ISC2 CC Practice Test

ISC2 CC Practice Test

 ▶

CC Practice Test

Updated for October 2026
Home›CC
What changed for ISC2 CC - Certified in Cybersecurity in 2026
  • September 1, 2026: a new CC Certification Exam Outline took effect, with five domains weighted Security Principles 24%, Security Governance 17.3%, IAM Concepts 20%, Networking and Cloud Security Concepts 21.3%, and Security Operations and Incident Response 17.3%. (source)
  • The September 2026 outline integrates foundational AI security concepts across all five domains, including model drift as a business-continuity risk and quantum-resistant cryptography. (source)
  • May 20, 2026: ISC2 closed new enrollments in the One Million Certified in Cybersecurity program after more than 1 million people enrolled in the free CC course and exam. (source)
  • Free CC exam codes issued through One Million Certified in Cybersecurity that have not expired must be used to schedule and sit the exam by December 31, 2026; new candidates pay the U.S. $199 exam fee. (source)
  • June 2026: Pearson VUE test centers began extra security screening for ISC2 exams, which may include infrared and metal-detection wand scans for hidden recording devices. (source)
  • Chinese-language CC exams are offered only in set windows each year: January 4 – February 2, April, July 11 – August 9, and October 8 – November 6. (source)

Last verified: 2026-10-14 against ISC2, Inc. (the certifying body).

ISC2 CC - Certified in Cybersecurity Key Facts (2026)
  • Questions: the ISC2 CC exam has 100–125 items, delivered by Computerized Adaptive Testing (CAT).
  • Time: candidates get 2 hours (120 minutes) to complete the CC exam.
  • Cost: the CC exam fee is U.S. $199 (one exam attempt, USD); after passing, the Annual Maintenance Fee is U.S. $50.
  • Passing score: candidates need 700 out of 1000 scaled points to pass.
  • Domains: the outline effective September 1, 2026 covers 5 domains, led by Security Principles at 24%.
  • Registration: an exam purchase must be scheduled and taken within 365 days; free One Million CC codes expire for use on December 31, 2026.
  • Renewal: CC holders earn 45 CPE credits per 3-year certification cycle and pay the U.S. $50 AMF each year.
  • Retakes: ISC2 allows up to 4 attempts in any 12-month period, with 30, 60 and then 90 test-free days between attempts.

Source: ISC2, Inc., verified 2026-10-14 (source)

ISC2 CC - Certified in Cybersecurity at a Glance (2026)
ItemISC2 CC (2026)
Test dates / testing windowsNo fixed national dates for English exams — you book an appointment at a Pearson VUE test center after purchase. Chinese-language exams: January 4 – February 2, April, July 11 – August 9, October 8 – November 6.
Registration deadline(s)Exam must be scheduled and taken within 365 days of purchase; Peace of Mind Protection (2 attempts) must be used within 180 days; unexpired One Million CC free codes by December 31, 2026.
Fee breakdown (USD)Exam: U.S. $199. Annual Maintenance Fee after certification: U.S. $50 per year. Retake / reschedule fees: —
Eligibility / prerequisitesNo work experience required; after passing, complete the application, agree to the ISC2 Code of Ethics and meet the candidate background qualifications.
Number of questions100–125 items (multiple choice and advanced item types), Computerized Adaptive Testing
Time limit2 hours
Passing score + scoring method700 out of 1000 scaled points; unofficial result at the test center, official result emailed by ISC2
Retake waiting period30 test-free days after attempt 1, 60 after attempt 2, 90 after attempt 3 and later
Attempts allowedUp to 4 attempts in a 12-month period
CE / renewal requirement45 CPE credits per 3-year cycle + U.S. $50 AMF each year
LanguagesEnglish, Chinese, Japanese, German, Spanish
Official registration URLisc2.org/Register-for-Exam

Source: ISC2, Inc., verified 2026-10-14.

The ISC2 CC - Certified in Cybersecurity exam gives you 2 hours for 100–125 adaptive items and requires a scaled score of 700 out of 1000 to pass.

Welcome to our free CC practice tests. Whether you're just starting your exam prep or looking for a final review, our 72 practice tests cover everything you need to know to pass the Certified in Cybersecurity exam. Practice with the free ISC2 CC practice test on PracticeTestGeeks (7 questions with answer explanations).

Those numbers come straight from the official ISC2 CC Certification Exam Outline, which took effect on September 1, 2026.

Each practice test includes detailed answer explanations to help you understand not just the correct answer, but why other options are wrong. Our questions are regularly updated to reflect the latest exam objectives and format.

Why Use Our CC Practice Tests?

How to Register for the ISC2 CC Exam in 2026

The free ride is ending. ISC2 closed new enrollments in its One Million Certified in Cybersecurity program on May 20, 2026, so most new candidates now pay the U.S. $199 exam fee. If you already hold a free code from the program, the deadline is firm:

"All non-expired exam codes must be used to schedule and take an exam by December 31, 2026." — ISC2, One Million Certified in Cybersecurity program FAQ (2026) (source)

According to ISC2's exam registration page, booking works like this:

  1. Log in to your ISC2 account, or create one (an ISC2 Candidate account is free for the first year).
  2. From the Certification menu, choose the CC exam, pick a purchase option and click “Buy Now.”
  3. After checkout, open “Courses and Exams” in your ISC2 account and click Schedule next to the exam.
  4. Fill in the ISC2 Exam Account Information form with your name exactly as it appears on your ID.
  5. Finish booking the appointment on the Pearson VUE site.

Once you pass, you complete the application and pay the U.S. $50 Annual Maintenance Fee. To keep the credential you then earn 45 CPE credits over each three-year cycle.

Free ISC2 CC Study Tools

Interactive ISC2 CC resources on PracticeTestGeeks, free to start:

CC Practice Test Questions

Prepare for the ISC2 CC - Certified in Cybersecurity exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.

CC Access Controls Concepts
CC Exam Questions covering Access Controls Concepts. Master CC Test concepts for certification prep.
CC Business Continuity and Disaster Recovery
Free CC Practice Test featuring Business Continuity and Disaster Recovery. Improve your CC Exam score with mock test prep.
CC Cloud Security Fundamentals
CC Mock Exam on Cloud Security Fundamentals. CC Study Guide questions to pass on your first try.
CC Cryptography Basics
CC Test Prep for Cryptography Basics. Practice CC Quiz questions and boost your score.
CC Identity and Access Management
CC Questions and Answers on Identity and Access Management. Free CC practice for exam readiness.
CC Incident Response
CC Mock Test covering Incident Response. Online CC Test practice with instant feedback.
CC Network Security
Free CC Quiz on Network Security. CC Exam prep questions with detailed explanations.
CC Physical Security
CC Practice Questions for Physical Security. Build confidence for your CC certification exam.
CC Risk Management
CC Test Online for Risk Management. Free practice with instant results and feedback.
CC Security Governance
CC Study Material on Security Governance. Prepare effectively with real exam-style questions.
CC Security Operations
Free CC Test covering Security Operations. Practice and track your CC exam readiness.
CC Security Principles
CC Exam Questions covering Security Principles. Master CC Test concepts for certification prep.
CC Threat Intelligence
Free CC Practice Test featuring Threat Intelligence. Improve your CC Exam score with mock test prep.

Sample ISC2 CC Practice Questions

Try these questions from our free ISC2 CC practice tests. The correct answer and an explanation follow each question.

  1. What is a best practice for Incident Response?

    • A. Following established standards and documenting all decisions
    • B. Implementing without any documentation
    • C. Using ad-hoc approaches each time
    • D. Ignoring industry standards entirely

    Answer: A. Following established standards and documenting all decisions

    Best practices for Incident Response include following established standards and maintaining documentation.

  2. What is a best practice for Identity and Access Management?

    • A. Following established standards and documenting all decisions
    • B. Implementing without any documentation
    • C. Using ad-hoc approaches each time
    • D. Ignoring industry standards entirely

    Answer: A. Following established standards and documenting all decisions

    Best practices for Identity and Access Management include following established standards and maintaining documentation.

  3. What is a best practice for Business Continuity and Disaster Recovery?

    • A. Following established standards and documenting all decisions
    • B. Implementing without any documentation
    • C. Using ad-hoc approaches each time
    • D. Ignoring industry standards entirely

    Answer: A. Following established standards and documenting all decisions

    Best practices for Business Continuity and Disaster Recovery include following established standards and maintaining documentation.

  4. What is a best practice for Access Controls Concepts?

    • A. Following established standards and documenting all decisions
    • B. Implementing without any documentation
    • C. Using ad-hoc approaches each time
    • D. Ignoring industry standards entirely

    Answer: A. Following established standards and documenting all decisions

    Best practices for Access Controls Concepts include following established standards and maintaining documentation.

Take the full ISC2 CC practice test

⏱️ ⏱️ How many questions are on the ISC2 CC exam and how long is it?
The CC exam uses Computerized Adaptive Testing (CAT) and gives each candidate 100 to 125 items in 2 hours. You need a scaled score of 700 out of 1000 to pass.
💵 💵 How much does the ISC2 CC exam cost?
The standard CC exam fee is US$199. After you pass, you complete the application and pay a US$50 Annual Maintenance Fee (AMF), and you earn CPE credits to keep the certification.
📋 📋 What are the 5 domains of the ISC2 CC exam in 2026?
Under the outline effective September 1, 2026, the domains are Security Principles (24%), Security Governance (17.3%), IAM Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%).
🔐 🔐 What is the CIA triad in cybersecurity?
The CIA triad is Confidentiality, Integrity and Availability. Confidentiality keeps data away from unauthorized people, integrity makes sure data is not altered without authorization, and availability keeps systems and data accessible to authorized users when needed.
🪪 🪪 What does AAA mean: authentication, authorization and accounting?
Authentication proves who a user is, for example with a password plus a one-time code. Authorization decides what that verified user may access. Accounting records what the user did, which supports auditing and non-repudiation.
🧑‍💼 🧑‍💼 What is the difference between least privilege and separation of duties?
Least privilege gives each user only the access needed for their job and nothing more. Separation of duties splits a sensitive task between two or more people, so no single person can complete it alone, such as creating and approving the same payment.
🛡️ 🛡️ What is defense in depth vs Zero Trust?
Defense in depth layers several independent controls, such as firewalls, segmentation, endpoint protection and training, so one failure does not expose everything. Zero Trust assumes no user or device is trusted by default based on network location, and verifies every access request.
☁️ ☁️ What is the cloud shared responsibility model?
The cloud provider secures the underlying infrastructure, such as data centers, hardware and the virtualization layer. The customer always remains responsible for its own data and user access, and takes on more duties (operating systems, applications) in IaaS than in SaaS.
🔑 🔑 What is the difference between symmetric encryption, asymmetric encryption and hashing?
Symmetric encryption uses one shared secret key for encryption and decryption, as AES does. Asymmetric encryption uses a public and private key pair, as RSA does. Hashing, such as SHA-256, is one-way and is used to check integrity rather than to recover data.
🔄 🔄 What is the difference between business continuity and disaster recovery?
Business continuity keeps critical business functions running during a disruption. Disaster recovery is the part of that plan that restores IT systems and data after an incident, guided by targets such as the recovery time objective (RTO) and recovery point objective (RPO).

CC Questions and Answers

How many questions are on the ISC2 CC - Certified in Cybersecurity in 2026?

100 to 125 items. The ISC2 CC exam uses Computerized Adaptive Testing, so the number you see depends on how you perform. Items are multiple choice plus advanced item types, and you have 2 hours, under the exam outline effective September 1, 2026.

What is the ISC2 CC - Certified in Cybersecurity passing score?

700 out of 1000 scaled points. Because the score is scaled, 700 does not mean answering 70% of items correctly. Your Pearson VUE proctor gives you an unofficial result at checkout, and ISC2 emails the official result.

How much does the ISC2 CC - Certified in Cybersecurity cost?

U.S. $199 for the exam. After you pass, you pay a U.S. $50 Annual Maintenance Fee each year. The One Million Certified in Cybersecurity program closed to new enrollments on May 20, 2026, and its unexpired free codes must be used by December 31, 2026.

How long is the ISC2 CC - Certified in Cybersecurity?

2 hours. In that time you answer 100 to 125 adaptive items at a Pearson VUE test center. The exam is offered in English, Chinese, Japanese, German and Spanish.

What topics are on the ISC2 CC - Certified in Cybersecurity?

5 domains: Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). This is the outline effective September 1, 2026, which also adds AI security concepts to every domain.

When is the next ISC2 CC - Certified in Cybersecurity registration deadline?

There is no single national deadline. You must schedule and take the exam within 365 days of buying it. If you hold a free One Million Certified in Cybersecurity code, you must take the exam by December 31, 2026. Chinese-language exams run only in set windows, the next being October 8 to November 6.

Are the CC practice tests free?

Yes, all CC practice tests on Practice Test Geeks are completely free. You get instant feedback with detailed answer explanations for every question, with no registration required to start practicing.

How many CC practice test questions are available?

We offer multiple CC practice tests with hundreds of questions covering all major exam topics and objectives.

How do I prepare for the Certified in Cybersecurity exam?

Start by taking a CC practice test to identify your weak areas. Focus your study on those topics, then retake the practice tests to measure your improvement. Review the detailed explanations for any questions you miss.

How hard is the CC exam?

The difficulty varies by individual, but consistent practice with our CC practice tests will help you build confidence and improve your chances of passing on the first attempt.

How many questions are on the ISC2 CC exam and how long is it?

The ISC2 Certified in Cybersecurity (CC) exam uses Computerized Adaptive Testing (CAT), so each candidate sees between 100 and 125 items within a 2-hour time limit. Items are multiple choice plus advanced item types, and the exam is taken at a Pearson VUE test center in English, Chinese, Japanese, German or Spanish. Because the test is adaptive, the number of questions you receive does not on its own show whether you passed.

What score do you need to pass the ISC2 CC exam?

To pass the ISC2 CC exam, you need a scaled score of 700 out of 1000 points. Because the score is scaled, 700 does not mean answering 70% of questions correctly. If you do not pass, the ISC2 retake policy lets you retest 30 test-free days after a first attempt, 60 days after a second, and 90 days after a third or later attempt. You can take the exam at most 4 times in any 12-month period.

How much does the ISC2 CC exam cost, and is it still free?

The standard ISC2 CC exam fee is US$199. After passing, candidates complete the certification application and pay a US$50 Annual Maintenance Fee (AMF), then earn Continuing Professional Education (CPE) credits to keep the credential. The One Million Certified in Cybersecurity program, which offered a free course and exam, has closed to new enrollments. Existing exam codes that have not expired must be used by December 31, 2026.

What domains are on the ISC2 CC exam in 2026?

Under the exam outline effective September 1, 2026, the ISC2 CC exam covers five domains: Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). Check your study materials against this 2026 outline. It includes topics such as governance, risk and compliance (GRC) planning, key risk indicators, and quantum-resistant cryptography.

Official Resources

▶ Start Quiz