CC Practice Test
Updated October 2026What changed for ISC2 CC - Certified in Cybersecurity in 2026
- September 1, 2026: a new CC Certification Exam Outline took effect, with five domains weighted Security Principles 24%, Security Governance 17.3%, IAM Concepts 20%, Networking and Cloud Security Concepts 21.3%, and Security Operations and Incident Response 17.3%. (source)
- The September 2026 outline integrates foundational AI security concepts across all five domains, including model drift as a business-continuity risk and quantum-resistant cryptography. (source)
- May 20, 2026: ISC2 closed new enrollments in the One Million Certified in Cybersecurity program after more than 1 million people enrolled in the free CC course and exam. (source)
- Free CC exam codes issued through One Million Certified in Cybersecurity that have not expired must be used to schedule and sit the exam by December 31, 2026; new candidates pay the U.S. $199 exam fee. (source)
- June 2026: Pearson VUE test centers began extra security screening for ISC2 exams, which may include infrared and metal-detection wand scans for hidden recording devices. (source)
- Chinese-language CC exams are offered only in set windows each year: January 4 – February 2, April, July 11 – August 9, and October 8 – November 6. (source)
Last verified: 2026-10-14 against ISC2, Inc. (the certifying body).
ISC2 CC - Certified in Cybersecurity Key Facts (2026)
- Questions: the ISC2 CC exam has 100–125 items, delivered by Computerized Adaptive Testing (CAT).
- Time: candidates get 2 hours (120 minutes) to complete the CC exam.
- Cost: the CC exam fee is U.S. $199 (one exam attempt, USD); after passing, the Annual Maintenance Fee is U.S. $50.
- Passing score: candidates need 700 out of 1000 scaled points to pass.
- Domains: the outline effective September 1, 2026 covers 5 domains, led by Security Principles at 24%.
- Registration: an exam purchase must be scheduled and taken within 365 days; free One Million CC codes expire for use on December 31, 2026.
- Renewal: CC holders earn 45 CPE credits per 3-year certification cycle and pay the U.S. $50 AMF each year.
- Retakes: ISC2 allows up to 4 attempts in any 12-month period, with 30, 60 and then 90 test-free days between attempts.
Source: ISC2, Inc., verified 2026-10-14 (source)
ISC2 CC - Certified in Cybersecurity at a Glance (2026)
| Item | ISC2 CC (2026) |
|---|---|
| Test dates / testing windows | No fixed national dates for English exams — you book an appointment at a Pearson VUE test center after purchase. Chinese-language exams: January 4 – February 2, April, July 11 – August 9, October 8 – November 6. |
| Registration deadline(s) | Exam must be scheduled and taken within 365 days of purchase; Peace of Mind Protection (2 attempts) must be used within 180 days; unexpired One Million CC free codes by December 31, 2026. |
| Fee breakdown (USD) | Exam: U.S. $199. Annual Maintenance Fee after certification: U.S. $50 per year. Retake / reschedule fees: — |
| Eligibility / prerequisites | No work experience required; after passing, complete the application, agree to the ISC2 Code of Ethics and meet the candidate background qualifications. |
| Number of questions | 100–125 items (multiple choice and advanced item types), Computerized Adaptive Testing |
| Time limit | 2 hours |
| Passing score + scoring method | 700 out of 1000 scaled points; unofficial result at the test center, official result emailed by ISC2 |
| Retake waiting period | 30 test-free days after attempt 1, 60 after attempt 2, 90 after attempt 3 and later |
| Attempts allowed | Up to 4 attempts in a 12-month period |
| CE / renewal requirement | 45 CPE credits per 3-year cycle + U.S. $50 AMF each year |
| Languages | English, Chinese, Japanese, German, Spanish |
| Official registration URL | isc2.org/Register-for-Exam |
Source: ISC2, Inc., verified 2026-10-14.
The ISC2 CC - Certified in Cybersecurity exam gives you 2 hours for 100–125 adaptive items and requires a scaled score of 700 out of 1000 to pass.
Welcome to our free CC practice tests. Whether you're just starting your exam prep or looking for a final review, our 72 practice tests cover everything you need to know to pass the Certified in Cybersecurity exam. Practice with the free ISC2 CC practice test on PracticeTestGeeks (7 questions with answer explanations).
Those numbers come straight from the official ISC2 CC Certification Exam Outline, which took effect on September 1, 2026.
Each practice test includes detailed answer explanations to help you understand not just the correct answer, but why other options are wrong. Our questions are regularly updated to reflect the latest exam objectives and format.
Why Use Our CC Practice Tests?
- Free and unlimited access — no registration required
- Detailed explanations for every question
- Multiple practice tests covering all exam topics
- Instant scoring so you know where to focus your study
How to Register for the ISC2 CC Exam in 2026
The free ride is ending. ISC2 closed new enrollments in its One Million Certified in Cybersecurity program on May 20, 2026, so most new candidates now pay the U.S. $199 exam fee. If you already hold a free code from the program, the deadline is firm:
"All non-expired exam codes must be used to schedule and take an exam by December 31, 2026." — ISC2, One Million Certified in Cybersecurity program FAQ (2026) (source)
According to ISC2's exam registration page, booking works like this:
- Log in to your ISC2 account, or create one (an ISC2 Candidate account is free for the first year).
- From the Certification menu, choose the CC exam, pick a purchase option and click “Buy Now.”
- After checkout, open “Courses and Exams” in your ISC2 account and click Schedule next to the exam.
- Fill in the ISC2 Exam Account Information form with your name exactly as it appears on your ID.
- Finish booking the appointment on the Pearson VUE site.
Once you pass, you complete the application and pay the U.S. $50 Annual Maintenance Fee. To keep the credential you then earn 45 CPE credits over each three-year cycle.
Free ISC2 CC Study Tools
Interactive ISC2 CC resources on PracticeTestGeeks, free to start:
- ISC2 CC flashcards — review key terms and concepts card by card
- ISC2 CC study guide — topic-by-topic overview of what the exam covers
- ISC2 CC cheat sheet — one-page printable summary for last-minute review
CC Practice Test Questions
Prepare for the ISC2 CC - Certified in Cybersecurity exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
CC Access Controls Concepts
CC Exam Questions covering Access Controls Concepts. Master CC Test concepts for certification prep.
CC Business Continuity and Disaster Recovery
Free CC Practice Test featuring Business Continuity and Disaster Recovery. Improve your CC Exam score with mock test prep.
CC Cloud Security Fundamentals
CC Mock Exam on Cloud Security Fundamentals. CC Study Guide questions to pass on your first try.
CC Cryptography Basics
CC Test Prep for Cryptography Basics. Practice CC Quiz questions and boost your score.
CC Identity and Access Management
CC Questions and Answers on Identity and Access Management. Free CC practice for exam readiness.
CC Incident Response
CC Mock Test covering Incident Response. Online CC Test practice with instant feedback.
CC Network Security
Free CC Quiz on Network Security. CC Exam prep questions with detailed explanations.
CC Physical Security
CC Practice Questions for Physical Security. Build confidence for your CC certification exam.
CC Risk Management
CC Test Online for Risk Management. Free practice with instant results and feedback.
CC Security Governance
CC Study Material on Security Governance. Prepare effectively with real exam-style questions.
CC Security Operations
Free CC Test covering Security Operations. Practice and track your CC exam readiness.
Sample ISC2 CC Practice Questions
Try these questions from our free ISC2 CC practice tests. The correct answer and an explanation follow each question.
What is a best practice for Incident Response?
- A. Following established standards and documenting all decisions
- B. Implementing without any documentation
- C. Using ad-hoc approaches each time
- D. Ignoring industry standards entirely
Answer: A. Following established standards and documenting all decisions
Best practices for Incident Response include following established standards and maintaining documentation.
What is a best practice for Identity and Access Management?
- A. Following established standards and documenting all decisions
- B. Implementing without any documentation
- C. Using ad-hoc approaches each time
- D. Ignoring industry standards entirely
Answer: A. Following established standards and documenting all decisions
Best practices for Identity and Access Management include following established standards and maintaining documentation.
What is a best practice for Business Continuity and Disaster Recovery?
- A. Following established standards and documenting all decisions
- B. Implementing without any documentation
- C. Using ad-hoc approaches each time
- D. Ignoring industry standards entirely
Answer: A. Following established standards and documenting all decisions
Best practices for Business Continuity and Disaster Recovery include following established standards and maintaining documentation.
What is a best practice for Access Controls Concepts?
- A. Following established standards and documenting all decisions
- B. Implementing without any documentation
- C. Using ad-hoc approaches each time
- D. Ignoring industry standards entirely
Answer: A. Following established standards and documenting all decisions
Best practices for Access Controls Concepts include following established standards and maintaining documentation.
⏱️ How many questions are on the ISC2 CC exam and how long is it?
The CC exam uses Computerized Adaptive Testing (CAT) and gives each candidate 100 to 125 items in 2 hours. You need a scaled score of 700 out of 1000 to pass.
START CC SECURITY PRINCIPLES PRACTICE TEST💵 How much does the ISC2 CC exam cost?
The standard CC exam fee is US$199. After you pass, you complete the application and pay a US$50 Annual Maintenance Fee (AMF), and you earn CPE credits to keep the certification.
START CC GOVERNANCE PRACTICE TEST📋 What are the 5 domains of the ISC2 CC exam in 2026?
Under the outline effective September 1, 2026, the domains are Security Principles (24%), Security Governance (17.3%), IAM Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%).
START CC GOVERNANCE PRACTICE TEST🔐 What is the CIA triad in cybersecurity?
The CIA triad is Confidentiality, Integrity and Availability. Confidentiality keeps data away from unauthorized people, integrity makes sure data is not altered without authorization, and availability keeps systems and data accessible to authorized users when needed.
START CC SECURITY PRINCIPLES PRACTICE TEST🪪 What does AAA mean: authentication, authorization and accounting?
Authentication proves who a user is, for example with a password plus a one-time code. Authorization decides what that verified user may access. Accounting records what the user did, which supports auditing and non-repudiation.
START CC ACCESS CONTROL PRACTICE TEST🧑💼 What is the difference between least privilege and separation of duties?
Least privilege gives each user only the access needed for their job and nothing more. Separation of duties splits a sensitive task between two or more people, so no single person can complete it alone, such as creating and approving the same payment.
START CC IAM PRACTICE TEST🛡️ What is defense in depth vs Zero Trust?
Defense in depth layers several independent controls, such as firewalls, segmentation, endpoint protection and training, so one failure does not expose everything. Zero Trust assumes no user or device is trusted by default based on network location, and verifies every access request.
START CC NETWORK SECURITY PRACTICE TEST☁️ What is the cloud shared responsibility model?
The cloud provider secures the underlying infrastructure, such as data centers, hardware and the virtualization layer. The customer always remains responsible for its own data and user access, and takes on more duties (operating systems, applications) in IaaS than in SaaS.
START CC CLOUD SECURITY PRACTICE TEST🔑 What is the difference between symmetric encryption, asymmetric encryption and hashing?
Symmetric encryption uses one shared secret key for encryption and decryption, as AES does. Asymmetric encryption uses a public and private key pair, as RSA does. Hashing, such as SHA-256, is one-way and is used to check integrity rather than to recover data.
START CC CRYPTOGRAPHY PRACTICE TEST🔄 What is the difference between business continuity and disaster recovery?
Business continuity keeps critical business functions running during a disruption. Disaster recovery is the part of that plan that restores IT systems and data after an incident, guided by targets such as the recovery time objective (RTO) and recovery point objective (RPO).
START CC BC/DR PRACTICE TESTCC Questions and Answers
Official Resources
- ISC2 Certified in Cybersecurity (CC) — the official ISC2 certification page, covering who the CC is for and how to get started.
- CC Certification Exam Outline — the official domains, weights, exam length, item count and passing score, effective September 1, 2026.
- Register for an ISC2 Exam — the official ISC2 page for scheduling your exam with Pearson VUE.
About the Author
Senior Cloud Architect & Cybersecurity Certification Trainer
Stanford UniversityDavid Chen holds a Master of Science in Computer Science from Stanford University and has earned over 25 professional certifications across AWS, Microsoft Azure, Google Cloud, cybersecurity, and enterprise architecture domains. He works as a solutions architect and now focuses on helping IT professionals pass cloud, security, and technical certification exams.