Study guide
CAT Format and Beginner Security Judgment
ISC2 Certified in Cybersecurity CC
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds
2 Domain 1: Security Principles (24%)
CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles
3 Domain 1: Risk Management and Security Controls
Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical
4 Domain 1: Governance, Ethics, Policy, and Privacy
Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions
5 Domain 1: Physical Security Controls
Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing
6 Domain 2: Security Governance - Business Continuity
Business Continuity (BC)
7 Domain 2: Security Governance - Disaster Recovery
Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery
8 Domain 2: GRC Planning
GRC Planning: Purpose, Importance, and Tools
9 Domain 2: Measuring Cybersecurity Effectiveness
Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity
10 Domain 2 and Domain 5: Security Awareness and Triage
Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review
11 Domain 3: Identity Lifecycle Management
Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management
12 Domain 3: Logical Access Controls
Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC
13 Domain 4: Networking Fundamentals
Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems
14 Domain 4: Network Security Architecture and Cloud Security
Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting
15 Domain 5: Incident Response
Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response
16 Domain 5: Security Monitoring
Logging and Monitoring Security Events
17 Domain 5: Threat Actors and Threat Intelligence
Threat Actors, Threat Intelligence, and Frameworks
18 Domain 5: Data Security
Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace
19 Domain 5: Asset Protection
Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management
20 Domain 5: Data Handling Policy
Data Handling Policy and Classification
21 Domain 5: Security Testing
Security Readiness, Application, and Physical Testing
22 Integrated CC Scenario Labs
Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill
23 Final 14-Day Review and Exam Readiness
CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE
CAT Format and Beginner Security Judgment
Key Takeaways Explain This Topic AI
The outline states that the CC exam uses Computerized Adaptive Testing (CAT) for its listed languages.
The item count is 100-125 and the time limit is 2 hours.
Scenario items are answered from the outline topics: CIA, AAA, risk, controls, and ethics.
Choose the action that protects the stated security objective and follows the stated policy, rather than the most technical-sounding option.
Source: ISC2 CC Exam Outline effective September 1, 2026, checked 2026-10-22.
Last updated: October 2026
The Format Facts
The outline says CC uses Computerized Adaptive Testing (CAT) for the English, Simplified Chinese, Japanese, German, and Spanish exams. The exam has 100-125 items and runs for 2 hours. Items are multiple choice and advanced item types. The outline does not describe how the adaptive algorithm selects items, so plan around the stated length and time, not around a formula.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), CC CAT Examination Information, https://www.isc2.org/certifications/cc/cc-certification-exam-outline , checked 2026-10-22.
A Beginner Decision Method
For each scenario, name the security objective first (confidentiality, integrity, or availability, from subdomain 1.1). Then ask who is acting and whether the action can be traced (AAA, subdomain 1.1). Then check the control and policy involved (subdomains 1.3 and 1.4). Finally, check the answer against the ISC2 Code of Ethics (subdomain 1.5). The answer that protects the stated objective within policy is usually the correct one.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- Length: 2 hours
- Items: 100-125; multiple choice and advanced item types
- Passing grade: 700 out of 1000
- Delivery: CAT, in person at Pearson testing centers (ISC2 FAQ)
Common Traps
A common trap is relying on rumored pass rates or unofficial claims. Use the outline and the ISC2 pages for format, length, and policy details, and treat the 700 out of 1000 passing grade as a scaled score.