Beginner Security Decision Scenarios

ISC2 Certified in Cybersecurity CC

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds

2 Domain 1: Security Principles (24%)

CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles

3 Domain 1: Risk Management and Security Controls

Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical

4 Domain 1: Governance, Ethics, Policy, and Privacy

Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions

5 Domain 1: Physical Security Controls

Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing

6 Domain 2: Security Governance - Business Continuity

Business Continuity (BC)

7 Domain 2: Security Governance - Disaster Recovery

Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery

8 Domain 2: GRC Planning

GRC Planning: Purpose, Importance, and Tools

9 Domain 2: Measuring Cybersecurity Effectiveness

Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity

10 Domain 2 and Domain 5: Security Awareness and Triage

Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review

11 Domain 3: Identity Lifecycle Management

Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management

12 Domain 3: Logical Access Controls

Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC

13 Domain 4: Networking Fundamentals

Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems

14 Domain 4: Network Security Architecture and Cloud Security

Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting

15 Domain 5: Incident Response

Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response

16 Domain 5: Security Monitoring

Logging and Monitoring Security Events

17 Domain 5: Threat Actors and Threat Intelligence

Threat Actors, Threat Intelligence, and Frameworks

18 Domain 5: Data Security

Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace

19 Domain 5: Asset Protection

Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management

20 Domain 5: Data Handling Policy

Data Handling Policy and Classification

21 Domain 5: Security Testing

Security Readiness, Application, and Physical Testing

22 Integrated CC Scenario Labs

Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill

23 Final 14-Day Review and Exam Readiness

CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE

Beginner Security Decision Scenarios

Key Takeaways Explain This Topic AI

CC scenarios reward actions that fit the candidate's role, protect assets, follow policy, and avoid unnecessary harm.

The first safe action is often to report, preserve evidence, verify identity, or use an approved process, not to act technically and fast.

Controls should match the risk, not be chosen because they sound impressive; broad control removal for a narrow problem is almost always wrong.

The ISC2 Code of Ethics asks members to act honorably, honestly, justly, responsibly, and legally (Canon II).

A five-step framework (asset, principle, authority, policy, safest action) prevents the most common beginner scenario mistakes.

Last updated: October 2026

A Beginner Decision Framework

Many CC questions are short workplace stories where every answer choice contains security words, yet only one fits the role, risk, and policy. Use a repeatable framework instead of reacting to the most technical-sounding option. This matters because Domain 1 is 24% of the exam and supplies the judgment used in the other four domains.

Step Decision question

1 What asset, person, system, or information is at risk?

2 Which security principle is most relevant (CIA, privacy, ethics)?

3 What authority does the person in the scenario actually have?

4 What policy, procedure, or approval path applies?

5 What action cuts risk without destroying evidence or disrupting business needlessly?

Keep the ISC2 Code of Ethics canons in mind for ethics questions. The Code lists them in this order: protect society and the common good; act honorably and legally; provide diligent, competent service to principals; and advance and protect the profession.

Walked-Through Scenarios

Scenario 1, The Curious File Share. A junior employee finds a shared folder named "Executive Salaries" they can open even though their job has no need for it. Opening files to "see if it's real" or copying the folder "as proof" are both wrong, they extend an unauthorized access. The right move: stop browsing, record enough detail to report, and notify the security or IT process. Confidentiality and least privilege rule here. Curiosity is not authorization.

Scenario 2, The Unapproved Security Test. A friend says the company website probably has a login flaw and asks a junior analyst to try password guessing after hours. Even with good intent, testing without authorization is not acting legally and honorably under Canon II. Decline, then report the concern through the proper channel. "I was trying to help" never replaces written permission and defined scope.

Scenario 3, The Availability Shortcut. During a busy week a manager asks IT to disable MFA for everyone until a project ends. Availability matters, but stripping a major authentication control for all users creates outsized risk. Verify the real problem, use an approved exception process if one exists, help users with enrollment issues, and escalate business impact to the risk owner. Decisions must be risk-aware, not convenience-only.

More Scenarios and Wrong-Answer Patterns

Scenario 4, The Altered Report. A financial report was changed after approval and no one knows who did it. The core issue is integrity, and accountability is weak. Useful controls are access review, change control, version history, logging, and unique accounts. The first response is to preserve relevant records and follow the investigation process; re-editing the report can erase the evidence needed for root-cause analysis.

Scenario 5, The Privacy Mistake. A support agent emails a customer list to the wrong vendor contact. A beginner does not decide alone whether regulators or customers must be notified. Report through the privacy or incident process with the facts: what data was sent, who received it, when, and whether recall or containment is possible.

Tempting answer Why it is risky
Delete evidence immediately Blocks investigation and root-cause analysis
Share passwords to move faster Breaks authentication and accountability
Access data to satisfy curiosity Violates authorization and need-to-know
Disable controls broadly Creates large risk for a narrow problem
Decide legal notification alone Exceeds the beginner role and breaks process

If you can name the asset, the principle, the authority, and the safest next action, you can answer most beginner cybersecurity scenarios even when the technology is unfamiliar. That discipline, more than memorizing tools, is the skill this section trains.

Reading Scenario Wording Like the Exam Writer

CC scenario items are written so that distractors are plausible but break one rule. Train yourself to spot the rule each tempting option violates, then eliminate.

Phrase in an answer What it usually signals
"immediately delete" or "clean up" Evidence destruction risk; almost always wrong
"to save time" or "just this once" Convenience over policy; likely a trap
"verify identity" or "follow the process" Often the safe, role-appropriate answer
"escalate" or "report to the appropriate team" Correct when the issue exceeds beginner authority
"disable for everyone" Broad control removal; disproportionate to the risk

A second technique is to match the action to the candidate's authority. The CC credential targets entry-level practitioners (outline About section), so the scenarios in this guide favor preserving evidence and routing the issue to the right owner. When two answers are both safe, prefer the one that is reversible and least disruptive, then escalate.

A worked elimination: a phishing email reaches an employee who already clicked a link. Option A says delete the email to be safe; option B says forward it to everyone as a warning; option C says report it to security and preserve it; option D says reply to the sender to confirm. C wins because it preserves evidence and follows process; A destroys evidence, B spreads the threat, and D engages the attacker. Build this reflex and unfamiliar technology stops mattering, because the safe behavior is consistent across every Domain 1 scenario.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 1.1 to 1.5, checked 2026-10-22.