How to pass the ISC2 CC exam
The ISC2 CC is knowledge exam — it tests how precisely you know the ISC2 CC exam outline, in its own vocabulary. This guide gives you the official blueprint, a realistic study plan, and the exact way to practise so you walk in ready.
⚡ The short version
- The exam: 100-125 multiple-choice questions, 120 minutes.
- The trap: it rewards precision — questions use the standard's exact vocabulary, and near-miss options punish paraphrase-level knowledge.
- The plan: read the ISC2 CC exam outline → drill questions by area → run full timed mocks until you hold 80–85% → review every miss. Budget 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure).
- Where to focus: Security Principles is 24% of the exam — study it hardest.
What the ISC2 CC exam actually is
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online. Items are multiple choice plus what ISC2 calls advanced item types; 25 of them are unscored pretest items that look like any other. Difficulty adapts to your answers, so you cannot skip, review or change an answer. The exam stops once the algorithm is 95% confident of the result (from item 100 on), at 125 items or at the time limit, and anyone who has not answered 100 items within two hours fails automatically. The passing standard is 700 out of 1,000 points; ISC2 reports pass/fail rather than a score, with a per-domain proficiency breakdown after a failed attempt. CC has been adaptive since October 1, 2025, and the current outline took effect on September 1, 2026: Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%) and Security Operations and Incident Response (17.3%). Languages: English, Simplified Chinese (in four annual appointment windows only), Japanese, German and Spanish. ExamDeck simulates the single-answer multiple-choice format in fixed-length, non-adaptive mocks; advanced item types and the adaptive engine are not reproduced.
The official exam blueprint (exam domains)
ISC2 publishes exactly how the exam content is distributed. This is your single most useful planning fact — weight your study to match it:
| Area | Weight | |
|---|---|---|
| Security Principles | 24% | |
| Networking and Cloud Security Concepts | 21.3% | |
| Identity and Access Management (IAM) Concepts | 20% | |
| Security Governance | 17.3% | |
| Security Operations and Incident Response | 17.3% |
Source: ISC2 CC Certification Exam Outline, effective September 1, 2026. Security Principles alone is 24% — most candidates under-weight it.
Eligibility & cost (the quick facts)
Before you book, you have to qualify and apply:
- No prerequisites - no cybersecurity work experience or degree is required; ISC2 recommends basic IT knowledge.
- You must be at least 16 to sit an ISC2 exam; candidates aged 16 or 17 must be accompanied to the test centre by a parent or guardian.
- No endorsement after passing: you agree to the ISC2 Code of Ethics, submit the certification application within nine months of the exam (otherwise you must retake it) and pay the first US$50 Annual Maintenance Fee.
How long should you study?
For most candidates, 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure) is the realistic range; treat "I crammed it in a weekend" stories as outliers built on years of hands-on experience.
What matters more than the hour count is how you spend them. Passive re-reading plateaus fast. The candidates who pass comfortably shift most of their time into answering questions and analysing why each option is right or wrong.
What's the ISC2 CC pass rate? (the honest answer)
ISC2 does not publish official pass rates — so any site quoting an exact "ISC2 CC pass rate" is guessing or repeating someone else's guess. Here's what we can say honestly:
- Community-reported first-attempt figures vary widely and can't be verified — treat them as noise.
- What is knowable: candidates who consistently hold 80–85% on realistic, full-length mocks before booking overwhelmingly report passing; candidates who book on gut feel are the ones writing "failed by a hair" posts.
- The exam is deliberately passable for prepared candidates — ISC2 wants competent certified professionals, not a lottery. Preparation quality, not luck, is the variable you control.
The core strategy: precision beats familiarity
This exam rewards exact knowledge of the ISC2 CC exam outline — its definitions, its terms, and how its pieces fit together. The distractors are engineered to look right to anyone who knows the material "roughly": they swap adjacent terms, invert a rule, or quote a plausible-sounding phrase that isn't in the standard.
So don't study by osmosis. Learn the vocabulary as written, quiz yourself on the exact definitions, and practise telling near-miss options apart. If your workplace uses different words for the same ideas, note the mapping — the exam only accepts the standard's language.
A study plan that works
Adjust the pace to your timeline, but keep the shape: build understanding first, then convert it into exam reflexes through questions.
Read the standard + take a diagnostic
Read the ISC2 CC exam outline once for the map — how the areas connect. Take a free diagnostic to see where you stand and seed your error log.
Study area by area
Work one area at a time, heaviest first (Security Principles → Networking and Cloud Security Concepts). Read that area, then drill questions on it with explanations for every option. Don't move on until you're at ~80%.
Drill the traps: techniques, terms & calculations
Attack whatever the diagnostic marked weakest — exact definitions, look-alike terms, and any calculation-style items.
Run full-length timed mocks
Sit complete 100-question, 120-minute simulations under exam conditions. Review every wrong answer; spaced repetition resurfaces misses on a 1 → 3 → 7 → 16-day schedule. The ExamDeck ISC2 CC bank has 30 questions today, so a mock here runs the whole bank at the real pace, not the full exam length.
Reach readiness & book
When you hold 80–85% across all areas on fresh mocks — not one lucky run — schedule the exam while you're sharp.
The week-by-week plan
The same shape, laid out as a calendar. Studying part-time (15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure))? Follow it as written. More time? Compress two weeks into one — but keep the order and the goals.
| When | Focus | You're done when… |
|---|---|---|
| Week 1 | Security Principles (24%) - CIA and AAA, non-repudiation, privacy, the risk management lifecycle, policies, standards and procedures, control types and the ISC2 Code of Ethics. Take a free diagnostic. | You can classify any control as technical, administrative or physical and place any document in the policy-standard-procedure hierarchy |
| Week 2 | Networking and Cloud Security Concepts (21.3%) - OSI and TCP/IP models, ports and firewalls, wireless, IoT and ICS, segmentation, defense in depth, Zero Trust, cloud characteristics, service and deployment models and the shared security model. | 80%+ on Networking and Cloud questions |
| Week 3 | Identity and Access Management (IAM) Concepts (20%) - the identity lifecycle (provision, review, deprovision), least privilege, separation of duties and access control models. | 80%+ on IAM questions |
| Week 4 | Security Governance (17.3%) and Security Operations and Incident Response (17.3%) - GRC, BC/DR, awareness, KRIs and dashboards; data handling and encryption, logging and triage, threat intelligence, the incident response plan, asset and change management, security testing. | 80%+ on both domains |
| Week 5 | Two full timed mocks answered strictly in order, without going back (the real exam is adaptive and allows no review); clear the error log, then book. | 80-85% held on fresh mocks |
Falling behind? Cut scope from the lightest blueprint areas, never from mocks or error-log review — those two convert knowledge into a pass.
Practice questions: how to actually use them
Do
- Read the explanation for every option — wrong answers teach the most
- Track accuracy per knowledge area, not overall
- Re-attempt misses on a spaced schedule
- Sit full, timed 100-question mocks before booking
Don't
- Use "exam dumps" — stale, often wrong, against ISC2's policies
- Grind questions without analysing why
- Judge readiness on one good run
- Assume job experience covers the whole syllabus
That's exactly how ExamDeck's ISC2 CC bank is built: original, expert-reviewed questions, an explanation linked to the source for every option, per-area readiness scoring, and a spaced-repetition error log — no dumps, no ads.
See the quality — a real ISC2 CC question
Exam-day tactics
- Read every scenario twice. The detail that changes the answer is usually in the last sentence.
- Pace yourself — about 1.2 minutes per question. Don't sprint, don't stall.
- Mark-and-skip the hard ones. Bank the easy marks first; return with the time you saved.
- Never leave a question blank. There's no penalty for guessing — answer everything.
- Pick the best answer per the ISC2 CC exam outline, not the real-world-fastest. They're often different.
- If you're online-proctored, prep your room early: clear desk, ID ready, one monitor, break planned.
Why candidates fail (and how to avoid it)
- Under-studying. "I've done BA work for years" isn't a plan — the exam covers areas your job may not.
- Memorising instead of understanding. Recall fails on "what next?" questions.
- Ignoring the blueprint. Spreading time evenly when Security Principles is 24% leaves the biggest area under-prepared.
- Relying on dumps. Stale, often wrong, and a code-of-conduct risk.
- Poor pacing. Six minutes on one question means rushing the last twenty.
Start preparing for ISC2 CC today
6 free questions in study mode · per-area readiness · no card, no dumps, no ads.
Create your free account →ISC2 CC exam — frequently asked
Is the CC exam still free?
Not for new candidates. ISC2 closed new enrolments in its One Million Certified in Cybersecurity program on May 20, 2026. If you already hold an unexpired free exam code from that program, you can schedule and sit the exam until December 31, 2026. Everyone else pays the standard registration fee (US$199 in most regions), and CC-only holders pay a US$50 Annual Maintenance Fee each year after passing.
What changed in the CC exam on September 1, 2026?
The exam outline. The CAT format, two-hour limit, 100-125 items and the 700/1000 passing standard are unchanged. The Business Continuity, Disaster Recovery and Incident Response domain (10%) was replaced by Security Governance (17.3%): GRC, redundancy (BC/DR), security awareness and effectiveness metrics such as KRIs and dashboards, while incident response moved into Security Operations and Incident Response. Access Controls Concepts became Identity and Access Management Concepts, adding the identity lifecycle (provision, review, deprovision). New topics include AAA, due care and due diligence, cloud characteristics and the shared security model, Zero Trust, threat actors and cyber threat intelligence, quantum-resistant cryptography and red, blue and purple teaming; on-premises facility items such as HVAC and fire suppression are gone. Prep material written for the earlier outline misses these topics.
Can I go back to a question on the adaptive CC exam?
No. Items appear one at a time, each chosen according to your previous answers, and you cannot skip, review or change an answer. The exam can stop at item 100 once the algorithm is 95% confident of your result - pass or fail - or continue to 125 items or the two-hour limit. 25 items are unscored pretest items that look exactly like scored ones. Pace yourself: a candidate who has not answered 100 items within two hours (72 seconds per item on average) fails automatically.
How many questions is the ISC2 CC exam and how long is it?
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online.
What is the passing score for ISC2 CC?
The passing score is 700 out of 1,000 points (a scaled score; ISC2 reports pass/fail and does not release scores). Aim for a consistent 80–85% on realistic practice exams before booking.
What is the ISC2 CC pass rate?
ISC2 does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
What are the ISC2 CC eligibility requirements?
No prerequisites - no cybersecurity work experience or degree is required; ISC2 recommends basic IT knowledge. You must be at least 16 to sit an ISC2 exam; candidates aged 16 or 17 must be accompanied to the test centre by a parent or guardian. No endorsement after passing: you agree to the ISC2 Code of Ethics, submit the certification application within nine months of the exam (otherwise you must retake it) and pay the first US$50 Annual Maintenance Fee.
How much does ISC2 CC cost?
The standard exam registration is US$199 in most regions (EUR 191.04 in ISC2's EMEA price list, GBP 161.19 in the UK; taxes and local currency depend on the test location - verify on isc2.org). One exam purchase covers one attempt and must be scheduled and sat within 365 days; Peace of Mind Protection bundles two attempts, to be used within 180 days, for less than two single exams. Rescheduling costs US$50 and cancelling US$100. After passing, CC-only holders pay a US$50 Annual Maintenance Fee (AMF) every year. The free One Million Certified in Cybersecurity program closed to new enrolments on May 20, 2026; free exam codes already issued can be used until December 31, 2026.
How long should I study for ISC2 CC?
For most candidates, 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
Does the ISC2 CC certification need recertification?
valid for a three-year cycle: earn 45 CPE credits per cycle, all Group A (ISC2 suggests 15 a year), and pay the US$50 Annual Maintenance Fee every year - the certification then renews automatically, with no re-exam.
Are ExamDeck's ISC2 CC questions exam dumps?
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against ISC2's policies.