Which of the following terms describes a measurement with a defined threshold that warns leadership when the organization's risk exposure is rising?

Key performance indicator (KPI)

Free Practice Test

Free Certified in Cybersecurity Practice Test

Check your readiness for the ISC2 Certified in Cybersecurity (CC) exam with 50 exam-style questions across all five domains of the outline effective September 1, 2026, each with an instant explanation. Free to take, with a 60-minute timer that matches the pace of the real exam, and retake it as often as you want.

Start the Practice Test → Try a Question First

50Questions, or a 25-question quick test

60 minTimer, paced like the real exam

5Certified in Cybersecurity domains covered

A–DEvery answer choice explained, right and wrong

Try a question before you start

Pick an answer to see the reasoning. These are samples from the 50-question bank; the full test starts below.

Security Principles

A hospital discovers that patient records were altered by an unauthorized script overnight. Nobody outside the organization saw the records and the system stayed online the whole time. Which element of the CIA triad was most directly violated?

Why not A? Nobody outside the organization saw the records, so confidentiality, which guards against unauthorized disclosure, held.

Why not C? Availability concerns whether authorized users can reach the system when they need it. The system stayed online, so availability held.

Why not D? Authentication proves an identity. It supports the triad but is not one of its three properties.

B is correct. Integrity means data is accurate and has not been altered without authorization. Records being changed by an unauthorized script is a direct integrity violation, even though nothing was disclosed and nothing went offline.

Networking and Cloud Security Concepts

Which security design principle layers multiple independent controls so that the failure of any one control does not expose the protected asset?

Why not A? Separation of duties divides a sensitive task among people so that no one person controls it end to end. It addresses fraud and error, not layered technical protection.

Why not C? Least privilege grants subjects only the access their duties require. It is one control that might sit inside a layered design, not the layering principle itself.

Why not D? Zero trust verifies every access request regardless of network location. It often uses layered controls, but it is not the general term for layering them.

B is correct. Defense in depth, also called layered defense, places several independent controls in an attacker's path, such as a firewall, MFA, encryption and monitoring, so a single failure does not compromise the asset.

The full test has 50 questions like these. Start it now →

Start Your Free Practice Test

Enter your details, then choose a 25-question Quick Test or the full 50-question, 60-minute practice test.

Prefer to talk to someone?

Phone800-698-5501

Emaillearn@trainingcamp.com

What you get at the end

Your overall score, a score for each exam domain, and the domains to work on next.

Example report77%

Security Principles83%

Security Governance64%

Identity and Access Management (IAM) Concepts78%

Networking and Cloud Security Concepts71%

Security Operations and Incident Response90%

Below 80% is flagged as an area to work on.

What's on the Certified in Cybersecurity exam

5 weighted domains. The practice test draws questions from each in the same proportion.

24%
Security Principles
CIA triad, AAA, privacy, risk terms, policies and standards, control types, and ethics.
17.3%
Security Governance
GRC planning, business continuity and disaster recovery, security awareness, and metrics.
20%
Identity and Access Management (IAM) Concepts
Identity life cycle, authentication factors, least privilege, separation of duties, and access models.
21.3%
Networking and Cloud Security Concepts
OSI and TCP/IP, ports, network threats, segmentation, VPNs, and cloud service models.
17.3%
Security Operations and Incident Response
Data handling and encryption, logging and triage, threat actors, incident response, hardening, and security testing.

Built on what our boot camp teaches

Every question maps to the same exam objectives we teach in the Certified in Cybersecurity boot camp, and every answer choice has its own explanation, so a wrong answer still teaches you something. Questions last reviewed September 29, 2026.

Real exam: between 100 and 125 questions in 2 hours.
To pass: a score of 700 out of 1000 points.
This test: 50 questions on a 60-minute timer, or a 25-question quick test.

Read the full Certified in Cybersecurity exam guide

This free ISC2 Certified in Cybersecurity practice test checks your readiness for the CC exam with 50 exam-style questions across all five domains of the outline effective September 1, 2026, each with an explanation for every answer choice, on a 60-minute timer that mirrors the pace of the real two-hour exam. Built by Training Camp, an ISC2 Official Training Partner, and drawn from the same objectives we teach in our Certified in Cybersecurity Boot Camp. New to the certification? Learn more about the ISC2 CC.

What's on the ISC2 Certified in Cybersecurity (CC) exam?

ISC2 refreshed the CC outline on September 1, 2026, and this test follows the new version. It has five weighted domains: Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). The real exam uses computerized adaptive testing, so you answer between 100 and 125 questions in 2 hours, and you need 700 out of 1000 points to pass. Items are multiple choice plus advanced item types, and foundational AI security concepts are woven through every domain rather than sitting in a domain of their own.

There is no experience requirement. ISC2 designed the CC as an entry point for career changers, students and IT staff moving into security, and the exam tests whether you can apply foundational concepts to a short scenario rather than whether you can configure anything. If you studied under the previous outline, note that Security Governance is now its own domain (it absorbed business continuity and disaster recovery along with security awareness), Access Controls became Identity and Access Management, and Incident Response moved into Security Operations and Incident Response next to new material on threat actors, threat intelligence and security testing.

How to use this practice test

Take it once without notes to get an honest baseline, then read the explanation for every answer, including the ones you got right. The incorrect-choice explanations are where the distinctions the CC likes to test (authentication versus authorization, a policy versus a standard, containment versus eradication) get spelled out. Study your weakest domain and retake the test in a week. The 60-minute timer over 50 questions keeps you honest about pacing: the real exam gives you 2 hours for up to 125 adaptive questions, so practice deciding in about a minute and moving on rather than second-guessing.

Training Camp instructor teaching network security at a whiteboard

How to get the most from it

Three steps, in this order.

Student working through practice questions at a laptop

Step 1

Take a baseline

Take the full test once without notes, so the score shows where you really stand.

Step 2

Read every explanation

Including the ones you got right. The notes on the wrong choices explain the differences between similar concepts, like tokenization and encryption.

Students working on laptops in a Training Camp lab

Step 3

Fix one domain, then retake

Your results break down by domain. Study the weakest one for a week, then retake. Each Quick Test draws a fresh mix of questions.

Certified in Cybersecurity Practice Test

Frequently Asked Questions

Quick answers about the test, the ISC2 Certified in Cybersecurity (CC) exam, and how to prepare.

Is this ISC2 CC practice test free?

Yes. Training Camp's Certified in Cybersecurity practice test is free to take. You get 50 exam-style questions across all five domains of the 2026 CC outline, with a written explanation for every answer choice.

How does this practice test work?

It is 50 multiple-choice scenario questions drawn from all five CC domains, with an instant explanation after each answer and a 60-minute timer that mirrors the pace of the real exam. You can retake it as often as you want. Treat it as a readiness check rather than a substitute for full preparation.

How many questions are on the real ISC2 CC exam?

The CC exam uses computerized adaptive testing, so you answer between 100 and 125 questions in 2 hours. The item count varies because the exam stops once it is confident about your ability level.

What score do I need to pass the ISC2 CC exam?

You need 700 out of 1000 points. Because the exam is adaptive and scaled, 700 does not mean answering 70 percent of the questions correctly.

What domains does the ISC2 CC exam cover?

Under the outline effective September 1, 2026, the five domains are Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). Foundational AI security concepts appear across all five.

How hard is the ISC2 CC exam?

The CC is an entry-level certification with no experience requirement, easier than the SSCP or CISSP, but it is scenario-based rather than pure memorization. Most candidates find the identity and access models and the network security terminology the hardest parts, and the adaptive format means it feels demanding the whole way through.

Do I need experience to take the ISC2 CC?

No. ISC2 designed the CC for people starting out, so there is no work experience requirement and no prerequisite certification. Basic IT familiarity helps, but the exam assumes you are learning security concepts for the first time.

How should you prepare for the ISC2 CC exam?

Start with the ISC2 exam outline and work through each domain, then use practice questions like these to find your weak areas. If you want a structured path with an instructor and your exam voucher included, our three-day Certified in Cybersecurity Boot Camp covers all five domains of the 2026 outline.

Ready to pass it for real?

The Certified in Cybersecurity boot camp covers every exam domain with a live instructor, online or in person.

Exam voucher included
Free retake
180 days of unlimited 1-on-1 coaching after class

View the Certified in Cybersecurity Boot Camp →

Popular Searches

Quick Links