How hard is the ISC2 CC exam?
The ISC2 Certified in Cybersecurity (CC) exam is one of the easier security certifications: it is entry level, has no experience requirement, and tests concepts rather than technical skills. Beginners are typically ready after three to six weeks of study. What makes it harder than its level suggests is the question style — ISC2 asks for the best, first or most appropriate action from several reasonable ones — and an adaptive format that does not let you go back and change an answer.
Where ISC2 CC learners lose marks
This is how SaveMyCert learners do on our ISC2 CC practice questions, domain by domain, on the first try. Across 1,428 first answers to CC practice questions on SaveMyCert, learners chose the right answer 77% of the time.
| Exam domain | Exam weight | Answers | Right first time |
|---|---|---|---|
| 1. Security Principles | 24% | 441 | 76% |
| 2. Security Governance | 17% | 208 | 80% |
| 3. Identity And Access Management (IAM) Concepts | 20% | 250 | 74% |
| 4. Networking and Cloud Security Concepts | 22% | 347 | 77% |
| 5. Security Operations and Incident Response | 17% | 182 | 76% |
How this is measured: each question counts once per practice session, on the first answer. These are SaveMyCert learners part-way through preparing, answering our original questions, so treat the figures as a guide to which domains trip people up — not as a pass rate. The real exam does not score a raw percentage, so none of these figures is the pass mark.
What makes the CC approachable
The CC covers the map of the security field: core principles such as the CIA triad, governance and risk, access control, network security and security operations. You are not asked to configure a firewall, read packet captures or write scripts. ISC2 publishes the full outline, and the concepts are explained in plain terms in its free official training, so there is little hidden material.
What makes it harder than it looks
Candidates who fail the CC usually lose marks in three ways:
- Best-answer questions. Several options are true statements; the question asks which is best, first or most important. ISC2 usually prefers the answer that protects people and follows policy over the technically clever one.
- The manager’s view. Many questions are written from the perspective of someone deciding what an organisation should do, not someone fixing a machine. Technical readers often pick the hands-on fix when the expected answer is to follow the incident or change process.
- No going back. The exam is adaptive: each answer is final once you move on, so you cannot flag a question and return to it later. Candidates used to reviewing at the end find this stressful.
How long it takes to prepare
Most people with no security background are ready in three to six weeks of regular study. IT professionals who already know networking and access control can often prepare in one to three weeks, spending most of the time on governance, risk and ethics, which they are less likely to meet at work.
The ISC2 CC study plan guide linked below breaks the preparation into weeks by domain.
Who finds it hardest
Complete newcomers to IT find the networking content hardest — ports, protocols and network devices come up without explanation. Experienced technical staff tend to find the governance and ethics questions hardest, because the expected answer follows ISC2’s framework rather than what they would do on the job.
How to tell you are ready
Practise answering in one pass without changing answers, as the real exam requires. When you get a question wrong, check whether you misunderstood the concept or chose a true-but-not-best option; the second kind is the one to fix before exam day. Once you score consistently well on timed mixed-domain practice, you are ready to book.
Plan your prep
Questions, answered
Source
Exam facts in this guide come from the vendor's published exam guide. Vendors revise these — check the source for the current version before you book.