If you’re serious about getting into cybersecurity, then this is for you! This time, I will cover the basics of one of the best entry-level exams you can take, and I truly believe that at the end of this article you’ll know exactly what to do to pass it!
Most beginners prepare for this exam like it’s a vocabulary test. And there is no surprise there.
It is next to impossible to understand what matters for the exam without proper guidance.
So they download the glossary. They watch 20 hours of video. They make flashcards for every acronym they find.
Then they open a practice exam and get stuck on a question where they know every single word.
How do I know that? I was that guy! And this article is what you need to stop being that guy and become someone who easily passes the exam and, more importantly, builds a good knowledge foundation for your career.
What you can expect from this article:
Whether the CC is the right first step for you
The one rule each of the 5 domains keeps testing
The trap in each domain that catches people who “know the material”
How to find your weakest domain in 15 minutes
Is the CC even for you?
The ISC2 Certified in Cybersecurity (CC) is an entry-level certificate from the same organization behind the CISSP. It’s built for people at the start:
Career switchers who need proof they understand the basics
Students and IT people who want a first security credential
Anyone overwhelmed who needs a clear structure to learn from
It won’t get you a job on its own. No certificate does. But it gives your CV a reason for a second look, and it forces you to learn the foundation every other certificate builds on.
If you’re still deciding, read the 5 rules below. If they make sense to you, the CC is a realistic goal.
The real problem: studying everything
Here’s the misconception: “The CC is a big technical exam. I need to memorize hundreds of terms before I’m ready.”
You don’t.
Most CC questions don’t ask “What is RPO?” They ask what a careful security person would do in a situation. The terms matter, but only as tools to answer that question.
Every domain keeps testing the same small set of ideas, wrapped in different stories. Learn the rule behind each domain, learn its trap, and most questions get much simpler.
The 5 rules
Domain weights are from the ISC2 CC exam outline in effect since September 1, 2026.
Domain 1: Security Principles (about 24% of the exam)
The rule: read for the impact, not the attack.
Most Domain 1 scenarios ask three things: What did the victim lose (secrecy, correctness, or access), how big is the risk, and what would a careful manager do first?
There are a couple of common traps there.
Here are the two that appear the most often on the exam:
Ignoring risk is not equal to accepting risk: Accepting a risk is a decision someone with authority makes and owns.
Transferring a risk (to an insurer, for example) moves part of the cost, never the accountability.
Make sure you understand all the risk treatment decisions and what they really mean!
Example: a manager knows the old server is vulnerable and says nothing. That’s ignoring. If she documents the risk and signs off on it, that’s accepting.
Domain 2: Security Governance (about 17% of the exam)
The rule: Governance decides, risk management weighs, compliance proves. And for continuity, the business impact analysis (BIA) always comes first.
In plain words: management decides what’s acceptable, risk management measures what could go wrong, and compliance is the proof you did what you said.”
However, we won’t be covering the whole domain today, but only the most common trap on the exam.
The trap: treating RTO and RPO as the same thing.
RTO is about time: how fast the system must be back.
RPO is about data: how much data you can afford to lose.
And RTO plus the work recovery time (WRT), the time to verify systems and data before going live, must fit inside the maximum tolerable downtime (MTD). If it doesn’t, the plan fails, no matter how good it looks.
One more to remember: compliance isn’t security. Passing an audit proves you met a minimum. It doesn’t prove you’re safe.
Are you getting lost? Don’t give up! Try the CC Readiness test and I’ll help you from there!
Domain 3: Identity and Access Management (about 20% of the exam)
The rule: Access is a life cycle, not a one-time setup.
Most Domain 3 questions describe what goes wrong when people join, move or leave, and ask which control would have stopped it.
It is absolutely essential to realize that identity and access management must cover the complete life cycle. From onboarding to employee termination.
Common trap: a password plus a PIN is “multi-factor.”
It isn’t. Both are something you know. Two factors of the same type aren’t MFA. The factors need to be from different categories to be considered MFA.
Exam thinking: if someone is being fired, their access is disabled at or before the moment they’re told. Not the next morning. Disable first, don’t delete.
Decided to go for it? Start with the free CC Week 1 Kit: The complete first 7 days of my 30-day plan, built on Domain 1, with 6 quizzes. It’s free, you have nothing to lose and everything to gain!
Domain 4: Networking and Cloud Security (about 21% of the exam)
The rule: the CC tests concepts, not configuration.
You won’t configure a firewall.
You need to know which layer something lives at, the secure replacement for each insecure protocol (Telnet → SSH, HTTP → HTTPS, FTP → SFTP), and which design limits the damage after a breach.
I am serious about the protocols!!
The trap: “The IDS will block the attack.”
An IDS detects and alerts. It doesn’t block. Blocking is a firewall’s or an IPS’s job. Read which one the question is asking about.
The cloud version of the same trap: “It’s SaaS, so the provider handles security.” The provider handles a lot. Your configuration and your data are still yours.
Domain 5: Security Operations (about 17% of the exam)
The rule: Order matters.
This domain is a lot about the order you do things in.
Protect data by its state and classification. Detect with logs. Once an incident is confirmed, contain before you eradicate, then recover and learn. And never test anything without written authorization.
The trap: “The server is infected. Wipe it and restore from backup.”
It feels like the fastest fix. But it skips containment, and it destroys the evidence you need to find out how the attacker got in. Restore that backup without knowing, and you may restore the same hole.
The order the exam expects:
Contain: isolate the server so the attack can’t spread.
Eradicate: find and remove the cause.
Recover: restore, then verify that it’s clean.
Learn: write down what happened and fix the process.
Exam thinking: when you see “FIRST” in an incident question, the answer is rarely the final fix. It’s usually containment, unless people are in danger. Human safety always comes first.
One more thing: Hashing isn’t encryption. Need secrecy? Encrypt. Need to prove a file didn’t change? Hash.
How to use the 5 rules this week
Reading rules is easy. Knowing which one would catch you is the useful part. Here’s what I’d do:
Find out where you stand. Take a short test that scores each domain separately, not one total number.
Start with your weakest domain. Not Domain 1 because it comes first. The lowest score.
For every practice question, ask one thing before you answer: what is this really asking? Impact (Domain 1)? Order (Domain 5)? Who decides (Domain 2)? Most wrong answers are right answers to a different question. That’s why the exam is so tricky!
Write down every trap that caught you. One line each. That list is worth more than any glossary. You can simply ask me in the comments, and I will explain it to you! No strings attached!
Find your weakest domain in 15 minutes
I built a free tool for step 1: the CC Readiness Test. 25 original exam-style questions, 15 minutes, and a score for each of the 5 domains. You see your results right away.
👉 Take the free CC Readiness Test
Decided to go for it? Start with the free CC Week 1 Kit: the complete first 7 days of my 30-day plan, built on Domain 1, with 6 quizzes.
👉 Get the free Week 1 Kit
And if Week 1 works for you, the full 30-Day CC First-Try Pass Plan takes you to exam day step by step!
Let’s learn and grow together!
Erich
Decoded Security