ExamFinch.com My Study

Cheat sheet

ISC2 CC Cheat Sheet

Practice this exam

Security Principles

  • 24% of exam
  • CIA Triad Risk Controls Governance Ethics

Security Governance

  • 17.3% of exam
  • GRC Business Continuity Disaster Recovery Security Awareness Metrics and KRIs

IAM Concepts

  • 20% of exam
  • Identity Life Cycle Authentication MFA Least Privilege Access Models

Networking and Cloud Security

  • 21.3% of exam
  • Ports Firewalls IDS IPS Segmentation Cloud Security

Security Operations and IR

  • 17.3% of exam
  • Data Security Monitoring Incident Response Change Management Security Testing

Quick Facts

  • Exam ISC2 CC
  • Format CAT
  • Items 100-125
  • Time 2 hours
  • Pass 700/1000
  • Level Entry level
  • Prereq None
  • Outline Sep 1 2026

CIA PR

  • Hide, trust, reach
  • Confidentiality Integrity Availability

Risk vs Threat PR

Risk

  • Likelihood impact
  • Business exposure
  • Measured

Threat

  • Potential cause
  • Actor/event
  • May exploit
  • Exposure vs cause

Control Picker PR

  • Need policy → Administrative
  • Need tool → Technical
  • Need lock → Physical
  • Stop attack → Preventive
  • Find attack → Detective
  • Fix after → Corrective

CIA Triad PR

  • Confidentiality Prevent disclosure
  • Integrity Prevent tampering
  • Availability Ensure access
  • Nonrepudiation Cannot deny
  • Privacy Personal data rights
  • Assurance Confidence level

Vulnerability vs Exploit PR

Vulnerability

  • Weakness
  • Can be fixed
  • Scan finding

Exploit

  • Attack method
  • Uses weakness
  • Active abuse
  • Weakness vs use

Risk PR

  • Asset Valuable resource
  • Threat Potential cause
  • Vulnerability Weakness
  • Likelihood Chance
  • Impact Damage
  • Risk Likelihood x impact
  • Tolerance Acceptable risk
  • Residual risk Risk remaining

Controls PR

  • Administrative Policies/processes
  • Technical Systems/tools
  • Physical Locks/guards
  • Preventive Stop event
  • Detective Find event
  • Corrective Fix issue
  • Deterrent Discourage action

BCP vs DRP RE

BCP

  • Business continues
  • Processes
  • People/sites

DRP

  • Systems recover
  • Technology
  • Restore order
  • Business vs systems

Resilience Terms RE

  • BCP Continue business
  • DRP Recover systems
  • IRP Handle incidents
  • BIA Impact analysis
  • RTO Recovery time
  • RPO Data loss
  • MTD Max downtime
  • Tabletop Discussion test

Access Flow AC

  • Identify, authenticate, authorize, account
  • ID AuthN AuthZ Logs

Authentication vs Authorization AC

Authentication

  • Proves identity
  • Password/MFA
  • Before access

Authorization

  • Grants permissions
  • Roles/rights
  • After identity
  • Who vs what

Access Picker AC

  • User claims name → Identification
  • Verify user → Authentication
  • Grant access → Authorization
  • Track actions → Accountability
  • Job-based access → RBAC
  • Label access → MAC

Access Basics AC

  • Identification Claim identity
  • Authentication Prove identity
  • Authorization Grant permissions
  • Accountability Trace actions
  • MFA Multiple factors
  • SSO One login
  • Federation Trusted identity
  • Provisioning Create access

Access Models AC

  • DAC Owner decides
  • MAC Label based
  • RBAC Role based
  • ABAC Attribute based
  • Least privilege Minimum access
  • Separation duties Split power
  • Need to know Business need

Network Controls NE

  • Firewall filters; IDS alerts; IPS blocks
  • Firewall IDS IPS VPN

IDS vs IPS NE

IDS

  • Detects
  • Alerts
  • Out-of-band

IPS

  • Prevents
  • Blocks
  • Inline
  • Alert vs block

Network Picker NE

  • Filter packets → Firewall
  • Detect only → IDS
  • Block attack → IPS
  • Remote tunnel → VPN
  • Separate users → VLAN
  • Public services → DMZ

Network Basics NE

  • TCP Reliable transport
  • UDP Fast transport
  • IP Addressing
  • DNS Name resolution
  • DHCP Assign addresses
  • NAT Translate addresses
  • VLAN Logical segment
  • DMZ Public segment

Network Controls NE

  • Firewall Filter traffic
  • IDS Detect intrusions
  • IPS Block intrusions
  • VPN Encrypted tunnel
  • NAC Control access
  • Proxy Intermediary
  • WPA3 Wi-Fi security
  • Segmentation Limit spread

IR Flow OP

  • Prepare, detect, contain, recover
  • Prepare Detect Analyze Contain Recover

Hash vs Encryption OP

Hash

  • One-way
  • Integrity
  • Fingerprint

Encryption

  • Reversible
  • Confidentiality
  • Key needed
  • Verify vs hide

Incident Picker OP

  • Before incident → Preparation
  • Alert appears → Detection
  • Scope unclear → Analysis
  • Damage spreading → Containment
  • Cause remains → Eradication
  • Service restored → Recovery

Incident Response OP

  • Preparation Get ready
  • Detection Find event
  • Analysis Confirm scope
  • Containment Limit damage
  • Eradication Remove cause
  • Recovery Restore service
  • Lessons learned Improve process

Operations OP

  • Classification Data label
  • Encryption Protect secrecy
  • Hashing Verify integrity
  • Backup Recover data
  • Hardening Reduce attack
  • Patching Fix flaws
  • Logging Record events
  • Awareness Train users

Common Traps

AuthN vs AuthZ

  • AuthN proves identity ≠ AuthZ grants rights

IDS vs IPS

  • IDS alerts ≠ IPS blocks

Hash vs encrypt

  • Hash checks integrity ≠ Encryption hides data

BCP vs DRP

  • BCP keeps business ≠ DRP restores systems

Risk formula

  • Risk needs impact ≠ Threat is cause

Least privilege

  • Minimum access ≠ Review regularly

Last Minute

  • 1. Weights: 24 / 17.3 / 20 / 21.3 / 17.3
  • 2. CAT items: 100-125
  • 3. Passing grade: 700/1000
  • 4. CIA = confidentiality/integrity/availability
  • 5. AuthN = prove identity
  • 6. AuthZ = grant permissions
  • 7. IDS alerts; IPS blocks
  • 8. BCP business; DRP systems
  • 9. Hash integrity; encryption secrecy
  • 10. Current outline since Sep 1 2026

ISC2 Certified in Cybersecurity (CC)

  • Practice Questions 237 questions Study Guide 66 topics Cheat Sheet 75 facts Flashcards 50 cards Shorts 3 short s Videos 4 videos Blogs 4 blogs Free CE Podcast