement, no prior certifications required, and no educational prerequisites. This policy sets the CC apart from nearly all other professional security credentials and makes it accessible to complete newcomers to the field.
While not required, ISC2 recommends familiarity with basic IT concepts before studying for the exam. Candidates who have completed coursework in networking fundamentals, operating systems, or general IT principles will find the material easier to absorb. After passing the exam, candidates must pay a $50 Annual Maintenance Fee (AMF) to complete certification and gain ISC2 member status; no endorsement from an existing ISC2 member is required, unlike the CISSP process.
The CC exam consists of 100 to 125 items, which include multiple-choice questions and advanced item types such as drag-and-drop and hotspot questions. The time limit is 2 hours (120 minutes). The exam is delivered via Pearson VUE in a computerized adaptive testing (CAT) format, available at authorized testing centers worldwide or via online proctoring. The exam is offered in English, Chinese, Japanese, German, and Spanish.
Scoring is on a scale of 0 to 1000, and the passing score is 700. The adaptive format means the difficulty of questions adjusts dynamically based on candidate performance, and the total number of questions delivered may vary within the 100–125 range depending on the test engine's assessment of candidate ability. Candidates should be prepared for both straightforward knowledge-recall questions and scenario-based items that require applying concepts to real-world situations.
Earning the CC positions candidates for entry-level and junior cybersecurity roles in a field that the U.S. Bureau of Labor Statistics projects will grow 32% by 2032 — more than ten times the average growth rate across all occupations. Common job titles pursued by CC holders include SOC Analyst, Security Analyst, IT Security Specialist, and Cybersecurity Technician, with entry-level salaries in the United States typically ranging from $60,000 to $85,000 annually. ISC2 reports that its certified members earn 35% higher salaries than non-members, and survey data shows that 10% of CC holders received a salary increase and 7% received a promotion within their first certification cycle.
Beyond immediate job placement, the CC serves as the foundational step in the ISC2 certification pathway, familiarizing candidates with ISC2's exam format and professional standards before advancing toward credentials such as the SSCP or CISSP. Compared to alternatives like CompTIA Security+, the CC's lack of prerequisites and free exam availability make it a lower-risk entry point, while ISC2's brand recognition — as the organization behind CISSP, the most recognized advanced security certification globally — lends the CC meaningful credibility with hiring managers and HR systems that filter for ISC2 credentials.
5 sample questions with answers and explanations. The full bank has 838 questions, enough for 6 full-length practice exams.
Preview — answers shown1. A security team needs to verify that a downloaded software package has not been tampered with during transmission. The vendor provides both the software file and a separate SHA-256 hash value on their website. How should the team verify integrity? (Select one!)
Explanation
Hash verification requires calculating the hash of the received file using the same algorithm and comparing it to the vendor-provided hash value. If the hashes match, the file has not been altered. Hashing is a one-way function that cannot be decrypted or reversed. Any modification to the file, even a single bit change, produces a completely different hash value. This method verifies integrity but not authenticity unless combined with digital signatures. The vendor-provided hash must be obtained through a trusted channel to prevent attackers from providing both modified files and matching modified hashes.
2. A defense contractor implements an access control model where all documents are labeled with classification levels such as Unclassified, Confidential, Secret, and Top Secret. Users are assigned clearance levels by a central security authority and cannot change access permissions on documents they create. Which access control model is in use? (Select one!)
Explanation
Mandatory Access Control uses centrally-assigned security labels and clearances where users cannot override or modify access permissions. MAC is the standard for military and government environments requiring strict information protection. The central authority assigns both classification labels to objects and clearance levels to subjects, and the system enforces access automatically. Discretionary Access Control allows owners to set permissions. Role-Based Access Control uses role assignments. Rule-Based Access Control applies uniform rules across all users.
3. A company's web application was unavailable for 4 hours due to a database failure. The IT team restored the database from the most recent backup, which was taken 8 hours before the failure. How much data was lost? (Select one!)
Explanation
The Recovery Point Objective (RPO) determines maximum acceptable data loss measured backward from the disaster event. Since the most recent backup was taken 8 hours before the failure occurred, all transactions and changes made during those 8 hours were lost when restoring from that backup. The 4-hour downtime period represents the Recovery Time Objective (RTO) - the time required to restore the system - but does not affect data loss. RPO is about data loss measured in time before the incident, while RTO is about restoration time measured after the incident. The backup age determines data loss, not the restoration duration.
4. During a security assessment, an analyst discovers that employees are writing passwords on sticky notes placed on their monitors. The organization implements mandatory security awareness training covering password management and social engineering threats. What type of security control is this training? (Select one!)
Explanation
Security awareness training is an administrative (also called managerial) control because it involves policies, procedures, and education to guide human behavior. Administrative controls include training programs, security policies, and risk assessments. Technical controls are software or hardware-based automated protections like firewalls and encryption. Physical controls are tangible mechanisms such as locks and fences. Compensating controls are alternative measures used when primary controls are not feasible.
5. A logistics company backs up their transportation management system using the following schedule: Full backup every Sunday at midnight, incremental backups Monday through Saturday at midnight. On Thursday morning, the storage array fails and all production data is lost. The backup team has available the Sunday full backup and incremental backups from Monday, Tuesday, and Wednesday. How many backup sets must be restored to recover the system to Wednesday's end-of-day state? (Select one!)
Explanation
Incremental backups copy only changes since the last backup of any type and require restoring the full backup plus all incremental backups in sequence. To restore to Wednesday end-of-day requires: Sunday full backup, Monday incremental, Tuesday incremental, and Wednesday incremental, totaling four backup sets. Each incremental builds on the previous backup. Missing any incremental in the sequence breaks the restoration chain. Differential backups would require only two sets, but this scenario explicitly uses incremental backups.
Information Systems Security Engineering Professional (ISSEP)
ISSEP · 850 questions
Systems Security Certified Practitioner (SSCP)
SSCP · 849 questions
Certified Cloud Security Professional (CCSP)
CCSP · 850 questions
Certified Secure Software Lifecycle Professional (CSSLP)
CSSLP · 841 questions
Certified in Governance, Risk and Compliance (CGRC)
CGRC · 850 questions
Certified Information Systems Security Professional (CISSP)
CISSP · 850 questions
$17.99
One-time access to this exam