How many free CC practice questions can I try?

You can answer 10 CC practice questions free without creating an account. Each one is graded instantly with a written explanation. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.

What topics does the CC exam cover?

The CC exam is organised into 5 domains: Security Principles (26%), Network Security (24%), Access Controls Concepts (22%), Security Operations (18%), Incident Response, Business Continuity and Disaster Recovery Concepts (10%). The weighting above shows how much of the exam each domain represents, so budget study time in the same proportion.

How long is the CC exam and how is it scored?

The CC exam has approximately 100 questions in 120 minutes, with a passing score of 700. Practice sets here are scored the same way as the real exam so you can see whether you are above or below the line before test day.

How should I start studying for CC?

Start with Security Principles, the highest-weighted domain, then work down the list. Answer a mixed set after each domain pass — mixing domains forces you to identify what a question is asking before recalling the content, which is what the real exam does.

Are these the same questions that appear on the real CC exam?

No. These are original practice questions written against the published CC exam objectives. They mirror the style, difficulty, and domain weighting of the real exam, but the actual exam content is confidential and is not reproduced here.

CC Practice Questions — CC

Domain	Exam weight	What it covers
Security Principles	26%	Understand fundamental security concepts including CIA Triad, risk management, and security controls
Network Security	24%	Understand network fundamentals, protocols, and security controls
Access Controls Concepts	22%	Understand authentication, authorization, and access control models
Security Operations	18%	Understand security operations including data security, physical security, and monitoring
Incident Response, Business Continuity and Disaster Recovery Concepts	10%	Understand incident response phases and business continuity/disaster recovery planning

Sample question 1 — Security Operations

An employee forwards a suspicious email to the security team. The message asks recipients to sign in through a link that mimics the company portal. Several coworkers already clicked the link. Which action should the team take first?

A. Block the link and reset credentials for everyone who clicked it, then notify affected staff
B. Reply to the original email telling all recipients that the message is a scam and to be careful
C. Wait for the email gateway vendor to release a signature update before taking any other action
D. Delete the forwarded message from the security mailbox so it cannot be clicked again by analysts

Answer: A. Option A is correct because blocking the malicious link stops further clicks while resetting credentials for those who clicked contains any stolen sessions or passwords, and notification supports awareness. Option B is incorrect because replying to the original message reaches only that thread and does not invalidate credentials already entered. Option C is incorrect because waiting for a vendor signature leaves the link live and the exposed accounts unprotected. Option D is incorrect because deleting the forwarded copy removes evidence and does nothing about the active link or compromised credentials.

Sample question 2 — Network Security

During a quarterly access review at an insurance firm, auditors find that a claims adjuster can still open the payment approval module months after transferring from finance. Management wants to prevent this class of finding from recurring. Which control should the security team recommend?

A. Rotate the adjuster's password every thirty days so the old finance entitlement becomes harder to misuse
B. Remove the finance role at transfer and re-certify entitlements through periodic role-based reviews
C. Rely on the adjuster's manager to notice the extra module and submit a removal request after each transfer
D. Add a second approval step inside the payment module so only managers can release large claim payments

Answer: B. Option B is correct because timely removal of the finance role at transfer, combined with recurring role-based recertification, directly addresses stale entitlements and prevents privilege accumulation across job changes. Option C is incorrect because depending on a manager to spot and report excess access is detective, manual, and unreliable, so the same finding can recur. Option D is incorrect because adding an approval step inside the module does not remove the unauthorized entitlement and leaves the adjuster able to view payment data. Option A is incorrect because password rotation changes a credential but does not revoke the finance role, so the adjuster retains the excess access.

Sample question 3 — Network Security

While an analyst watches, an attacker is actively copying data from a compromised workstation to an external host. The incident commander must decide the immediate next step and wants to stop the theft without destroying evidence needed for the later investigation. Which action is most appropriate at this stage?

A. Isolate the workstation from the network while preserving its memory and disk state for later analysis
B. Delete the compromised user account and reset all domain passwords before continuing to monitor the host
C. Wait and continue monitoring until the copying finishes so the full scope of stolen data is documented
D. Shut the workstation down immediately and store the hard drive in a locked cabinet for the investigators

Answer: A. Option A is correct. network isolation halts the active exfiltration while preserving volatile memory and disk contents that investigators need to determine scope and root cause. Option B is incorrect because powering off the workstation destroys volatile memory such as running processes and network connections that are valuable evidence. Option C is incorrect because deleting the account and resetting passwords does not stop the ongoing transfer and may tip off the attacker while evidence is lost. Option D is incorrect because allowing the theft to complete causes avoidable data loss and violates the duty to contain an active incident promptly.

CC Practice Questions

CC Practice Questions

How the CC exam is structured

Worked sample CC questions