Certified in Cybersecurity Exam Topics and Questions

Security Principles carries the heaviest weighting on the exam and sets the conceptual foundation for everything that follows. You face questions on the CIA triad, authentication methods, risk management, control types, the ISC2 Code of Ethics, and governance structures. The breadth is wide, and candidates lose marks by confusing adjacent concepts or misapplying controls to the wrong scenario.

– Information assurance and the core properties

Confidentiality, integrity and availability form the triad, but the exam tests whether you can distinguish them under pressure. A question might describe a scenario where data is altered without authorisation, and you must recognise that as an integrity failure rather than a confidentiality breach. Authentication methods appear frequently: something you know, something you have, something you are. Multi-factor authentication combines two or more categories, and the exam will check that you understand why a password plus a security question is still single-factor. Non-repudiation ensures a party cannot deny an action, typically through digital signatures. Privacy overlaps with confidentiality but focuses on personal data and the individual's rights over it. Candidates who treat these terms as interchangeable will select the wrong option when the stem turns on a subtle difference.

– Risk, controls and governance

Risk management runs through identification, assessment and treatment. You need to know that risk tolerance is set by the organisation, not by the security team, and that treatment options include acceptance, avoidance, mitigation and transfer. Controls are grouped as technical, administrative and physical. Technical controls include firewalls and encryption. Administrative controls cover policies, training and procedures. Physical controls are locks, badges and guards. The ISC2 Code of Ethics has four canons, and they are ranked. When two obligations conflict, the higher canon prevails, and that ranking is the examinable part. Governance processes translate to policies, which are high-level and mandatory; standards, which define specific requirements; procedures, which are step-by-step instructions; and regulations, which are externally imposed. Mixing up the hierarchy or the level of detail each one prescribes will cost you marks on scenario questions.

How Security Principles is tested

At just over a quarter of the exam, this topic appears in roughly one question in four. Items present a short scenario and ask you to identify which principle is at stake, which control type applies, or which risk treatment fits the facts. The traps are subtle: a stem might describe logging and monitoring, and the distractor will offer non-repudiation when the correct answer is integrity. Authentication questions often hinge on factor categories, so memorising the three types and recognising that two passwords are still one factor is essential. Ethics items describe a conflict and expect you to apply the canon hierarchy rather than your personal judgement. Governance questions test whether you can match the right instrument to the right level of authority. Candidates who rely on intuition rather than definitions will drift toward plausible but incorrect options. The weighting means you cannot afford to treat any sub-area as optional.

After the foundational principles, the exam shifts to what happens when things go wrong. Business continuity keeps critical functions running during a disruption. Disaster recovery brings systems back after an event. Incident response handles the detection, containment and recovery from security events. The weighting is lighter than Security Principles, but candidates still lose marks by confusing the scope and timing of each discipline.

How Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts is tested

One question in ten comes from this topic. Items typically describe a scenario involving an outage, a breach or a natural event, then ask which plan applies or which phase of response is underway. The common trap is mixing up business continuity and disaster recovery. BC is about maintaining operations during the event; DR is about restoring systems afterward. A question might describe switching to a alternate site to keep the call centre running, and the distractor will be disaster recovery when the correct answer is business continuity. Incident response questions focus on the sequence: detection, containment, eradication, recovery, lessons learned. Candidates who skip the containment step or who confuse eradication with recovery will pick the wrong option. The topic is narrow, so every sub-area is fair game. If you cannot define the purpose and components of each discipline in one sentence, you are not ready.

Access control decides who gets in and what they can do once inside. The topic splits between physical controls, which govern entry to buildings and rooms, and logical controls, which govern access to systems and data. Together they account for more than one question in five, and the exam tests whether you can apply the right model to the right requirement. Candidates lose marks by confusing discretionary, mandatory and role-based controls, or by misapplying least privilege and segregation of duties.

– Physical access controls

Badge systems, gates, locks and environmental design all limit who can enter a space. Monitoring extends the control: security guards, CCTV, alarm systems and logs provide detection and deterrence. The exam will describe a scenario involving physical entry and ask which control is in play or what monitoring method applies. The distinction between authorised and unauthorised personnel is straightforward in principle but tested through scenarios where an employee holds the door for a visitor or a contractor arrives without an escort. Tailgating and piggybacking are the examinable risks. Candidates who assume good intent will miss the policy violation. Physical and logical controls overlap in some scenarios, so read the stem carefully to see whether the question is about building access or system access.

– Logical access controls

Least privilege means granting only the access required to perform a role, nothing more. Segregation of duties splits a sensitive task across two or more people so that no single individual can complete it alone. Both principles reduce insider risk, and the exam tests whether you can identify violations. Discretionary access control allows the data owner to decide who gets access. Mandatory access control assigns labels to subjects and objects, and the system enforces access based on those labels. Role-based access control groups permissions by job function, and users inherit the role's rights. The distinctions are sharp, and a question will describe a scenario then ask which model is in use. Mixing up DAC and RBAC, or confusing MAC with either, will send you to the wrong option. The models are conceptual, but the exam expects you to recognise them in plain-language descriptions of real environments.

How Access Controls Concepts is tested

With just over a fifth of the weighting, this topic delivers one question in every four or five. Items describe a workplace scenario and ask which control type, principle or model applies. Physical control questions might present a building entry procedure and ask what is missing or what risk remains. Logical control questions describe a permission structure and expect you to name the model or identify the principle being violated. The traps are precise: a stem might describe role-based access, and the distractor will offer discretionary access control because the scenario mentions a manager approving requests. Least privilege and segregation of duties appear in scenarios where someone has too much access or where a single person can complete a sensitive process end to end. Candidates who skim the facts or who rely on general security intuition will drift toward plausible but incorrect answers. Every model and principle is testable, so you need working definitions, not just familiarity.

Network security follows access controls and accounts for nearly a quarter of the exam. You face questions on networking fundamentals, threat types, detection and prevention technologies, and infrastructure design across on-premises, cloud and hybrid environments. The scope is broad, the weighting is heavy, and candidates lose marks by confusing adjacent technologies or by misapplying a control to the wrong layer of the stack.

– Networking foundations

The OSI model and TCP/IP model provide the reference layers, and the exam expects you to know which protocols and devices operate at which layer. IPv4 and IPv6 differ in address length and format, and questions may describe an address and ask which version is in use. WiFi introduces wireless security protocols, and you need to distinguish WPA2 from WPA3. Ports map services to numbers: HTTP is 80, HTTPS is 443, DNS is 53. Applications sit at the top of the stack, and the exam tests whether you can trace a connection from application down through transport, network and data link. Candidates who skip the fundamentals or who guess at port numbers will lose marks on items that hinge on protocol behavior or service identification.

– Threats, detection and prevention

Distributed denial-of-service floods a target with traffic. A virus replicates by attaching to files. A worm spreads without user action. A Trojan masquerades as legitimate software. Man-in-the-middle intercepts communication between two parties, and side-channel attacks infer information from physical implementation rather than breaking the algorithm. Detection technologies include intrusion detection systems, which monitor traffic and alert on suspicious patterns. Host-based IDS runs on individual machines; network-based IDS sits on the wire. Prevention technologies include antivirus, firewalls and intrusion prevention systems, which block rather than simply alert. The exam describes an attack scenario and asks which threat type it represents or which control would prevent it. Mixing up detection and prevention, or confusing HIDS with NIDS, will point you to the wrong option.

– Infrastructure design and cloud

On-premises infrastructure requires physical controls: power, cooling, fire suppression, redundancy. Environmental design and memoranda of understanding appear in questions about shared facilities or third-party hosting. Network segmentation splits the environment into zones. A demilitarised zone sits between the internet and the internal network. VLANs separate broadcast domains. VPNs tunnel encrypted traffic across untrusted networks. Micro-segmentation applies granular controls within the internal network, and Network Access Control enforces policy before granting access. Embedded systems and IoT devices require segmentation because they often lack robust security. Cloud models shift responsibility: Software as a Service delivers applications, Infrastructure as a Service delivers compute and storage, Platform as a Service delivers a development environment. Managed service providers operate services on your behalf, and service-level agreements define uptime and support. Hybrid combines on-premises and cloud. The exam tests whether you can identify which model fits a described scenario and who holds which responsibility.

How Network security is tested

At nearly a quarter of the exam, this topic appears in one question out of every four. Items describe a network event, a design requirement or a cloud arrangement, then ask which technology, threat or model applies. Threat questions present symptoms and expect you to name the attack. Detection and prevention questions describe a control and ask whether it detects or blocks, or whether it operates on the host or the network. Infrastructure questions describe a topology and ask which segmentation technique is in use, or they describe a service and ask which cloud model applies. The traps are precise: a stem might describe a firewall, and the distractor will offer intrusion detection when the correct answer is intrusion prevention. SLA and MOU look similar but serve different purposes, and confusing them costs marks. Candidates who rely on surface familiarity rather than exact definitions will drift toward plausible but incorrect options. The weighting and the breadth mean you cannot skip any sub-area.

Security Operations closes the exam and covers data security, system hardening, policy and awareness training. The weighting is lighter than Network security but still represents nearly one question in five. Candidates lose marks by confusing symmetric and asymmetric encryption, by misapplying data handling requirements, or by mixing up policy types and their purposes.

– Data security and monitoring

Encryption protects data at rest and in transit. Symmetric encryption uses the same key for encryption and decryption; it is fast but requires secure key exchange. Asymmetric encryption uses a public key to encrypt and a private key to decrypt, solving the key distribution problem but running slower. Hashing produces a fixed-length output from variable input and is one-way; it verifies integrity but does not encrypt. Data handling includes classification, which assigns sensitivity levels; labeling, which marks data with its classification; retention, which defines how long data is kept; and destruction, which ensures data is unrecoverable when no longer needed. Logging and monitoring capture security events, and the exam tests whether you understand what to log and why. Candidates who treat encryption types as interchangeable or who skip the distinction between hashing and encryption will lose marks on scenario questions.

– Hardening, policy and training

System hardening reduces attack surface. Configuration management establishes baselines, applies updates and patches, and tracks changes. The exam expects you to know that a baseline is the starting secure state and that patches address known vulnerabilities. Best practice policies govern behavior. A data handling policy defines classification and retention. A password policy sets complexity, length and expiration. An Acceptable Use Policy tells users what they may do with organisational resources. A bring-your-own-device policy governs personal devices on the network. A change management policy requires documentation, approval and a rollback plan. A privacy policy explains how personal data is collected and used. Security awareness training addresses social engineering, password protection and other human factors. The exam tests whether you can match the right policy to the right requirement, and whether you understand why training matters. Mixing up policy types or confusing their scope will point you to the wrong option.

How Security Operations is tested

At just under a fifth of the weighting, this topic delivers one question in every five or six. Items describe a data protection requirement and ask which encryption type or handling step applies, or they present a policy scenario and ask which policy governs the situation. Encryption questions hinge on symmetric versus asymmetric, and the distractor will offer hashing when the requirement is confidentiality. Data handling questions describe a lifecycle stage and expect you to name the correct step: classification, retention or destruction. Policy questions describe workplace behavior and ask which policy applies, and the trap is choosing a plausible but incorrect policy because the scenario mentions a related concept. Change management questions test whether you know that approval comes before implementation and rollback comes after failure. Awareness training questions ask why training matters or what it should cover, and candidates who underestimate the human factor will miss the point. The weighting means you need working knowledge of every sub-area, not just the technical controls.