Almost every page describing the CC exam is now describing an exam that no longer exists. ISC2 published a new exam outline effective 1 September 2026 — the first major content update since the certification launched in August 2022. A whole domain was replaced. And the second thing those pages get wrong is more basic: CC does not have a fixed number of questions.
This guide uses only what ISC2 publishes on its own pages, and says plainly where ISC2 publishes nothing. Every figure below was verified on 18 September 2026.
The exam at a glance
| Outline in force | Effective 1 September 2026 |
| Format | Computerized Adaptive Testing (CAT) |
| Number of items | 100–125 — a range, not a fixed count |
| Item format | Multiple choice and advanced item types |
| Time limit | 2 hours |
| Passing grade | 700 out of 1000 points |
| Your score | Not released. Pass or fail only; a failure comes with proficiency levels by domain |
| Equivalent percentage | Not published by ISC2 — and with no score released, not derivable either |
| Experience required | None |
| Price | USD 199 exam only; USD 299 with Peace of Mind Protection (two attempts) |
| Annual maintenance fee | USD 50 a year while you hold only CC |
| Languages | English, Chinese, Japanese, German, Spanish |
| Testing centre | Pearson |
| Accreditation | ANAB to ISO/IEC 17024; approved under U.S. DoDM 8140.03 |
You will not know how many questions you are getting
CC is adaptive. ISC2 publishes the item count as a range — 100 to 125 — because the exam adjusts as you answer and stops when it has measured you confidently enough. Two hours is the one fixed quantity.
Do the arithmetic at both ends. A 100-item exam gives you 72 seconds a question. A 125-item exam gives you 57.6 seconds. You cannot know in advance which you are sitting, so prepare for the tighter one — and notice that ISC2 labels its domain weights “Average Weight” for exactly the same reason: no two candidates sit quite the same exam.
Can you settle a CC question in under a minute?
Timed practice against the two-hour limit, with a written explanation for every answer — so the questions you get wrong are the ones you learn from.
- Full-length timed tests that hold you to the real two-hour limit
- An explanation for every answer, right and wrong
- Original questions written from ISC2’s published outline — never real exam content
On Udemy · lifetime access · 30-day refund policy applies
Straight answer before you click: our CC question bank was written against the previous exam outline and is being rebuilt for the domains that took effect on 1 September 2026. Until that is done it is useful for the fundamentals that did not change — and it does not yet cover the new governance, cloud and threat-intelligence material. We would rather tell you that here than have you find out afterwards.
Comparing entry points? CompTIA Security+ practice tests. Heading for cloud instead? AWS Solutions Architect Associate practice tests.
No score, ever
This surprises people more than the adaptive format does. ISC2 states plainly that no scores are provided. You get a pass or a fail. If you fail, you receive a list of proficiency levels for each domain at the test centre, which tells you where you were weak but not how close you came.
Two practical consequences. There is no point chasing a percentage in practice, because nothing on exam day will be expressed as one. And a near miss and a heavy failure look identical on paper, so the per-domain proficiency report is the only diagnostic you will get — read it carefully before booking again.
What the exam covers now
The domains and their published average weights, as of the current outline:
- Security Principles — 24%. Now includes Authentication, Authorization and Accounting, and the risk management lifecycle.
- Networking and Cloud Security Concepts — 21.3%. Traditional networking plus cloud service and deployment models, the shared responsibility model, zero trust and segmentation.
- Identity and Access Management (IAM) Concepts — 20%. Broadened from access control to identity lifecycle, provisioning and deprovisioning.
- Security Governance — 17.3%. The domain that replaced business continuity: GRC, security awareness, culture, and measuring effectiveness with metrics and key risk indicators.
- Security Operations and Incident Response — 17.3%. Now carries incident response, threat actors, cyber threat intelligence, threat frameworks and security testing.
ISC2 also states that foundational AI topics are integrated across all five domains — identifying AI assets, recognising automated threats, and supporting governance of them. If your study material has no AI content at all, it predates this outline.
Getting certified is more than passing
After you pass, you complete an endorsement application signed by an ISC2 certified professional; ISC2 will act as endorser if you do not know one. You then pay your first annual maintenance fee to begin the membership cycle, and commit to the ISC2 Code of Ethics. The AMF is USD 50 a year while CC is your only ISC2 certification, and rises to USD 135 if you earn another one.
Where practice questions fit
Practice questions are a diagnostic, not a syllabus. Their job is to find the domain you are weak in and to train you to commit to an answer quickly, which matters more on an adaptive exam than on a fixed one. Used that way — timed, reviewed, and written from the published outline — they are the most efficient preparation available in the last few weeks.
One caution that matters more than it appears to. Sites offering “real exam questions”, brain dumps or leaked CC content are selling you a violation of the ISC2 Examination Agreement and Non-Disclosure Agreement, and ISC2 states it may revoke certifications and ban you from earning future ones. They are also stale by construction: the outline changed on 1 September 2026, so anything harvested before then describes an exam that no longer exists.
Practise under the clock, not just the syllabus.
Where to go next
If you are weighing CC against the other common entry point, the comparison is less about difficulty than about where you are standing — our CompTIA Security+ (SY0-701) exam guide sets out that exam’s published figures, including a much tighter clock at roughly sixty seconds a question and a scored result you actually get to see.
Frequently asked questions
How many questions are on the ISC2 CC exam?
Between 100 and 125. CC uses Computerized Adaptive Testing, so the number is not fixed in advance. You have two hours regardless.
What is the passing score for CC?
700 out of 1000 points. ISC2 does not release scores to candidates, so you will not find out how close you were – you receive a pass or fail, plus a list of proficiency levels by domain if you fail.
Has the CC exam changed?
Yes. A new exam outline took effect on 1 September 2026, the first major content update since CC launched in August 2022. One domain was replaced and three were renamed and broadened.
Do I need experience to take CC?
No. ISC2 states that no work experience is required. You do need to be endorsed by an ISC2 certified professional after passing, and ISC2 can act as endorser.
How much does the CC exam cost?
USD 199 for the exam, or USD 299 with Peace of Mind Protection, which includes two attempts. There is also an annual maintenance fee of USD 50 once certified.
Sources. All exam parameters above come from ISC2’s own CC certification page and exam outline (effective 1 September 2026), its article on the updated exam, its exam policy pages and its Annual Maintenance Fee page, accessed 18 September 2026, together with its 22 April 2026 press release on the conclusion of the One Million Certified in Cybersecurity programme. Exam parameters change; if you spot a discrepancy, check ISC2’s page and tell us so we can correct it.
Disclosure and disclaimer. FoxMedium publishes independent study material. Our practice tests are not official ISC2 content and are not endorsed by, affiliated with, or representative of ISC2 or the official certification examination. All questions are original and written from publicly published exam outlines. We do not host or distribute real exam content. Links to our courses earn us revenue if you enrol. ISC2, CC, Certified in Cybersecurity, CISSP and all related trademarks belong to their respective owners.
