Full exam simulation
100 questions · 120 minutes, 25 unscored and not identified. One question per screen, flag and strike-out, a review screen and a score report per domain — no answers until you finish.
ISC2CCFoundationalSecurityAvailable
ISC2 Certified in Cybersecurity
Entry-level cybersecurity: security principles, governance, identity and access, network and cloud security, and security operations.
Independent practice — not affiliated with or endorsed by ISC2. CC is used only to identify the exam. Trademark notices
Domain weights
Share of scored content per domain. Every sitting draws questions by these weights.
- D1Security Principles24 %25 concepts
- D2Security Governance17 %18 concepts
- D3Identity And Access Management (IAM) Concepts20 %21 concepts
- D4Networking and Cloud Security Concepts22 %23 concepts
- D5Security Operations and Incident Response17 %18 concepts
Your progress
No attempts yet. Take a full sitting to get a readiness rating; results are kept in this browser. Join your class to keep them on every device.
Choose a mode
Quick 20
20 questions · 24 min, same weights, all scored. A daily check.
Weak spots
20 questions aimed at your weakest domains, missed concepts and due reviews.
Practice builder
Pick domains, topics, how many questions and which pool (new, wrong, due, low confidence). Spaced repetition with confidence ratings, flashcards and a mistake book.
Open practiceDomain drill
One domain, up to 20 questions.
What's on the exam
Domain 1: Security Principles
24 %CIA triad, AAA, non-repudiation and privacy; risk management lifecycle and processes; laws, frameworks, policies, standards and procedures; technical, administrative and physical controls; due care, due diligence and the ISC2 Code of Ethics. Official weight 24 %.
Practice domain 1 →Domain 2: Security Governance
17 %Governance, risk and compliance (GRC) purpose and frameworks; business continuity and disaster recovery; security awareness, culture and social engineering; key metrics, key risk indicators, dashboards and score cards. Official weight 17.3 %.
Practice domain 2 →Domain 3: Identity And Access Management (IAM) Concepts
20 %Identity life cycle: role definition, provisioning, access review and deprovisioning; least privilege, separation of duties and access control models (DAC, MAC, RBAC, ABAC); authentication factors and MFA. Official weight 20 %.
Practice domain 3 →Domain 4: Networking and Cloud Security Concepts
22 %OSI and TCP/IP models, IPv4/IPv6, ports, VPN, firewalls, wireless, ICS and IoT; segmentation, VLANs, micro-segmentation, defense in depth and Zero Trust; cloud characteristics, service and deployment models and the shared responsibility model. Official weight 21.3 %.
Practice domain 4 →Domain 5: Security Operations and Incident Response
17 %Data classification, labeling, masking, sanitization and encryption; logging, monitoring, triage, threat actors and threat intelligence; incident response plans and exercises; asset life cycle and change management; red, blue and purple teaming and application testing. Official weight 17.3 %.
Practice domain 5 →
Domain names and weights come from the official CC exam objectives (checked 2026-10-27). Always check it for the authoritative scope.
Includes 15 performance-style items (put in order, match, read an exhibit) — practice them with the “Order / match” filter.
The real exam's full computerized-adaptive-testing simulations (labs in a live interface) are not reproduced.
Sources · checked 2026-10-27
- ISC2 — CC exam outline (effective September 1, 2026): 2 hours, 100–125 items, CAT, pass 700 of 1000; weights 24 / 17.3 / 20 / 21.3 / 17.3 % ↗
- ISC2 — Certified in Cybersecurity certification page (five domains) ↗
- ISC2 — Computerized Adaptive Testing FAQ (25 unscored pretest items; at least 75 scored items for CC) ↗
Sample questions
Two of this exam's original questions, with the explanation you get after every answer.
Sample 1Select one
A hospital encrypts patient records and restricts who can open them. Which security objective is it mainly protecting?
- AConfidentiality
- BNon-repudiation
- CIntegrity
- DAvailability
Show answer & explanation
Correct: A. Confidentiality means information is not disclosed to unauthorized people, processes or devices. Encryption and access control are the classic confidentiality controls.
Sample 2Select 2
Which threats are PRIMARILY threats to availability? (Select TWO.)
- AA man-in-the-middle altering a payment
- BA shoulder-surfer reading a password
- CRansomware that encrypts a file server
- DA power outage in the data center
- EAn insider copying a customer list
Show answer & explanation
Correct: C, D. Ransomware makes data unusable and outages stop systems, both denying access. Eavesdropping and copying breach confidentiality; altering data breaches integrity.