Search...

CC Exam Guide

A 5-week study plan aligned to official CC exam domains.

Exam Information

120 minutes

Duration

100 questions (approx.)

Questions

700 (scaled)

Passing Score

Confirm with the vendor

Exam fee

Recommended Study Plan

Week 1

Security Principles & Governance

26% of exam

10-12 hours

Focus: Distinguish preventive vs detective vs corrective vs compensating controls
Confidentiality, Integrity, Availability (CIA Triad)
Risk management concepts
Security controls (physical, technical, administrative)
Governance and compliance
Security policies and procedures
Ethics and professional responsibility

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#security-principles

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 2

Incident Response & Business Continuity

10% of exam

6-8 hours

Focus: Containment comes before eradication — stop spread first
Incident response phases (preparation, detection, containment, eradication, recovery)
Business continuity planning (BCP)
Disaster recovery planning (DRP)
Recovery time objectives (RTO) and recovery point objectives (RPO)
Backup strategies and testing

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#incident-response-bc-dr

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 3

Access Control Models & Identity

22% of exam

6-8 hours

Focus: RBAC is the default answer for enterprise role management
Authentication methods (passwords, MFA, biometrics)
Authorization and access control models (DAC, MAC, RBAC)
Identity management
Least privilege and separation of duties
Account management and provisioning

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#access-controls

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 4

Network Security Fundamentals

24% of exam

6-8 hours

Focus: HTTPS encrypts web traffic; HTTP does not — always prefer TLS for sensitive data
OSI model and TCP/IP
Network protocols (HTTP, HTTPS, FTP, DNS, DHCP)
Firewalls and network segmentation
VPNs and remote access security
Wireless security (WPA, WPA2, WPA3)
Network monitoring and intrusion detection

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#network-security

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 5

Security Operations

18% of exam

6-8 hours

Focus: Hashing verifies integrity; encryption protects confidentiality — different purposes
Data security and encryption
Data classification and handling
Physical security controls
Security awareness and training
Logging and monitoring (SIEM)
Change management and configuration management

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#security-operations

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 6

Final Review & Practice Exams

All domains

8-10 hours

Complete all three full-length practice exams
Review incorrect answers and weak domains
Revisit flashcards for key terms
Timed review of highest-weight domains

Recommended Resources:

Practice exams

Flashcards

Study notes PDF

Exam Tips & Strategies

Domain Insight 1

Distinguish preventive vs detective vs corrective vs compensating controls

Domain Insight 2

Know when to recommend policy/training (administrative) vs technical controls

Follow Domain Weights

Spend more study time on higher-weighted domains — they drive the majority of exam questions.

Practice Under Time Pressure

Use timed practice exams to build pacing before test day.

Key Topics to Master

Confidentiality, Integrity, Availability (CIA Triad)

Risk management concepts

Incident response phases (preparation, detection, containment, eradication, recovery)

Business continuity planning (BCP)

Authentication methods (passwords, MFA, biometrics)

Authorization and access control models (DAC, MAC, RBAC)

OSI model and TCP/IP

Network protocols (HTTP, HTTPS, FTP, DNS, DHCP)

Data security and encryption

Data classification and handling

The exam fee and booking rules change without notice. Confirm them on the vendor exam page before you pay. Domain checklist: CC study guide. Corrections: methodology.

For the most up-to-date exam information, visit the official exam guide.

View Official Exam Guide

CC Exam Guide

A 5-week study plan aligned to official CC exam domains.

Exam Information

120 minutes

Duration

100 questions (approx.)

Questions

700 (scaled)

Passing Score

Confirm with the vendor

Exam fee

Recommended Study Plan

Week 1

Security Principles & Governance

26% of exam

10-12 hours

Focus: Distinguish preventive vs detective vs corrective vs compensating controls
Confidentiality, Integrity, Availability (CIA Triad)
Risk management concepts
Security controls (physical, technical, administrative)
Governance and compliance
Security policies and procedures
Ethics and professional responsibility

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#security-principles

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 2

Incident Response & Business Continuity

10% of exam

6-8 hours

Focus: Containment comes before eradication — stop spread first
Incident response phases (preparation, detection, containment, eradication, recovery)
Business continuity planning (BCP)
Disaster recovery planning (DRP)
Recovery time objectives (RTO) and recovery point objectives (RPO)
Backup strategies and testing

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#incident-response-bc-dr

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 3

Access Control Models & Identity

22% of exam

6-8 hours

Focus: RBAC is the default answer for enterprise role management
Authentication methods (passwords, MFA, biometrics)
Authorization and access control models (DAC, MAC, RBAC)
Identity management
Least privilege and separation of duties
Account management and provisioning

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#access-controls

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 4

Network Security Fundamentals

24% of exam

6-8 hours

Focus: HTTPS encrypts web traffic; HTTP does not — always prefer TLS for sensitive data
OSI model and TCP/IP
Network protocols (HTTP, HTTPS, FTP, DNS, DHCP)
Firewalls and network segmentation
VPNs and remote access security
Wireless security (WPA, WPA2, WPA3)
Network monitoring and intrusion detection

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#network-security

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 5

Security Operations

18% of exam

6-8 hours

Focus: Hashing verifies integrity; encryption protects confidentiality — different purposes
Data security and encryption
Data classification and handling
Physical security controls
Security awareness and training
Logging and monitoring (SIEM)
Change management and configuration management

Recommended Resources:

ISC2 official objectives

/certifications/isc2/cc/notes#security-operations

/certifications/isc2/cc/practice

/certifications/isc2/cc/study-guide

Week 6

Final Review & Practice Exams

All domains

8-10 hours

Complete all three full-length practice exams
Review incorrect answers and weak domains
Revisit flashcards for key terms
Timed review of highest-weight domains

Recommended Resources:

Practice exams

Flashcards

Study notes PDF

Exam Tips & Strategies

Domain Insight 1

Distinguish preventive vs detective vs corrective vs compensating controls

Domain Insight 2

Know when to recommend policy/training (administrative) vs technical controls

Follow Domain Weights

Spend more study time on higher-weighted domains — they drive the majority of exam questions.

Practice Under Time Pressure

Use timed practice exams to build pacing before test day.

Key Topics to Master

Confidentiality, Integrity, Availability (CIA Triad)

Risk management concepts

Incident response phases (preparation, detection, containment, eradication, recovery)

Business continuity planning (BCP)

Authentication methods (passwords, MFA, biometrics)

Authorization and access control models (DAC, MAC, RBAC)

OSI model and TCP/IP

Network protocols (HTTP, HTTPS, FTP, DNS, DHCP)

Data security and encryption

Data classification and handling

The exam fee and booking rules change without notice. Confirm them on the vendor exam page before you pay. Domain checklist: CC study guide. Corrections: methodology.

For the most up-to-date exam information, visit the official exam guide.

View Official Exam Guide