(ISC)² CC - Exam Cheatsheet

(ISC)² CC — Exam Cheatsheet

⚠️ FORMAT CORRECTION (Aug 2026) — READ FIRST
Section titled “⚠️ FORMAT CORRECTION (Aug 2026) — READ FIRST”

The format details below are stale (most online study guides predate Oct 1, 2025). What the exam is actually like tomorrow:

CAT (Computerized Adaptive Testing): 100–125 items, 2 hours, 700/1000 to pass

Item types: MCQ + advanced types (drag-and-drop, scenario)

No item review — once you answer, you can’t go back

25 of the first 100 items are UNSCORED pretest — you cannot tell which ones; answer all and move on

Delivery: Pearson VUE test center only (no online proctoring)

The rest of this cheatsheet’s content (CIA, ports, models, ethics) is still valid. The full strategy is in research/00-MASTER-STRATEGY.md.

Format (outdated line below for reference only): ~~100 MCQ · 2 hours · passing 700/1000 · no penalty for guessing~~

Tip: Print or open on your phone. Skim the bold/tables first.

⭐ TOP 20 — If you only memorize this, memorize this

CIA Triad — Confidentiality, Integrity, Availability
AAA — Authentication, Authorization, Accounting
Risk = Threat × Vulnerability × Impact
4 Risk treatments — Accept, Avoid, Mitigate, Transfer
6 Access control models — DAC, MAC, RBAC, RuBAC, ABAC, Risk-Based
RTO = downtime budget · RPO = data-loss budget
BIA first in BCDR · Preparation first in IR
NIST IR 4 phases — Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident
Hot site = minutes · Warm = hours · Cold = days
3-2-1 backup rule (3 copies, 2 media, 1 offsite)
MAC = labels/clearances · DAC = owner decides
IDS = detect (passive) · IPS = prevent (inline)
Symmetric = same key, fast (AES) · Asymmetric = pub/priv, slow (RSA)
Hashing = one-way, integrity · Encryption = two-way, confidentiality
Least Privilege + Need to Know + Separation of Duties = access core
Defense in Depth = layered controls (almost always the right answer)
(ISC)² Ethics Canon 1 = Protect society/public trust (always first)
WPA3 > WPA2 > WPA > WEP (WEP broken, never use)
HTTP 80 · HTTPS 443 · SSH 22 · Telnet 23 · DNS 53 · RDP 3389
WPA2 = AES-CCMP · WPA3 = SAE (forward secrecy)

Domain 1 — Security Principles (heaviest weight)

CIA Triad

Confidentiality — prevent unauthorized disclosure
Integrity — prevent unauthorized modification
Availability — ensure timely access
Add-ons: Authenticity, Non-repudiation

AAA

Authentication — prove identity (password, token, biometric)
Authorization — what you can do (ACLs, permissions)
Accounting/Auditing — track what you did (logs)

Risk

Risk = Threat × Vulnerability × Impact
Threat — anything that can exploit a vulnerability
Vulnerability — a weakness
Impact — damage if exploited
Risk — probability × consequence

4 Risk Treatment Options

Option	When
Accept	Low impact; cost of fix > cost of risk
Avoid	Eliminate by removing the activity
Mitigate	Reduce likelihood or impact with controls
Transfer	Insurance / outsourcing / third party

Core Principles (these are answer-magnets)

Least Privilege — minimum access required to do the job
Need to Know — data on a strict need basis (subset of least privilege)
Separation of Duties (SoD) — split critical tasks so no one person has end-to-end control
Defense in Depth — layered controls; no single point of failure
Zero Trust — never trust, always verify (assumes breach already happened)
Implicit Deny — default deny; allow only what is explicitly permitted
Privilege Creep — accumulation of unneeded permissions over time
Non-Repudiation — cryptographic proof of action (digital signatures)

Due Diligence vs Due Care

Due Diligence — research/awareness (doing the homework)
Due Care — action (applying what you learned)
Due care fails without due diligence

(ISC)² Code of Ethics — 4 Canons (priority order)

Protect society, the common good, public trust, infrastructure
Act honorably, honestly, justly, responsibly, legally
Provide diligent and competent service
Advance and protect the profession

If a question asks “which canon comes first?” → Canon 1.

Privacy

PII — Personally Identifiable Information
PHI — Protected Health Information
GDPR (EU) · HIPAA (US healthcare) · PCI DSS (payment cards)
Data subject rights, consent, purpose limitation, data minimization

Domain 2 — BCDR & Incident Response

Plan Hierarchy

BIA → BCP → DRP (BIA identifies critical functions; BCP keeps the business running; DRP restores IT)

RTO vs RPO

Term	Question
RTO (Recovery Time Objective)	How fast must we be back? (downtime)
RPO (Recovery Point Objective)	How much data loss is acceptable?

Lower RTO/RPO → need a hotter (more expensive) site

MTBF / MTTR / MTTF

MTBF — Mean Time Between Failures (reliability)
MTTR — Mean Time To Repair (recovery speed)
MTTF — Mean Time To Failure (non-repairable items)

Disaster Recovery Sites

Type	Description	Cost	RTO
Hot	Live, current data, immediate failover	$$$	Minutes
Warm	Partial infra + some data	$$	Hours
Cold	Empty facility, no data	$	Days+
Mobile	Portable trailer with equipment	Varies	Varies

Backup Types

Full — everything
Incremental — only changes since last backup of any type
Differential — changes since last FULL backup
3-2-1 Rule — 3 copies, 2 different media, 1 offsite
Test your backups! An untested backup isn’t a backup

RAID Quick Ref

Level	Min Disks	Fault Tolerance
0	2	None — striping only
1	2	1 disk — mirroring
5	3	1 disk — striping + parity
6	4	2 disks — double parity
10	4	1 per mirror — stripe of mirrors

NIST Incident Response Lifecycle (4 phases)

Preparation — policies, training, tools
Detection & Analysis — confirm, scope, severity
Containment, Eradication & Recovery — stop the bleed, remove, restore
Post-Incident Activity — lessons learned, report

BCP/DRP Testing (least → most disruptive)

Document review / walkthrough
Tabletop exercise (discussion-based)
Simulation
Parallel test (recover at DR, keep primary running)
Full interruption test (cutover — riskiest)

Domain 3 — Access Controls

3 Categories of Controls

Category	Examples
Administrative (managerial)	Policies, training, procedures
Physical	Locks, fences, cameras, guards, mantraps
Logical / Technical	Passwords, ACLs, encryption, firewalls

6 Access Control Models

Model	Decision based on	Typical use
DAC (Discretionary)	Owner’s discretion	Small/medium org, file ownership
MAC (Mandatory)	Labels & clearances	Military, government
RBAC (Role-Based)	Role / job function	Enterprises (most common)
RuBAC (Rule-Based)	Rules (e.g., time-of-day ACL)	Firewalls, network gear
ABAC (Attribute-Based)	Multiple attributes	Fine-grained, dynamic
Risk-Based	Risk score / context	Adaptive auth

Memory aid — MAC = labels; DAC = owner decides

Authentication Factors

Type 1 — Something you know (password, PIN)
Type 2 — Something you have (token, smart card, phone)
Type 3 — Something you are (biometric)
Type 4 — Somewhere you are (location)
Type 5 — Something you do (behavioral)
MFA = 2+ different types

Biometrics & CER

FAR (False Acceptance Rate) — impostor accepted → lower is better
FRR (False Rejection Rate) — legit user rejected → lower is better
CER (Crossover Error Rate) — point where FAR = FRR → lower is better biometric

Password Best Practices (modern NIST view)

Length > complexity (8+ minimum, 12+ recommended)
No forced periodic rotation (only on compromise)
Screen against breach dictionaries
Salt + hash (bcrypt, Argon2). Never plaintext.
MD5 / SHA-1 → weak. SHA-256 → fine.

Account Types

User — regular
Privileged / Admin — elevated
Service — machine-to-machine
Guest — limited, time-bound
Shared — avoid; use individual accounts (accountability)

Common Access Attacks

Brute force · Dictionary · Rainbow tables · Credential stuffing · Password spraying · Keylogger · Phishing · Shoulder surfing · Tailgating/piggybacking (physical)

Domain 4 — Network Security

OSI 7 Layers (top → bottom)

Application — HTTP, SMTP
Presentation — encryption, format
Session — dialog control
Transport — segments, TCP/UDP, ports
Network — packets, IP, routers
Data Link — frames, MAC, switches
Physical — bits, cables, hubs

Mnemonic (top→bot): All People Seem To Need Data Processing Mnemonic (bot→top): Please Do Not Throw Sausage Pizza Away

TCP/IP 4 Layers

Link → Internet → Transport → Application

Must-Know Ports

Port	Protocol
20/21	FTP (data/control)
22	SSH
23	Telnet — insecure
25	SMTP
53	DNS
67/68	DHCP
69	TFTP
80	HTTP
110	POP3
143	IMAP
161/162	SNMP
389	LDAP
443	HTTPS
445	SMB
1433	MS SQL
3389	RDP

Network Devices

Hub (L1) — broadcasts to all, no intelligence
Switch (L2) — MAC table, forwards to port
Router (L3) — routes between networks via IP
Firewall — filters traffic
IDS — detects, alerts (passive)
IPS — detects AND blocks (inline)
Proxy — intermediary, can cache/filter

Firewall Types

Packet-Filtering (Stateless) — header only, fast, weak
Stateful — tracks connection state, smarter
Application-Layer (Proxy) — deep inspection, slowest, strongest
NGFW — stateful + DPI + IPS + app awareness

Encryption Essentials

Type	Keys	Speed	Use
Symmetric	Same shared key	Fast	Bulk data (AES, 3DES)
Asymmetric	Public + Private	Slow	Key exchange, signatures (RSA, ECC)
Hashing	None (one-way)	Fast	Integrity (SHA-256)

Confidentiality = encryption
Integrity = hashing / MAC / digital signatures
Non-repudiation = digital signature
Hashing ≠ encryption (one-way vs two-way)

PKI

CA — Certificate Authority, issues certs
CSR — Certificate Signing Request
X.509 — cert standard
CRL / OCSP — revocation
Chain of trust — Root CA → Intermediate → End-entity
Self-signed = trust anchor; otherwise = signed by a CA

Wireless

WEP — broken, never use
WPA — outdated
WPA2 — solid (AES-CCMP)
WPA3 — best, current (SAE, forward secrecy)
Personal = PSK (home/small)
Enterprise = 802.1X + RADIUS (corporate)

VPN

Site-to-Site — between networks (branch ↔ HQ)
Remote Access — user → network
Tunneling — PPTP (weak) · L2TP · IPsec (network layer) · SSL/TLS VPN (browser)

IP Classes (legacy — know the basics)

A: 1–126, /8
B: 128–191, /16
C: 192–223, /24
Private ranges: 10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16

Domain 5 — Security Operations

Data Lifecycle

Create → Store → Use → Share → Archive → Destroy

Data Classification

Public — anyone
Internal — org-wide
Confidential — restricted group
Restricted / Regulated — strictest (PII, PHI, financial)

Logging & Monitoring

Audit trail — who/what/when/where
SIEM — correlation & alerting
NTP time sync — critical for log correlation
Retention — set by regulation / policy

Change & Patch Management

All changes go through formal process: request → review → approve → test → implement → verify
Emergency changes still documented, but expedited
Patching — regular cycle, prioritize by severity (CVSS)

Vulnerability Management

Identify → Prioritize → Remediate → Verify

Scanning — automated scanner
Pen test — actual exploitation
Pen test types:
- Black box — no knowledge (most realistic)
- White box — full knowledge (most thorough)
- Gray box — partial

Pen Test Phases

Reconnaissance (passive/active)
Scanning / Enumeration
Gaining Access (exploitation)
Maintaining Access
Covering Tracks

Awareness & Training

New hire + annual refresher
Phishing simulations
Role-based training
Human = weakest link

Cloud Service Models

Model	You manage	Provider manages
IaaS	OS, apps, data, runtime	HW, network, storage, virt
PaaS	Apps, data	Everything else
SaaS	Just use it	Everything

Shared Responsibility:

Security OF the cloud → provider
Security IN the cloud → you
You always own your data

Mobile / BYOD

MDM — enforce policies on devices
BYOD — bring your own device (separation/containerization)
COPE — corporate-owned, personally enabled
Remote wipe for lost devices

Physical Security (effectiveness order)

Deter — signs, lighting
Detect — cameras, motion sensors
Delay — fences, locks, bollards
Respond — guards, police

Mantrap — two doors, only one opens at a time (anti-piggybacking)
Bollards — prevent vehicle ramming
Faraday cage — blocks electromagnetic signals

Environmental

Fire suppression in server rooms:
- ❌ Water — damages equipment
- ✅ Gas / clean agent (FM-200, CO₂, Novec 1230)
HVAC — temp 68–75°F (20–24°C), humidity 40–55%
Hot/cold aisles — airflow efficiency
EMI shielding — prevent interference

Encryption by Data State

At rest — storage (BitLocker, AES on disk)
In transit — network (TLS, IPsec)
In use — memory (TPM, secure enclaves)

🪤 Common Exam Traps

Absolute words (“always”, “never”, “only”, “must”) → usually wrong unless the principle is absolute (e.g., implicit deny is the default).
“First step” questions → BIA for BCDR; Preparation for IR; Identify/BIA before planning.
Two correct answers? → pick the one that covers more CIA + non-repudiation + least privilege + defense in depth.
Hashing vs encryption → if you need to retrieve the data, encrypt. If you only need to verify, hash.
“Which is the BEST…” → usually defense in depth or the most complete / layered option wins.
Cost vs recovery → hot sites cost most but recover fastest. The question usually wants the option that meets RTO/RPO, not the cheapest.
MAC vs DAC → government / military / clearance = MAC. Business owner of a file = DAC.
IDS vs IPS → detects (passive, alerts) = IDS. Blocks (inline) = IPS.
3-2-1 backup is the gold standard answer for backup questions.
WPA3 > WPA2 > WPA > WEP — never pick WEP in any current question.
“Which Canon of Ethics comes first?” → Canon 1 (protect society).
BIA always comes first in BCDR. If a question asks “what should be done FIRST when developing a BCP,” the answer is BIA.
Implicit deny is the default firewall posture.
Default password / default config questions → change before deployment.

🎯 Exam Day Tactics

Format

100 questions · 2 hours (~72 sec each)
Pass at 700/1000
No penalty for guessing — answer every question

Pacing

First pass — answer all easy ones, flag hard ones
Second pass — work the flagged ones
Final pass — review flagged + any you second-guessed

Decision Heuristics

Watch absolutes → usually wrong
Pick the most complete, defense-in-depth answer
Match scenario to CIA keyword: “leaked” = confidentiality; “modified” = integrity; “down” = availability
“Most likely” / “Best” → not the technically perfect answer, the most practical one
Order questions → first step / last step / next step
If encryption/hashing → think about what the user needs to do with the data

What to Bring

Government-issued ID — name must exactly match registration
Confirmation email/number (printed safer)
Nothing else — no phone, no smartwatch, no notes
Pearson VUE provides a small locker

Energy

Eat beforehand, hydrate
Use the break if you need it (most centers allow)
Last 30 min → don’t change answers unless you have a real reason

✅ Last-Minute Checklist (go down this list the night before)

Good luck. The exam is fair, the material is finite, and you’ve already done the hard part — showing up prepared. Go pass it.