Security Readiness, Application, and Physical Testing

ISC2 Certified in Cybersecurity CC

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds

2 Domain 1: Security Principles (24%)

CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles

3 Domain 1: Risk Management and Security Controls

Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical

4 Domain 1: Governance, Ethics, Policy, and Privacy

Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions

5 Domain 1: Physical Security Controls

Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing

6 Domain 2: Security Governance - Business Continuity

Business Continuity (BC)

7 Domain 2: Security Governance - Disaster Recovery

Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery

8 Domain 2: GRC Planning

GRC Planning: Purpose, Importance, and Tools

9 Domain 2: Measuring Cybersecurity Effectiveness

Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity

10 Domain 2 and Domain 5: Security Awareness and Triage

Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review

11 Domain 3: Identity Lifecycle Management

Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management

12 Domain 3: Logical Access Controls

Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC

13 Domain 4: Networking Fundamentals

Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems

14 Domain 4: Network Security Architecture and Cloud Security

Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting

15 Domain 5: Incident Response

Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response

16 Domain 5: Security Monitoring

Logging and Monitoring Security Events

17 Domain 5: Threat Actors and Threat Intelligence

Threat Actors, Threat Intelligence, and Frameworks

18 Domain 5: Data Security

Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace

19 Domain 5: Asset Protection

Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management

20 Domain 5: Data Handling Policy

Data Handling Policy and Classification

21 Domain 5: Security Testing

Security Readiness, Application, and Physical Testing

22 Integrated CC Scenario Labs

Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill

23 Final 14-Day Review and Exam Readiness

CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE

Security Readiness, Application, and Physical Testing

Key Takeaways Explain This Topic AI

Subdomain 5.5 has three parts: security readiness testing, application testing, and physical penetration testing.

Readiness testing names blue, purple, and red teaming.

Application testing covers vulnerability scanning, static analysis, dynamic analysis, and threat modeling.

Physical penetration testing covers phishing, tailgating, and impersonation, and a finding needs a fix and a retest.

Source: ISC2 CC Exam Outline v01/2026, subdomain 5.5, and the CC outline page, checked 2026-10-22.

Last updated: October 2026

Security Testing in the 2026 Outline

Subdomain 5.5, Understand security testing , has three parts: security readiness testing (blue, purple, and red teaming), application testing (vulnerability scanning, static analysis, dynamic analysis, and threat modeling), and physical penetration testing (phishing, tailgating, and impersonation). The CC outline page describes entry-level staff supporting these tests rather than leading them.

Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 5.5, and CC outline page, checked 2026-10-22.

Readiness Testing: Blue, Purple, and Red

Red teaming simulates an attacker to find weaknesses.

Blue teaming defends and detects, and tests how well monitoring and response work.

Purple teaming brings the two together so attack and defense findings are shared and improved together.

These are the standard meanings of the three terms the outline names.

Application Testing Methods

Vulnerability scanning checks systems and applications for known weaknesses.

Static analysis examines code or configuration without running it.

Dynamic analysis tests a running application.

Threat modeling asks what could go wrong with a design before it is built.

Method Runs the software? Question it answers

Vulnerability scanning Scans the running system Which known weaknesses exist here?

Static analysis No Does the code or configuration contain risky patterns?

Dynamic analysis Yes How does the running application behave under test inputs?

Threat modeling No (design review) What could an attacker do to this design?

Physical Penetration Testing

Physical penetration testing checks whether people and facilities resist unauthorized entry. The outline's examples are phishing , tailgating (following an authorized person through a secured door), and impersonation (pretending to belong). A test result is useful only if it leads to a fix, such as a badge procedure, a challenge rule, or awareness training, followed by a retest.

Scenario: The Test Report

A tester follows an employee through a secured door. The finding is not that the door failed; it is that staff do not challenge unknown people. The remediation is awareness training and a challenge procedure, followed by a retest to confirm the change works.