Search...
Master key concepts with interactive flashcards
Risk Assessment
Click to reveal answer
The process of identifying, analyzing, and evaluating security risks to an organization's assets. It involves determining threat likelihood, potential impact, and existing vulnerabilities to prioritize security investments and mitigation strategies.
Click to show question
CC is a ISC2 certification. These facts come from the current exam guide and are the numbers to plan around.
| Domain | Weight | What to focus on |
|---|---|---|
| Security Principles | 26% | Confidentiality, Integrity, Availability (CIA Triad), Risk management concepts, Security controls (physical, technical, administrative) |
| Network Security | 24% | OSI model and TCP/IP, Network protocols (HTTP, HTTPS, FTP, DNS, DHCP), Firewalls and network segmentation |
| Access Controls Concepts | 22% | Authentication methods (passwords, MFA, biometrics), Authorization and access control models (DAC, MAC, RBAC), Identity management |
| Security Operations | 18% | Data security and encryption, Data classification and handling, Physical security controls |
| Incident Response, Business Continuity and Disaster Recovery Concepts | 10% | Incident response phases (preparation, detection, containment, eradication, recovery), Business continuity planning (BCP), Disaster recovery planning (DRP) |
Yes. You can start CC practice and flashcards free without creating an account. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.
They cover all 5 domains of the CC exam: Security Principles (26%), Network Security (24%), Access Controls Concepts (22%), Security Operations (18%), Incident Response, Business Continuity and Disaster Recovery Concepts (10%). Each section is weighted in the same proportion as the real exam, so nothing high-value is buried.
The CC exam has approximately 100 questions in 120 minutes, with a passing score of 700. Use the practice questions to confirm you are consistently above that line before booking the real exam.
Study in short, spaced sessions: a card you have not seen for two days is worth more than a card you reread immediately. Filter by Security Principles first, then mix domains so you practise identifying the topic before recalling the definition.
They are the recall half of preparation. Pair the cards with practice questions and at least one timed practice exam — candidates who only review cards usually recognise terms but miss scenario questions.