CC — ISC2 Certified in Cybersecurity Cheat Sheet

The CC exam rewards clear understanding of cybersecurity fundamentals: why a control is used, what risk it reduces, and how to distinguish similar terms under exam pressure. Many misses come from confusing adjacent concepts, such as authentication versus authorization, RTO versus RPO, threat versus vulnerability, or IDS versus IPS.

1. Scan the high-yield map to identify weak areas.
2. Review the comparison tables for commonly confused terms.
3. Practice scenario decisions: identify the asset, threat, vulnerability, control objective, and best control type.
4. Use topic drills immediately after each section.
5. Read detailed explanations for both correct and incorrect choices; the wrong answers often reveal the exam trap.

Security Design Principles

CIA triad

A good exam answer usually protects the stated objective directly. If the scenario says “prevent unauthorized viewing,” think confidentiality. If it says “detect tampering,” think integrity. If it says “keep services running,” think availability.

Risk language

Risk questions often test whether you can separate the components.

A simple way to think about risk is:

The exam may use qualitative wording rather than numbers. “High impact and high likelihood” normally demands urgent treatment.

Risk treatment options

Trap: Transferring risk does not eliminate accountability. An organization may outsource work, but it still needs governance, due diligence, monitoring, and clear responsibilities.

Control categories

Exam cue: If the question asks for “best prevention,” do not pick a control that merely detects. If it asks how to discover suspicious activity, detective controls are usually stronger.

Security governance and policy hierarchy

Trap: A procedure is not the same as a policy. A policy sets direction; a procedure tells someone exactly how to perform a task.

Security principles to keep active

A common simple risk expression is:

Risk Response Decisions

Exam trap: Transferring risk does not remove responsibility. An organization can outsource operations, but it still owns governance and accountability.

Control Categories

Control Functions

Exam trap: A policy says what is required. A procedure says how to do it.

Security Roles

Ethics and Professional Conduct

For ISC2 CC exam preparation, expect ethical reasoning questions that favor:

• Protecting society, people, and legitimate interests.
• Acting honestly, legally, and professionally.
• Reporting issues through proper channels.
• Avoiding unauthorized access, even with good intent.
• Maintaining confidentiality unless disclosure is properly authorized or legally required.

Key Continuity Metrics

High-yield distinction:

• RTO is about time to restore service.
• RPO is about amount of data loss.

Backup Types

Recovery Site Types

Incident Response Lifecycle

    flowchart LR
	    A[Prepare] --> B[Detect and Analyze]
	    B --> C[Contain]
	    C --> D[Eradicate]
	    D --> E[Recover]
	    E --> F[Lessons Learned]
	    F --> A

Evidence and Chain of Custody

Exam trap: Do not “investigate” by changing a suspect system unnecessarily. Preserve evidence and follow procedure.

BCP vs DR vs IR

Trap: Disaster recovery is not the whole business continuity program. DR is usually technology restoration; BCP is broader and includes people, facilities, vendors, communications, and business processes.

Business impact analysis terms

RTO vs RPO trap: If a system must be back within 4 hours, that is RTO. If no more than 15 minutes of transactions can be lost, that is RPO.

Backup types

Practice cue: If ransomware encrypts local backups, the better answer often involves offline, offsite, or immutable backups plus tested restoration.

Alternate processing sites

Incident response lifecycle

    flowchart LR
	    A[Prepare] --> B[Detect and analyze]
	    B --> C[Contain]
	    C --> D[Eradicate]
	    D --> E[Recover]
	    E --> F[Lessons learned]
	    F --> A

Next-step trap: Do not jump to recovery before containment and eradication. Restoring a compromised system without removing the cause can reintroduce the incident.

Evidence and communications

For security incidents, preserve facts and avoid unnecessary changes. Escalation paths, communications plans, and documentation matter.

Authentication Factors

MFA requires different factor types. A password plus a PIN is not strong MFA because both are “something you know.”

Access Control Models

Account and Privilege Controls

Identification, authentication, authorization, accountability

Major trap: Authentication happens before authorization. A user can prove identity and still be denied access.

Authentication factors

MFA requires factors from different categories. A password plus a PIN is usually not strong MFA because both are “something you know.”

Authorization models

Exam cue: If access should follow job duties, think RBAC. If classification labels and clearances dominate, think MAC. If many context attributes matter, think ABAC.

Account lifecycle controls

High-yield controls include unique user IDs, least privilege, separation of duties, periodic access reviews, logging, and rapid removal of access after termination or role change.

Physical access controls

Trap: Physical security is part of cybersecurity. Unauthorized physical access can bypass many technical controls.

Common Protocols and Ports

Network Devices and Security Tools

Segmentation Patterns

Wireless Security

Basic network model cues

You do not need to overcomplicate model questions. Identify whether the issue is about local switching, routed networks, ports, or application protocols.

Common protocols and ports

Trap: If credentials or sensitive data cross an untrusted network, prefer secure protocols such as HTTPS, SSH, SFTP, or VPN-based protection instead of plaintext protocols.

Network devices and controls

IDS vs IPS trap: IDS usually detects and alerts. IPS is usually inline and can block. If the question says “without interfering with traffic,” IDS may be better. If it says “automatically stop,” IPS may be better.

Segmentation, DMZs, and zero trust thinking

If a public web server must be reachable from the internet, placing it directly inside the internal network is usually poor design. A DMZ or segmented architecture reduces the chance that compromise of the public service immediately exposes internal assets.

Network attack patterns

Hashing vs Encryption

Certificate and Trust Terms

Exam trap: A digital signature is created with a private key and verified with the corresponding public key.

High-yield concept map

What each cryptographic tool does

Encryption, hashing, and encoding

Common trap: Base64 or similar encoding is not encryption. If anyone can reverse it without a secret key, it is not a confidentiality control.

Social Engineering Red Flags

Vulnerability Management Flow

Exam trap: A vulnerability scan identifies potential weaknesses. A penetration test attempts exploitation under defined rules.

Logging and Monitoring

Alert Triage Questions

1. Is the alert valid or a false positive?
2. What asset, user, or data is affected?
3. Is the activity still ongoing?
4. What is the business impact?
5. Is containment required now?
6. What evidence must be preserved?
7. Who must be notified according to procedure?

Routine operational controls

Trap: Installing a tool is not the same as operating a control. Logs must be reviewed, backups must be tested, patches must be deployed, and access must be recertified.

Change, incident, and problem management

If a scenario describes an emergency fix, the best answer may still include documentation, approval where possible, and post-change review.

Data handling

Data states

Malware and ransomware response cues

Prevention vs Detection vs Response

Fast practice checklist

Before a mock exam or question-bank session, confirm you can answer these without hesitation:

• Can you map examples to confidentiality, integrity, and availability?
• Can you distinguish administrative, technical, and physical controls?
• Can you identify preventive, detective, corrective, deterrent, compensating, and recovery controls?
• Can you explain risk as asset plus threat plus vulnerability plus likelihood plus impact?
• Can you distinguish risk mitigation, acceptance, avoidance, transfer, and sharing?
• Can you define RTO and RPO from a scenario?
• Can you place incident response steps in order?
• Can you tell authentication, authorization, and accountability apart?
• Can you choose between DAC, MAC, RBAC, and ABAC?
• Can you recognize secure versus insecure network protocols?
• Can you distinguish firewall, IDS, IPS, VPN, WAF, proxy, and SIEM?
• Can you explain encryption, hashing, digital signatures, certificates, and TLS?
• Can you identify when physical security is the best answer?
• Can you choose the most appropriate operational control: patching, hardening, logging, monitoring, or change management?

Mistake 3: Ignoring people and process controls

The exam is not only about technical devices. Many correct answers involve policies, training, approvals, documentation, incident roles, access reviews, or management acceptance of risk.

Mistake 4: Choosing convenience over least privilege

If one answer gives broad access “just in case” and another grants only what is required for the job, least privilege is usually the stronger security answer.

Mistake 5: Restoring too early during incidents

Recovery is important, but containment and eradication come first. Otherwise, the same compromise may return.

Mistake 6: Treating backups as automatically reliable

Backups support availability only if they are protected, current enough for the RPO, restorable within the RTO, and regularly tested.