ISC2 Certified in Cybersecurity (CC) Flashcards

Five domains: Security Principles; Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts; Access Controls Concepts; Network Security; and Security Operations.

Domain 1, Security Principles, at 26% of the exam — the largest single domain weighting.

700 out of 1000 points, using a scaled scoring model rather than a raw percentage of questions correct.

Candidates get 2 hours (120 minutes) to answer 100-125 questions.

Multiple choice and advanced item types delivered via Computerized Adaptive Testing (CAT), where question difficulty adjusts based on prior answers.

None. The CC is designed as an entry-level credential, so no prior professional cybersecurity experience is required to take the exam.

The core security model of Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

Authentication verifies who a subject is (identity proofing), while authorization determines what an authenticated subject is permitted to do (access rights).

Assurance that a party cannot later deny having performed an action, typically achieved through digital signatures, logging, and audit trails tied to a verified identity.

A threat is a potential cause of harm; a vulnerability is a weakness that a threat can exploit; risk is the likelihood and impact of a threat successfully exploiting a vulnerability.

A layered security strategy that uses multiple, overlapping controls (physical, technical, administrative) so that if one control fails, others still protect the asset.

Subjects should be granted only the minimum access rights needed to perform their job function, reducing the potential impact of compromised accounts or insider misuse.

Dividing critical tasks among multiple people so no single individual can complete a sensitive process alone, reducing fraud and error risk.

Avoid, transfer, mitigate, and accept — organizations choose one or a combination based on risk appetite and cost-benefit analysis.

Recovery Time Objective (RTO) is the maximum acceptable time to restore a system after disruption; Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time.

A BCP addresses keeping essential business functions running during and after a disruption; a DRP focuses specifically on restoring IT systems and infrastructure after a disaster.

Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident (lessons learned).

DAC lets the resource owner decide who gets access; MAC enforces access based on fixed system-wide security labels/classifications that users cannot override.

An access control model that assigns permissions to roles rather than individual users, and users are granted access by being assigned to the appropriate role(s).

Something you know (password/PIN), something you have (token/smart card), and something you are (biometric) — multifactor authentication combines two or more.

To filter network traffic between security zones based on defined rules, permitting or denying traffic by criteria such as IP address, port, and protocol.

An Intrusion Detection System (IDS) monitors and alerts on suspicious traffic without blocking it; an Intrusion Prevention System (IPS) actively blocks or stops detected malicious traffic in real time.

A Virtual Private Network creates an encrypted tunnel across an untrusted network, primarily providing confidentiality (and often integrity) for data in transit.

Dividing a network into smaller isolated zones (e.g., via VLANs or subnets) to limit the blast radius of a breach and control traffic flow between zones.

A Demilitarized Zone is a buffer subnet placed between an untrusted external network and a trusted internal network, hosting public-facing services while shielding the internal network.

A centralized team and facility responsible for continuously monitoring, detecting, analyzing, and responding to cybersecurity events across an organization.

Symmetric encryption uses one shared secret key for both encryption and decryption; asymmetric encryption uses a mathematically linked public/private key pair.

Preventive controls stop an incident before it occurs; detective controls identify that an incident is happening or has happened; corrective controls restore systems and reduce impact after an incident.

An exam delivery method where question difficulty is dynamically adjusted based on the candidate's prior answers, so each candidate receives a personalized set of items.

Certified members must pay an Annual Maintenance Fee to ISC2, along with earning and reporting Continuing Professional Education (CPE) credits to maintain their certification.