CC study guide
CC · Work through your exam, one topic at a time.
Certified in Cybersecurity (CC) is ISC2's entry-level cybersecurity certification. ISC2 describes it as proving you have the foundational knowledge, skills and abilities for an entry- or junior-level cybersecurity role, and it requires no work experience - only the passion and drive to enter the field. The CC study guide has 5 sections and about 1,578 words.
01Security Principles
Nearly every question resolves to confidentiality (only authorized eyes), integrity (only authorized changes, and detectable if they happen) and availability (access when needed), plus authentication, authorization and accounting (AAA) and non-repudiation - the inability to plausibly deny an action, usually delivered by digital signatures and tamper-evident logs. Privacy is a separate obligation about how personal data is collected and used, not merely whether it is secret.
301 words, about 2 min02Security Governance
Policies state management intent, are mandatory and high level ("access must follow least privilege"). Standards are mandatory specifics ("passwords are at least 14 characters").
313 words, about 2 min03Identity and Access Management (IAM) Concepts
Identification is the claim ("I am Alice"). Authentication proves it.
313 words, about 2 min04Networking and Cloud Security Concepts
The OSI and TCP/IP models let you place a control: cabling and locks (layer 1), switches and MAC filtering (2), routing, IPsec and NAT (3), TCP/UDP ports (4), TLS (5-6), and applications such as HTTP, DNS and SMTP (7). Know the common ports - 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP - and always prefer the secure twin: SSH over Telnet, HTTPS over HTTP, SFTP over FTP, IPsec or TLS over cleartext.
341 words, about 2 min05Security Operations and Incident Response
Operations is largely about knowing what normal looks like: centralized logging, a SIEM correlating events, a SOC triaging alerts, asset inventories, configuration baselines, change management and vulnerability management (scan, prioritize by risk, patch, verify). A vulnerability scan enumerates weaknesses; a penetration test safely exploits them; a red team exercises people, process and technology together.
310 words, about 2 min