ICYB
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ICYB is an entry-level cybersecurity certification aimed at people moving into defensive security roles or adding a security credential to an IT, networking, or help-desk background. Its published blueprint is broad rather than deep: threats and the current attack landscape, network and perimeter defense, identity and authentication, endpoint hardening, data protection and cryptography, security operations and incident response, risk and governance, and secure architecture including cloud and development practices. The weighting leans toward fundamentals, network security, and operations, so a candidate should expect conceptual questions with some applied scenarios rather than vendor-specific configuration trivia. No single product dominates the syllabus, which makes the credential useful as a vocabulary-and-framework foundation before specializing.
Preparation works best in blueprint order. Start with threat terminology and the CIA triad, then work through network controls, authentication models, and endpoint controls, and finish with operations, risk, and secure design so the earlier material is reused in context. Read each domain's objectives and write short definitions in your own words; the exam rewards precise distinctions (authentication versus authorization, vulnerability versus risk, hashing versus encryption). Practice with scenario questions that ask for the best control or the first response step, and time yourself so pacing is familiar. Confirm current exam logistics, including the number of questions, appointment length, and any retake rules, directly with the certifying organization, since it publishes the authoritative and up-to-date figures.
What you'll study
About ICYB preparation
What is the ICYB actually for?
It signals foundational, vendor-neutral defensive security knowledge. It suits career changers, junior administrators, and support staff who need shared vocabulary across threats, controls, identity, operations, and risk. It is a starting credential, not a specialist or advanced practitioner certification.
What is the exam format?
The exam is delivered as multiple-choice questions covering the eight published domains. The certifying body publishes the current question count, delivery options, and appointment length on its website; check there before booking, because these details change and any third-party figure may be out of date.
How difficult is it?
Most candidates find it approachable if they have some IT exposure, but the breadth catches people out. Questions often ask for the best answer among plausible controls, so surface familiarity with terms is not enough. Expect to justify why one control or response step beats another.
How long should I study?
Plan several weeks of consistent study rather than a weekend cram. A practical rhythm is one domain per study session, followed by a review pass focused on weak areas and scenario practice. Candidates new to security should allow extra time for networking and cryptography basics.
What order should I study the domains in?
Follow the blueprint: fundamentals and threats first, then network, identity, endpoint, and data protection, then operations and incident response, and finally risk, governance, and secure architecture. The later domains reuse earlier concepts, so this order reduces re-learning.
Can I retake it if I fail?
Retake eligibility, waiting periods, and any fees are set by the certifying organization and are not fixed across time. Check its official policy page before scheduling so you know the rules and cost. Do not rely on forum posts, which frequently quote outdated terms.
What trips candidates up most?
Three patterns: confusing authentication with authorization, treating a vulnerability as equivalent to risk, and jumping to containment or eradication before identification and scoping in incident-response questions. Another common error is choosing the most technical control when the question asks for the most appropriate or first step.
Do I need hands-on tools experience?
Not strictly, but familiarity helps. Setting up a small lab, reading logs, and trying basic network scanning or access-control configuration makes abstract objectives concrete. Scenario questions become easier when you have seen what a firewall rule, an audit log, or an authentication flow looks like in practice.
How do I verify current exam details?
Use the certifying organization's official website for question count, duration, fees, passing score, and retake rules. Those figures are published by the body and change over time. This page intentionally omits them so you are not working from a stale number.