Five Rules for Preparing for the ISC2 Certified in Cybersecurity Exam

Summary

An exam-preparation guide explains five ISC2 CC domains through key concepts and common traps, including risk decisions, recovery objectives, access management, network and cloud security, and incident-response order.

Key points

• Security Principles questions often focus on impact and risk treatment; accepting a risk requires an authorized decision, while transferring risk does not transfer accountability.
• For continuity planning, the guide distinguishes RTO (time to restore) from RPO (acceptable data loss) and says recovery time plus work recovery time must fit within maximum tolerable downtime.
• Identity and access management should cover the employee lifecycle; two factors of the same type, such as a password and PIN, do not constitute multi-factor authentication.
• The guide emphasizes understanding network concepts and secure protocol alternatives, and distinguishes IDS alerting from blocking by a firewall or IPS.
• For incident response, it recommends containment before eradication and recovery, preserving evidence, and testing only with written authorization.
• Its study advice is to identify the weakest exam domain, review missed-question traps, and answer based on what each question is actually asking.

Vendors

Products