Certified in Cybersecurity Essentials (CC-aligned) Practice Exams

A 100-question, 2-hour entry-level security practice paper across the five domains of the Sep 2026 CC outline: security principles, security governance, IAM concepts, networking and cloud security, and security operations and incident response.

3 practice papers · 300 questions · 120 minutes each · pass mark 70% · ₹196 for all papers

What the CC practice exams cover

Written from the published ISC2 Certified in Cybersecurity (CC) exam outline (effective 1 Sep 2026).

Security principles (24%): confidentiality, integrity, availability, authentication and non-repudiation; risk management: identification, assessment, treatment and tolerance; security control categories: technical, administrative and physical; defence in depth, least privilege and privacy by design as principles
Security governance (17.3%): governance elements: policies, standards, procedures and guidelines; laws, regulations and contractual obligations as drivers of security controls; the ISC2 Code of Ethics and professional conduct; security awareness training and acceptable use policies; roles and accountability for security decisions in an organisation
IAM concepts (20%): identification, authentication, authorisation and accounting; authentication factors and multifactor authentication; access control models: discretionary, mandatory and role-based; least privilege, separation of duties and privileged account management; account lifecycle: provisioning, review and de-provisioning; physical access controls: badges, visitor logs and monitoring
Networking and cloud security (21.3%): the OSI and TCP/IP models and common ports and protocols; common network threats: spoofing, denial of service, sniffing and on-path attacks; network defences: firewalls, IDS and IPS, segmentation, VLANs and VPNs; cloud service and deployment models and the shared responsibility model; secure protocols and wireless security basics
Security operations and incident response (17.3%): data handling: classification, labelling, retention and destruction; encryption in transit and at rest, hashing and key handling basics; system hardening, patch management and configuration management; logging, monitoring and the purpose of a security operations centre; incident response roles, the incident response plan and escalation; business continuity and disaster recovery: RTO, RPO and restore testing

The real CC exam pattern

Questions: 100-125, computerized adaptive testing (papers use a fixed 100)
Time: 2 hours
Scoring: 700 out of 1000
Question types: multiple choice; advanced item types

Practice papers

CC-style practice exam 1: Certified in Cybersecurity — 100 questions, 120 minutes
CC-style practice exam 2: Certified in Cybersecurity — 100 questions, 120 minutes
CC-style practice exam 3: Certified in Cybersecurity — 100 questions, 120 minutes

Free CC sample questions

Sample question 1 (Security principles)

A healthcare clinic identifies that patients could be harmed if prescription records were altered by an unauthorized insider. The security team rates the likelihood of this event as low but the potential impact as very high. Which risk management step is the team performing when it combines likelihood and impact into an overall risk rating?

Risk identification
Risk assessment
Risk treatment
Risk tolerance

Answer: B. Risk assessment

Option B is correct because risk assessment is the step where identified risks are evaluated by combining likelihood and impact to produce an overall risk rating or priority. Option A is incorrect because risk identification focuses on discovering and cataloging risks, not on evaluating their severity. Option C is incorrect because risk treatment involves selecting responses such as mitigate, transfer, avoid, or accept after assessment is done. Option D is incorrect because risk tolerance describes the amount of risk an organization is willing to bear, not the act of rating a specific risk.

Sample question 2 (Continuity and incident response)

A regional bank configures its customer transaction database to perform a full backup at midnight and incremental backups every three hours throughout the day. The most recent incremental backup completed at 3:00 PM. A hardware failure corrupts the database at 4:45 PM. In this scenario, what is the recovery point objective that has been achieved, and what does it indicate?

An RPO of three hours, meaning the bank can restore the database to full operation within three hours of the failure.
An RPO of one hour and forty-five minutes, meaning the database can tolerate being offline for that duration.
An RPO of three hours, meaning the bank could lose up to three hours of transaction data since the last successful backup.
An RPO of twenty-four hours, meaning data loss is limited to one full backup cycle.

Answer: C. An RPO of three hours, meaning the bank could lose up to three hours of transaction data since the last successful backup.

Option C is correct because the recovery point objective (RPO) represents the maximum amount of data the organization is willing to lose, measured in time. With backups every three hours and the last backup at 3:00 PM, up to three hours of transactions could be lost. Option A is incorrect because RPO is not the time needed to restore systems; that is the RTO. Option B is incorrect because RPO does not describe how long a system can be down. Option D is incorrect because RPO is not related to the interval between full backups only; it reflects the maximum acceptable data loss gap, which here is three hours between incremental backups.

Sample question 3 (Access control concepts)

A new employee presents a photo ID at the IT help desk and receives a username and a temporary password. The employee enters the username and password at the login screen, and the system checks the credentials against a directory. The system then determines which network folders the employee may open and records each file access in an audit log. Which sequence correctly identifies the four access control processes in the order they occur in this scenario?

Identification, authorization, authentication, accounting
Identification, authentication, authorization, accounting
Authentication, identification, accounting, authorization
Authorization, authentication, identification, accounting
Authentication, accounting, identification, authorization

Answer: B. Identification, authentication, authorization, accounting

Option B is correct because presenting the photo ID and receiving a username is identification, entering the password and having it checked is authentication, determining which folders may be opened is authorization, and writing each file access to an audit log is accounting. Option A is incorrect because it swaps authorization and accounting, placing audit logging before the access decision. Option C is incorrect because it treats receiving the username as authentication rather than identification. Option D is incorrect because it conflates authentication with authorization and omits the distinct accounting step. Option E is incorrect because it reverses identification and authentication and mislabels the audit activity as authorization.

Sample question 4 (Network security)

A security analyst notices that an external attacker is sending packets into the corporate network with a source IP address that belongs to an internal trusted server, causing downstream devices to accept and forward the traffic. Which type of network threat is being carried out?

Spoofing
Denial of service
Sniffing
Man-in-the-middle

Answer: A. Spoofing

Option A is correct because IP spoofing involves forging the source address in packets so they appear to originate from a trusted host. Option B is incorrect because a denial-of-service attack aims to overwhelm or disrupt service availability, not to impersonate a trusted host. Option C is incorrect because sniffing passively captures traffic rather than actively forging source addresses. Option D is incorrect because a man-in-the-middle attack intercepts and potentially alters communication between two parties, which is a different technique from source address impersonation.

Sample question 5 (Security operations)

A software vendor publishes a large service pack on its public website and wants customers to be able to verify that the file has not been altered since it was posted. Which cryptographic technique should the vendor use?

Symmetric encryption with AES
Asymmetric encryption with RSA
Generating an MD5 or SHA-256 hash of the file
Applying a digital certificate to the web server

Answer: C. Generating an MD5 or SHA-256 hash of the file

Hashing generates a fixed-size fingerprint of a file that changes if even a single bit is altered, allowing customers to verify file integrity. Option A and Option B provide confidentiality, not integrity verification. Option D authenticates the server to the client but does not verify the downloaded file.

About these papers

Unofficial practice material. Every question is original, written from the vendor's publicly published exam objectives, and no real exam item is reproduced or paraphrased. This paper is not affiliated with, endorsed by, sponsored by or certified by the certification owner, and passing it does not confer any certification.