ISC2 CC · ISC2 · Updated October 2026
ISC2 CC practice questions
Original & expert-reviewed · explanation for every option · no dumps
Practise ISC2 CC with original, expert-reviewed questions — each with an explanation for every option, linked to the source, across the full exam blueprint. No dumps, no ads, 6 free to start.
Free: 6 questions in study mode, no card. Full ISC2 CC bank with mock exams and the error log: $15 one-time, or every exam with All-Access for $19/mo or $119/yr.
What makes these different from dumps
📚 An explanation for every option
Not just the right answer — why each wrong option is wrong, linked to the source. Wrong answers teach the most.
⏱️ Timed mocks at the real pace
Sit timed runs at the real ISC2 CC pace (100 questions in 120 minutes on the real exam) on all 30 questions in the bank today, and get a readiness report by area.
↻ Spaced-repetition error log
Every miss comes back on a 1 → 3 → 7 → 16-day schedule, so the fixes actually stick.
🔖 Original & reviewed
Every question is written to test the concepts and reviewed before it ships — never copied or leaked “dumps”.
Try 10 real ISC2 CC questions — free, no sign-up
A representative slice of the bank: all exam domains, mixed difficulty (hard ones included). Answers are one tap away — no email wall.
1/10 · Security Principles
An insurer's payments portal must use multi-factor authentication (MFA). The vendor proposes a hardware token with its own keypad: the token shows a one-time code only after the user types a six-digit PIN on it, and the user then enters that code on the portal's sign-in page. The portal itself never receives the PIN. How does this design measure up against the MFA requirement under NIST SP 800-63B-4?
AMeets it: the code comes from a device separate from the computer
BFalls short: a PIN the portal cannot check is not a factor
CMeets it: one device can supply two distinct factors
DFalls short: a six-digit PIN is too short to count as a factor
Show answer & explanation
C is correct. NIST SP 800-63B-4, Section 2.2.1, permits AAL2 authentication with either a multi-factor authenticator or a combination of two separate factors, and says a multi-factor authenticator requires two factors to execute a single authentication event. Section 3.1.5 describes a multi-factor OTP authenticator as 'something you have' that generates one-time passwords only after an activation factor is input, which can be provided through an integral entry pad. Section 3.2.10 requires the activation secret to stay within the authenticator, with at least four characters and preferably six, while the eight-character minimum in Section 3.1.1.2 covers passwords sent to the verifier. The keypad token therefore provides MFA on its own, even though the portal never sees the PIN.
↗ ISC2 CC Exam Outline
2/10 · Networking and Cloud Security Concepts
During a zero trust rollout based on NIST SP 800-207, the project plan places all internal servers behind policy enforcement points (PEPs), so that none of them can be reached, or even discovered, until a client has been authenticated and authorized. The internal DNS servers are on the list together with the application servers. Which statement about the plan is consistent with SP 800-207?
ADNS servers should sit behind PEPs like the other enterprise resources
BDNS servers belong on the control plane with the policy engine
CDNS servers can be left outside the scope of the zero trust design
DDNS servers are among the components that have to stay accessible
Show answer & explanation
D is correct. NIST SP 800-207, Section 3.4.1 (Network Requirements to Support ZTA), item 4: enterprise resources should not be reachable without accessing a PEP and may not even be discoverable without accessing one, which prevents attackers from identifying targets via scanning. The same item then adds: 'Note that not all resources should be hidden this way; some network infrastructure components (e.g., DNS servers) must be accessible.' Item 1 also lists DNS as part of the basic routing and infrastructure that the local network provides. Putting the DNS servers behind PEPs with the application servers therefore goes beyond the guidance, while tenet 1, under which all data sources and computing services are considered resources, keeps them inside the zero trust design.
↗ ISC2 CC Exam Outline
3/10 · Identity and Access Management (IAM) Concepts
An accounts-payable clerk moves to the procurement team. IT adds the vendor-approval rights her new job needs. Her payment-posting rights and her badge access to the finance records room are left unchanged. What should the transfer process have done about her existing access?
ALeft both in place until the procurement team's annual access review
BRemoved both the posting rights and the records-room badge at the transfer
CRemoved the posting rights at the transfer and kept the badge until it expires
DKept both and logged her payment postings for review over a quarter
Show answer & explanation
B is correct. NIST SP 800-53 Rev. 5, PS-5 Personnel Transfer, item a requires organizations to 'review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred', and item c to 'modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer'. The control's discussion lists returning old and issuing new keys, identification cards and building passes among the actions a transfer may require. Her procurement duties are covered by the vendor-approval rights IT added, so neither the payment-posting rights nor the finance records room has a confirmed ongoing need, and both should have been removed at the transfer, the badge as much as the system rights.
↗ ISC2 CC Exam Outline
4/10 · Security Governance
A tornado destroys a federal agency's primary data center. The agency moves its operations to an alternate site, where power, network links and spare servers are now in place. Next, the team that runs the agency's grants-payment application must rebuild it on those servers, test it and return it to service. According to NIST SP 800-34 Rev. 1, which plan provides the procedures for this work?
AThe disaster recovery plan (DRP)
BThe information system contingency plan (ISCP)
CThe continuity of operations plan (COOP plan)
DThe business continuity plan (BCP)
Show answer & explanation
B is correct. NIST SP 800-34 Rev. 1, Section 2.2.6, describes the DRP as a plan for major, usually physical disruptions that deny access to the primary facility, which may be supported by multiple ISCPs that recover impacted individual systems once the alternate facility has been established. Section 2.2.7 adds that an ISCP can be activated at the system's current location or at an alternate site, and that once the DRP has successfully transferred an information system site to an alternate site, each affected system uses its respective ISCP to restore, recover and test systems and put them into operation. COOP plans cover mission essential functions and BCPs cover mission or business processes, not the recovery of one application.
↗ ISC2 CC Exam Outline
5/10 · Security Operations and Incident Response
A customer-facing web application's quarterly authenticated vulnerability scan reported two low-severity findings, and both have since been fixed. A penetration test of the same application is scheduled for next month, and the team must decide what to do with it. Which decision is consistent with NIST SP 800-115?
ACancel the penetration test for this release cycle
BReplace the test with monthly scans run by the same scanner
CGo ahead with the penetration test as originally planned
DGo ahead, scoped to retesting the two fixed findings
Show answer & explanation
C is correct. NIST SP 800-115, Section 4.3 (Vulnerability Scanning), notes that scanners suffer from the high false negative rates of other signature-based tools, that several low-risk vulnerabilities can present a higher risk when combined, and that a scanner may assign a low risk to each one, leaving the assessor falsely confident. It names penetration testing as a more reliable way of identifying the risk of vulnerabilities in aggregate. Section 5.2 describes penetration testing as mimicking real-world attacks to identify methods for circumventing security features, often by combining vulnerabilities. A scan whose findings have been fixed therefore does not make the planned test redundant.
↗ ISC2 CC Exam Outline
6/10 · Security Principles
A running app plans to share each user's recorded routes with partner gyms so that the gyms can suggest nearby classes. Before launch, the privacy team adds a plain-language notice that explains the sharing and an opt-in consent screen for the feature. In the privacy risk register, how should the team classify this response under the NIST Privacy Framework?
AAccepting the risk
BSharing the risk
CMitigating the risk
DAvoiding the risk
Show answer & explanation
B is correct. Section 1.2.2 of the NIST Privacy Framework v1.0 lists four approaches for responding to privacy risk: mitigating, transferring or sharing, avoiding and accepting. Under transferring or sharing, it notes that contracts are a means of sharing or transferring risk to other organizations, while privacy notices and consent mechanisms are a means of sharing risk with individuals. Mitigation applies technical or policy measures that minimize the risk, avoidance foregoes or terminates the processing, and acceptance judges the problems for individuals minimal or unlikely. A notice plus an opt-in consent screen is therefore recorded as sharing the risk with users.
↗ ISC2 CC Exam Outline
7/10 · Networking and Cloud Security Concepts
At a chemical plant, Windows-based operator workstations (HMIs) control a continuous production process. Corporate IT policy installs critical operating system patches on every Windows endpoint within 24 hours and then forces a reboot, and a new critical patch has just been released. How should the HMIs be handled according to NIST SP 800-82 Rev. 3?
APatch and reboot them within 24 hours like the other endpoints
BExclude them from patching and rely on network isolation for protection
CTest it with the vendor first, then apply it in a planned outage
DInstall the patch now and hold the reboot until the shift change
Show answer & explanation
C is correct. NIST SP 800-82 Rev. 3, Section 2.4 (Comparing OT and IT System Security), lists availability requirements: unexpected outages of systems that control industrial processes are unacceptable, and typical IT strategies such as rebooting a component are usually not acceptable for OT. Under change management in the same section, OT updates must be thoroughly tested by the vendor and the end user before implementation, and OT outages must be planned and scheduled days or weeks in advance.
↗ ISC2 CC Exam Outline
8/10 · Identity and Access Management (IAM) Concepts
An online retailer stores customers' passwords encrypted with AES-256 under a key held in a hardware security module, so that support staff can recover a forgotten password. A developer wants to stop keeping anything that can be turned back into a password and to send customers a reset link instead. The support manager wants to keep the encryption, arguing that an HSM-protected key is the stronger protection. Which storage method does NIST SP 800-53 Rev. 5 call for?
AAES-256 encryption of each password under a key held in the HSM
BA salted key derivation function for each password
CAES-256 encryption with a random salt per password
DA keyed hash of each password using the key held in the HSM
Show answer & explanation
B is correct. NIST SP 800-53 Rev. 5, IA-5(1) Password-based Authentication, item (d): 'Store passwords using an approved salted key derivation function, preferably using a keyed hash'. The discussion adds that cryptographically protected passwords include salted one-way cryptographic hashes of passwords, and item (e) requires immediate selection of a new password upon account recovery, which the discussion says can occur when a password is forgotten. Encryption keeps passwords recoverable however well its key is protected; a salted key derivation function does not, and the reset link covers forgotten passwords. SP 800-63B-4 (Section 3.1.1.2) also recommends a secret key kept in hardware such as an HSM, but for an additional keyed hashing or encryption step after the passwords are salted and hashed, not in place of it.
↗ ISC2 CC Exam Outline
9/10 · Security Principles · hard
A federal agency's new case-management system is ready for an authorization decision, with three high-severity findings that will remain open under a plan of action and milestones. The authorizing official, about to start two weeks of leave, emails her designated representative, the security officer who assembled the authorization package, asking him to sign the authorization to operate in her place. Under NIST SP 800-37, may the designated representative sign it?
AYes, if the authorizing official's delegation to him is in writing
BNo, accepting the risk falls to the system owner instead
CYes, if the CISO countersigns his acceptance of the open findings
DNo, accepting the risk is reserved to the authorizing official herself
Show answer & explanation
D is correct. NIST SP 800-37 Rev. 2, Task R-4 (Authorization Decision), states that the explicit acceptance of risk is the responsibility of the authorizing official and cannot be delegated to other officials within the organization. Appendix D adds that the only activity the authorizing official cannot delegate to the designated representative is the authorization decision and the signing of the associated decision document.
↗ ISC2 CC Exam Outline
10/10 · Security Principles · hard
Two companies exchange purchase orders through an API. Each order carries an HMAC-SHA-256 tag computed with a secret key that both companies hold, and the seller's system rejects any order whose tag fails to verify. Months later the buyer denies having sent a large order, and an independent arbitrator must decide whether the buyer originated it. Which protection, had it been applied to every order, would have given the arbitrator that evidence?
AKeeping each order's HMAC tag in a tamper-evident audit log
BAuthenticating each TLS session with the buyer's client certificate
CSigning each order digitally with the buyer's private key
DEncrypting each order with the seller's public encryption key
Show answer & explanation
C is correct. FIPS 186-5, Section 2.1, defines non-repudiation as assurance of the integrity and origin of data that can be verified by a third party as having originated from the entity in possession of the private key. NIST SP 800-57 Part 1 Rev. 5, Section 3.7, lists source and integrity authentication for a message authentication code when keys are unique to each pair of entities, while a digital signature can also support a non-repudiation decision. NIST SP 800-52 Rev. 2, Sections 2.3 to 2.5, describes TLS client authentication as the client signing part of the handshake, while application data is protected with keys that both client and server know. Only a signature made on each order with a key that the buyer alone controls gives the arbitrator evidence of origin.
↗ ISC2 CC Exam Outline
Covering all exam domains
The bank spans the whole ISC2 CC blueprint, weighted toward what the exam tests most:
Start practising ISC2 CC free
6 free questions in study mode · no card · full ISC2 CC bank: $15 one-time · no dumps, no ads.
Start ISC2 CC free →
ISC2 CC practice — FAQ
Is the CC exam still free?
Not for new candidates. ISC2 closed new enrolments in its One Million Certified in Cybersecurity program on May 20, 2026. If you already hold an unexpired free exam code from that program, you can schedule and sit the exam until December 31, 2026. Everyone else pays the standard registration fee (US$199 in most regions), and CC-only holders pay a US$50 Annual Maintenance Fee each year after passing.
What changed in the CC exam on September 1, 2026?
The exam outline. The CAT format, two-hour limit, 100-125 items and the 700/1000 passing standard are unchanged. The Business Continuity, Disaster Recovery and Incident Response domain (10%) was replaced by Security Governance (17.3%): GRC, redundancy (BC/DR), security awareness and effectiveness metrics such as KRIs and dashboards, while incident response moved into Security Operations and Incident Response. Access Controls Concepts became Identity and Access Management Concepts, adding the identity lifecycle (provision, review, deprovision). New topics include AAA, due care and due diligence, cloud characteristics and the shared security model, Zero Trust, threat actors and cyber threat intelligence, quantum-resistant cryptography and red, blue and purple teaming; on-premises facility items such as HVAC and fire suppression are gone. Prep material written for the earlier outline misses these topics.
Can I go back to a question on the adaptive CC exam?
No. Items appear one at a time, each chosen according to your previous answers, and you cannot skip, review or change an answer. The exam can stop at item 100 once the algorithm is 95% confident of your result - pass or fail - or continue to 125 items or the two-hour limit. 25 items are unscored pretest items that look exactly like scored ones. Pace yourself: a candidate who has not answered 100 items within two hours (72 seconds per item on average) fails automatically.
How many questions is the ISC2 CC exam and how long is it?
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online.
What is the passing score for ISC2 CC?
The passing score is 700 out of 1,000 points (a scaled score; ISC2 reports pass/fail and does not release scores). Aim for a consistent 80–85% on realistic practice exams before booking.
What is the ISC2 CC pass rate?
ISC2 does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
What are the ISC2 CC eligibility requirements?
No prerequisites - no cybersecurity work experience or degree is required; ISC2 recommends basic IT knowledge. You must be at least 16 to sit an ISC2 exam; candidates aged 16 or 17 must be accompanied to the test centre by a parent or guardian. No endorsement after passing: you agree to the ISC2 Code of Ethics, submit the certification application within nine months of the exam (otherwise you must retake it) and pay the first US$50 Annual Maintenance Fee.
How much does ISC2 CC cost?
The standard exam registration is US$199 in most regions (EUR 191.04 in ISC2's EMEA price list, GBP 161.19 in the UK; taxes and local currency depend on the test location - verify on isc2.org). One exam purchase covers one attempt and must be scheduled and sat within 365 days; Peace of Mind Protection bundles two attempts, to be used within 180 days, for less than two single exams. Rescheduling costs US$50 and cancelling US$100. After passing, CC-only holders pay a US$50 Annual Maintenance Fee (AMF) every year. The free One Million Certified in Cybersecurity program closed to new enrolments on May 20, 2026; free exam codes already issued can be used until December 31, 2026.
How long should I study for ISC2 CC?
For most candidates, 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
Does the ISC2 CC certification need recertification?
valid for a three-year cycle: earn 45 CPE credits per cycle, all Group A (ISC2 suggests 15 a year), and pay the US$50 Annual Maintenance Fee every year - the certification then renews automatically, with no re-exam.
Are ExamDeck's ISC2 CC questions exam dumps?
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against ISC2's policies.
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.