Vocations · Certifications

Practice for the CC exam,
one domain at a time.

64 original practice questions, each with an explanation, organized by the five domains of the ISC2 Certified in Cybersecurity exam outline. Track what you get right by domain and plan the days to your exam.

Start practicingWhat you get

The practice tool

Practice by domain with instant feedback, or take a timed set weighted like the exam outline. Load the sample study record to see the progress view filled in.

Loading the practice tool. If nothing appears, turn on JavaScript.

What you get

Vocations · CertificationsFreeNot affiliated with ISC2

What you finish with
A clear picture of which CC domains you know and which need work, explanations for every practice question, a set of key terms you can recite, and a day-by-day study plan to your exam date.
Who it is for
High school and college students, career changers and IT staff preparing for the ISC2 Certified in Cybersecurity exam, and teachers running a cybersecurity course or club.
Format
Browser tool: 64 original multiple-choice questions with explanations, timed sets of 10, 25 or 50, 32 flashcards and a progress view. Prints progress and the plan; downloads a calendar file of study days, a spreadsheet of answers and a progress file you can import on another device.
Access
Free. No account or sign-in. It runs in your web browser on a phone, tablet or computer. Everything you type stays in this browser and is saved there as you go; nothing is sent to Caveat.
Where it lives
The Certifications space in Caveat Vocations.
Support
Questions, a correction or a request: team@caveatacademic.com.

How to use it

  1. Start a practice round in one domain, or all five. Answer, then read the explanation, right or wrong.
  2. Use Missed last time to go back over what you got wrong until it sticks.
  3. Turn the flashcards during short breaks; mark the ones you know.
  4. Take a timed set of 25 once a week to practice pacing across all domains.
  5. On Progress, add your exam date. Follow the plan, which puts your weakest, heaviest domains first, and download it to your calendar.

Start practicing

How the questions and the progress view work

Original items, mapped to the published outline.

The five domains

Items are grouped by the domains of the ISC2 CC exam outline, and the timed set draws from each domain in proportion to its weight. ISC2 revises its outlines; check the current one on isc2.org before you book, and study from it.

DomainWeightItems here
1. Security Principles26%17
2. Business Continuity, Disaster Recovery and Incident Response Concepts10%7
3. Access Controls Concepts22%14
4. Network Security24%14
5. Security Operations18%12

What the numbers mean

Every item was written by Caveat for this tool. None comes from the exam, ISC2 training or another question bank, so the wording and difficulty will differ from the real test. The progress ring counts each domain by its weight and asks one thing: did you get the item right the last time you tried it. It is a study guide, not a prediction: ISC2 reports a scaled score, and nothing on this page can estimate it.

ISC2 and Certified in Cybersecurity (CC) are trademarks of ISC2, Inc. Caveat Academic Services is not affiliated with, endorsed by or sponsored by ISC2. Every practice item and definition on this page is original and is not drawn from the exam.

Sources

  1. ISC2. Certified in Cybersecurity (CC) Exam Outline. Domains, weights and topics; isc2.org. Check the current version before you study.
  2. ISC2. Code of Ethics (preamble and four canons); isc2.org.
  3. National Institute of Standards and Technology (2012). Computer Security Incident Handling Guide, SP 800-61 Rev. 2. The four-phase incident response life cycle used in CC study materials; Rev. 3 (2025) reorganizes incident response around the Cybersecurity Framework 2.0 functions.
  4. National Institute of Standards and Technology. Digital Identity Guidelines: Authentication and Lifecycle Management, SP 800-63B. Password guidance.
  5. National Institute of Standards and Technology (2020). Zero Trust Architecture, SP 800-207; and Guidelines for Media Sanitization, SP 800-88 Rev. 1.

ISC2 and Certified in Cybersecurity (CC) are trademarks of ISC2, Inc. Caveat Academic Services is not affiliated with, endorsed by or sponsored by ISC2. Every practice item and definition on this page is original and is not drawn from the exam. Practice scores are not exam scores and do not predict a result. Support: team@caveatacademic.com.