CC — ISC2 Certified in Cybersecurity Quick Review

Quick Review purpose

This independent Quick Review is for candidates preparing for the ISC2 Certified in Cybersecurity (CC), exam code CC. Use it after you have studied the core material and before you move into topic drills, mock exams, and detailed explanations.

The CC exam rewards clear understanding of cybersecurity fundamentals: why a control is used, what risk it reduces, and how to distinguish similar terms under exam pressure. Many misses come from confusing adjacent concepts, such as authentication versus authorization, RTO versus RPO, threat versus vulnerability, or IDS versus IPS.

Use this page to refresh the major decision points, then validate your readiness with IT Mastery practice, original practice questions, and a question bank organized by topic.

How to use this Quick Review

1. Scan the high-yield map to identify weak areas.
2. Review the comparison tables for commonly confused terms.
3. Practice scenario decisions: identify the asset, threat, vulnerability, control objective, and best control type.
4. Use topic drills immediately after each section.
5. Read detailed explanations for both correct and incorrect choices; the wrong answers often reveal the exam trap.

High-yield concept map

Security principles

CIA triad

A good exam answer usually protects the stated objective directly. If the scenario says “prevent unauthorized viewing,” think confidentiality. If it says “detect tampering,” think integrity. If it says “keep services running,” think availability.

Risk language

Risk questions often test whether you can separate the components.

A simple way to think about risk is:

\[ \text{Risk} = \text{Likelihood} \times \text{Impact} \]

The exam may use qualitative wording rather than numbers. “High impact and high likelihood” normally demands urgent treatment.

Risk treatment options

Trap: Transferring risk does not eliminate accountability. An organization may outsource work, but it still needs governance, due diligence, monitoring, and clear responsibilities.

Control categories

Exam cue: If the question asks for “best prevention,” do not pick a control that merely detects. If it asks how to discover suspicious activity, detective controls are usually stronger.

Security governance and policy hierarchy

Trap: A procedure is not the same as a policy. A policy sets direction; a procedure tells someone exactly how to perform a task.

Security principles to keep active

Business continuity, disaster recovery, and incident response

BCP vs DR vs IR

Trap: Disaster recovery is not the whole business continuity program. DR is usually technology restoration; BCP is broader and includes people, facilities, vendors, communications, and business processes.

Business impact analysis terms

RTO vs RPO trap: If a system must be back within 4 hours, that is RTO. If no more than 15 minutes of transactions can be lost, that is RPO.

Backup types

Practice cue: If ransomware encrypts local backups, the better answer often involves offline, offsite, or immutable backups plus tested restoration.

Alternate processing sites

Incident response lifecycle

    flowchart LR
	    A[Prepare] --> B[Detect and analyze]
	    B --> C[Contain]
	    C --> D[Eradicate]
	    D --> E[Recover]
	    E --> F[Lessons learned]
	    F --> A

Next-step trap: Do not jump to recovery before containment and eradication. Restoring a compromised system without removing the cause can reintroduce the incident.

Evidence and communications

For security incidents, preserve facts and avoid unnecessary changes. Escalation paths, communications plans, and documentation matter.

Access control concepts

Identification, authentication, authorization, accountability

Major trap: Authentication happens before authorization. A user can prove identity and still be denied access.

Authentication factors

MFA requires factors from different categories. A password plus a PIN is usually not strong MFA because both are “something you know.”

Authorization models

Exam cue: If access should follow job duties, think RBAC. If classification labels and clearances dominate, think MAC. If many context attributes matter, think ABAC.

Account lifecycle controls

High-yield controls include unique user IDs, least privilege, separation of duties, periodic access reviews, logging, and rapid removal of access after termination or role change.

Physical access controls

Trap: Physical security is part of cybersecurity. Unauthorized physical access can bypass many technical controls.

Network security

Basic network model cues

You do not need to overcomplicate model questions. Identify whether the issue is about local switching, routed networks, ports, or application protocols.

Common protocols and ports

Trap: If credentials or sensitive data cross an untrusted network, prefer secure protocols such as HTTPS, SSH, SFTP, or VPN-based protection instead of plaintext protocols.

Network devices and controls

IDS vs IPS trap: IDS usually detects and alerts. IPS is usually inline and can block. If the question says “without interfering with traffic,” IDS may be better. If it says “automatically stop,” IPS may be better.

Segmentation, DMZs, and zero trust thinking

If a public web server must be reachable from the internet, placing it directly inside the internal network is usually poor design. A DMZ or segmented architecture reduces the chance that compromise of the public service immediately exposes internal assets.

Network attack patterns

Security operations

Routine operational controls

Trap: Installing a tool is not the same as operating a control. Logs must be reviewed, backups must be tested, patches must be deployed, and access must be recertified.

Change, incident, and problem management

If a scenario describes an emergency fix, the best answer may still include documentation, approval where possible, and post-change review.

Data handling

Data states

Malware and ransomware response cues

Cryptography fundamentals

What each cryptographic tool does

Encryption, hashing, and encoding

Common trap: Base64 or similar encoding is not encryption. If anyone can reverse it without a secret key, it is not a confidentiality control.

Cross-topic decision rules

Common candidate mistakes

Mistake 1: Picking a tool before identifying the objective

A firewall, encryption, MFA, or SIEM may be useful, but the best answer depends on the objective. First ask:

1. What asset is at risk?
2. What is the threat or failure?
3. What security objective is needed: confidentiality, integrity, availability, accountability, or safety?
4. Is the best answer preventive, detective, corrective, or recovery-focused?

Mistake 2: Confusing similar pairs

Mistake 3: Ignoring people and process controls

The exam is not only about technical devices. Many correct answers involve policies, training, approvals, documentation, incident roles, access reviews, or management acceptance of risk.

Mistake 4: Choosing convenience over least privilege

If one answer gives broad access “just in case” and another grants only what is required for the job, least privilege is usually the stronger security answer.

Mistake 5: Restoring too early during incidents

Recovery is important, but containment and eradication come first. Otherwise, the same compromise may return.

Mistake 6: Treating backups as automatically reliable

Backups support availability only if they are protected, current enough for the RPO, restorable within the RTO, and regularly tested.

Fast practice checklist

Before a mock exam or question-bank session, confirm you can answer these without hesitation:

• Can you map examples to confidentiality, integrity, and availability?
• Can you distinguish administrative, technical, and physical controls?
• Can you identify preventive, detective, corrective, deterrent, compensating, and recovery controls?
• Can you explain risk as asset plus threat plus vulnerability plus likelihood plus impact?
• Can you distinguish risk mitigation, acceptance, avoidance, transfer, and sharing?
• Can you define RTO and RPO from a scenario?
• Can you place incident response steps in order?
• Can you tell authentication, authorization, and accountability apart?
• Can you choose between DAC, MAC, RBAC, and ABAC?
• Can you recognize secure versus insecure network protocols?
• Can you distinguish firewall, IDS, IPS, VPN, WAF, proxy, and SIEM?
• Can you explain encryption, hashing, digital signatures, certificates, and TLS?
• Can you identify when physical security is the best answer?
• Can you choose the most appropriate operational control: patching, hardening, logging, monitoring, or change management?

Practice plan for the CC exam

Use this Quick Review as a bridge into active practice for the ISC2 Certified in Cybersecurity (CC), exam code CC.

1. Start with topic drills. Work one area at a time: security principles, continuity and recovery, access control, network security, and operations.
2. Use original practice questions. Do not only memorize definitions; practice scenario wording and “best answer” decisions.
3. Review detailed explanations. For every missed question, write down why the correct answer is better and why the tempting answer is weaker.
4. Build a miss log. Track repeated confusions such as RTO/RPO, IDS/IPS, encryption/hashing, or authentication/authorization.
5. Move to mixed question-bank practice. Once topic scores are stable, use mixed sets to practice switching contexts quickly.
6. Finish with mock exams. Simulate timing and review every explanation, including questions you guessed correctly.

Next step: choose your weakest topic from this Quick Review and complete a focused question bank drill with detailed explanations before moving to a full mock exam.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official ISC2 questions, copied live-exam content, or exam dumps.