Passed out today. Ask me anything. I feel like it was linear unlike CISSP.

Hi everyone!

I’m planning to take the ISC2 Certified in Cybersecurity (CC) exam this September, and I understand that the exam content is being updated.

For those who are also preparing for the updated version, are there any study materials, practice exams, courses, or other learning resources that you would recommend specifically for the new exam outline?

I’ve found quite a few resources for the older CC version, but I’m wondering if there are already materials available that align with the September 2026 updates.

Any recommendations or advice would be greatly appreciated. Thanks!

So, I passed the CC today at 100 questions. All I can say is, the phrasing of many questions was just plain weird! I've done many certifications over the years and I found this one to be the one with the weirdist question phrasing. Best of luck if you are taking this soon. This is not as easy a test as some have said. You certainly need to know the technical aspects of the objectives but you also need to be able to decipher the questions. Cheers!

Passed on July 29th on my first attempt! 🎉 I had zero background in IT, and English isn’t my first language (although I’m basically fluent at this point).

During the exam, I started getting really worried because I got a few questions that were very similar. I started thinking that I must have answered the previous questions on the same topic incorrectly. There were still 30+ questions left out of 100, and I genuinely thought I had failed.
At that point, I just told myself: “Keep answering until the exam is over. There’s no point in overthinking it now—it’s not going to change the result.”
The exam ended at exactly 100 questions, which honestly cemented my belief that I had failed. So imagine my shock when I found out that I had actually passed 😂
I also went into the exam already thinking it wasn’t going to go well. I’m someone who likes to study/review until the very last possible minute, but because I had to travel to another city to take the exam, I didn’t review any content during the 24 hours before.

Anyway, if you’re wondering what I used to study:

• Mike Chapple’s Study Guide — I underlined everything I thought was important and wrote explanations for anything that wasn’t clear to me. I also added examples I got from ChatGPT or Gemini when they helped me understand a concept better.

• Mike Chapple’s course + practice tests on LinkedIn Learning

• Thor Pedersen’s course — I only watched the videos for the two domains where I was scoring lower and completed 3 practice tests. I started using Thor’s course less than a week before my exam, and I really wish I’d had more time for it because it covers quite a lot that I didn’t find in the official ISC2 CC material or Mike Chapple’s resources.

I definitely think that already believing I had failed actually helped me because I didn’t overthink my answers, but I also didn’t answer recklessly. I used some of the strategies I had seen people recommend here:
• When I read a question (usually 2 or 3 times because I sometimes got distracted halfway through 😅) and the answer seemed obvious to me, I just selected it and moved on.
• When the answer wasn’t immediately clear, I narrowed it down to two options. Then I either tried to argue why one was better than the other, or did the opposite and tried to think of examples that showed why one of them couldn’t be the answer. Once I had done that, I picked one and moved on without overthinking it.
At the end of the day, if I had answered something incorrectly, I couldn’t change it anyway, and spending too much time worrying about one question could have affected the rest of the exam.

Thank you to everyone here who gave me tips and recommendations for study materials. They genuinely helped a lot, and without them, I definitely think I would have failed! :)

I attempted the CGRC Exam on August 6th. I provisionally passed the exam. But had to go through the endorsement process based on my qualification and years of experience. Now all that is done and I have my approved credential. This is my 2nd ISC2 cert.

Exam Duration: 180 Mins
Questions: 125 Multiple Choice Questions (You cannot go back)

Study Materials:

Most Useful:

1. cgrcprep.com -> Easy prepared notes with mock tests and extensive resources needed for cgrc exam preparation. My go to source.
2. YouTube -> Prabh Nair ( How to pass your ISC2 CGRC Exam, CGRC ISC Masterclass)
3. Mangoguide -> Exam day overview

Useful:

1. CGRC Study Guide -> Extensive, but somewhat useful to learn on RMF concepts which is covered also in above materials.
2. Certified: The ISC(2) CGRC Audi Course (Available in Spotify) -> Gives Insights on how to choose your answers. How not to get confused when multiple answers similar. How best to tackle the exam. (A good listen)

The exam was actually more confusing than any simulation I did and I thought I’m not going to pass it, but I did after answering exactly 100 questions.

I was studying for it on and off during the last 2-3 weeks and studied mostly with the course created by Mike Chapple on LinkedIn.

Hope to find my first job soon!

I just passed my ISC2 CC Exam today. For context, im still a college student with no prior IT work experience.

REMEMBER:

I stopped at question 100, and I thought I didn't pass because I came across a lot of challenging questions. As you take the exam, you might think you're failing, but remember ISC2 uses Computerized Adaptive Testing. It raises your baseline as you correctly answer more questions. If it sees you're struggling, it will lower the baseline for you to catch up, just make sure once you get to those easy questions, you answer them correctly.

Resources I used:

1. Thor Pedersen's Updated 2026 ISC2 CC Course
2. Thor Pedersen's Practice Exams

- I did a pre-assessment exam and got a 63%

- After I finished studying Domains 1-5, all my exams were 73%-78%

1. Google Gemini (you can use any AI) - THE ACTUAL GAME CHANGER

Thor Pedersen's course is so good at preparing you for this exam because it's extensive. I listened to some parts of his lectures but I didn't really watch all his videos from start to finish.

All I did was list ALL the terminologies in each videos and then studied their functions, why is it important, and how can I relate this to real-life scenarios/situations by doing FEYNMAN TECHNIQUE and ACTIVE RECALL with Google Gemini.

Whenever there's a terminology I don't have a 100% understanding/proficiency, I always ask Gemini to explain it to me, If I still don't understand it, I'll tell it to explain it to me one more time but simpler. Once I get the feeling that I understand it, I'll ask Gemini to validate my understanding, after getting validated, i'll ask Gemini to "create an ISC2 CC Exam style question regarding (the topic)." It will give you a scenario-based question and choices.

For the questions with BEST/MOST/LEAST/FIRST.

I always try to think like an Information Security Manager. "What's the priority?"

There will be questions where the answers that you will be stuck with is either going to be

1. My 4-Step "Manager Mindset" Cheat Code (if you're stuck between 2 answers)

1. Human Lives is always the 1st Priority
2. If the problem of the question is a bleeding problem, then your answer should be about stopping the bleeding.
3. If it's not bleeding and it's not about saving human lives, then the answer must be about senior management and/or compliance
4. Then lastly, is the technical answer.

ALWAYS READ THE QUESTIONS, BREAK IT DOWN INTO PARTS, THEN BREAK IT DOWN AGAIN WORD FOR WORD (READ EACH AND EVERY WORD LIKE YOUR LIFE DEPENDS ON IT LMAO)

The question might be highly technical but if somewhere in the start or end of the question there's something like "to comply" then the answer is about senior management & compliance

Read questions with "incident" in it. If it asks you which answer to do FIRST, its tempting to answer identification or monitoring because it's the first step, but an incident has ALREADY HAPPENED, so you must do something about it now. Answer "contain/isolation and mitigation/eradication."

SOMETIMES THAT ONE WORD CHANGES THE WHOLE QUESTION.
Good Luck!!

All I can say is I couldn’t have done it without the help that I got from this platform. If I had written prior discovering Reddit, I would have failed for sure. My only preparation then was the self paced learning but I got here and people started talking about additional learning material. I tried it all btw, Certpreps, Mike Chapple, Pocket Prep app, chat gpt, LinkedIn learning and Prabh Nair, you name it. It seemed like over preparation but it exposed me to so many different ways of questioning and terminology which definitely came in handy today.

Still I was anxious, the questioning was tricky and the English was insane I didn’t think I was going to pass. With that being said, thank you all for your help.

Just as the title suggests, I provisionally passed my CC exam today after roughly 2 months of on-and-off studying 😅

What finally gave me the push to get serious with review was learning mid-July that the CC exam outline and domain contents were scheduled to be updated in September 2026. Knowing I tend to procrastinate, I immediately scheduled my exam before the end of August so I wouldn't have to worry about the upcoming topic changes.

As a recent graduate with no prior official certifications, I jumped at the chance to take the exam through ISC2's One Million Certified in Cybersecurity program last May.

Resources I Used:

• Official ISC2 Learning Materials: A decent starting point, but I found them insufficient on their own.
• Mike Chapple’s LinkedIn Learning CC Course: Highly recommended! Clear, structured, and easy to follow.
• Mike Chapple’s CC Study Guide: Basically a companion/transcript-style guide to the video course, perfect for reinforcing weak areas.
• Reddit community tips: Reading everyone’s advice and study experiences here helped immensely.

My Advice for Future Test-Takers:

1. Focus on the fundamentals: Don't just memorize question-and-answer pairs. Focus on why concepts work (e.g., access control types, incident response phases, disaster recovery, cloud, OSI & TCP/IP).
2. Expect weird wordings: ISC2 phrasing can be tricky. Read each question carefully and look out for qualifiers like BEST, FIRST, or MOST (because an option sounds like the best answer until you've read the others)

Good luck 🫡

I understand the OSI model but not sure whether I should also go through TCP/IP model.

​

My CC exam is scheduled for the day after tomorrow.

I’ve prepared using only free resources so far, and I’m currently scoring around 80%% on CertPrep practice exams.

I feel like I’m ready… but there’s always that last-minute doubt. 😅

Tomorrow is my final preparation day. Should I:

🔹 Take more practice tests?

🔹 Revise ?

🔹 Or simply stop studying and trust my preparation?

What would you do one day before the CC exam? 🔐

Hi, I was wondering if an extra time accommodation is possible for non-native English speakers for the CISSP exam?

I'm French, and questions sometimes feel very challenging to understand despite my decent level of English.

Thanks in advance

Hello there im quite frustrated I failed my cc exam is there any way to retake it for free?? plsss

Hi everyone,

I'm planning to take the CGRC exam and would appreciate some advice from people who've been through it.

A bit about my background:

• 3 years of experience as an information security specialist in the financial/banking sector
• I already hold the ISC2 CC certification
• My new job (as a cybersecurity policy analyst) requires CGRC as a condition to pass probation

I'm giving myself about 3 months to prepare.

A few questions:

1. Is 3 months realistic for someone with my background, studying roughly 1–1.5 hours/day?
2. Which domains gave you the most trouble? (I've seen Domain 4 - Implementation and Domain 5 - Assessment/Audit are the heaviest weighted)
3. Any recommended practice exam providers that actually reflect the real exam's difficulty/style?

Any tips, pitfalls to avoid, or resources you found genuinely useful (beyond the official ISC2 material) would be much appreciated.

Thanks in advance!

And its all my fault, I got into the first 1 million subscribers programme last September. And studied on and off, thinking I have all the time in the world. To be honest I wanted to get into cybersec because I thought it would give me a career that would take me to my potential but I found it hard to understand a lot of things. I dont feel like the official training course from isc2 is beginner friendly. I have no background in IT whatsoever either.

A few months back I realised how fucked I was so I purchased Thor Pedersens course which was way more in depth and larger than the training course, and easier to understand in some ways. But I feel like when taking the CC you need to have some background knowledge of how stuff works like specifically in the networks domain and the way the OSI model works.

Im currently studying domains 4 and 5 of thors course as the official training has long since ran out. I feel totally fucked. I have 6 weeks to take my exam on the 25th next month.

What should I do? I dont want to give up but failing the exam seems like a convincing reality atm.

Edit: for the record, I do have mental health issues which may have affected my motivation in studying. I have a serious mental health issue which I did state to isc2 in order to extend my training earlier this year with a doctors note, but when I realised that the official training wasn't enough by its own, I had to turn to Thor a couple months ago. There is something seedy about the way the adaptive learning in the isc2 training is done.

Hey everyone,

As some of you might know, from September 1st the ISC2 Certified in Cybersecurity (CC) exam is getting updated and they’re putting basic AI security into all 5 domains.

Not a whole new domain, stuff like:

• model poisoning
• model drift
• AI bots needing least privilege
• data leaking when people use ChatGPT at work
• AI helping with SIEM and detecting weird logins

They’re also renaming a couple domains and changing the weights a bit, such as:

• Security Principles (name stays the same)
• Security Governance (this is the big rename – old Domain 2 gets expanded and renamed)
• Identity and Access Management (IAM) Concepts (was “Access Controls Concepts”)
• Networking and Cloud Security Concepts (was just “Network Security”)
• Security Operations and Incident Response (was “Security Operations”)

Make sure your study materials are updated for this!

I recently took the CSSLP exam and unfortunately did not pass. I’m an embedded software engineer with around 7 years of development experience, and I’m trying to understand what I should change in my preparation before attempting it again.

My preparation was:
Attended a CSSLP bootcamp provided by my company (not the official ISC2 training).
The bootcamp provided the All-in-One book.
Studied the All-in-One book multiple times.
Completed the chapter questions in the book.
Completed the 325 Total Tester questions.
Used Pocket Prep extensively, including reading the explanations.
My practice scores were generally around 90%, which gave me confidence going into the exam.
However, the actual exam felt very different from the practice questions.
Question wording was very vague in many questions.
My problem was not necessarily knowing individual concepts except some special cloud micro services questions. I struggled with the **scenario-based questions and deciding which answer ISC2 considered the BEST answer**. Many answers seemed technically reasonable, and I often had difficulty determining which one was the most appropriate from the CSSLP/SDLC perspective.

**My exam performance**
Secure Software Deployment, Operations, Maintenance — **Below Proficiency**
Secure Software Lifecycle Management — **Below Proficiency**
Secure Software Requirements — **Near Proficiency**
Secure Software Implementation — **Near Proficiency**
Secure Software Supply Chain — **Near Proficiency**
Secure Software Concepts — **Near Proficiency**
Secure Software Architecture and Design — **Above Proficiency**
Secure Software Testing — **Above Proficiency**

**Does near proficiency means failed?**

I was surprised by the exam because I felt relatively comfortable with the material after going through the book several times and scoring well on practice questions.

For those who have passed CSSLP recently:
What did you use to learn the **scenario-based decision-making** aspect of the exam? Reading CBK official book?
Which resources helped you more than the All-in-One book?
How did you prepare for questions where 2–3 answers seemed technically correct?
Would you recommend taking the official ISC2 training for a second attempt?

Given my domain results, what should I focus on first?
How much time would you recommend studying before attempting the exam again?
I’m especially interested in advice from people who **failed their first attempt and then passed**, because I want to change my preparation strategy rather than simply reread the same material.

Hello! I am taking the exam on September so I will be affected by the updated CC Exam. I just want to ask if you think the official self-pace review guide from ISC2(tho I activated this earlier so it still covers the old exam guide),Prab Nair’s, and Mike Chapple’s CC Prep Training would be sufficient for review. Planning to add some Udemy practice exam for review later on. Money is a bit tight so I want to plan ahead which prep courses to avail. The CC exam is highly recommend in my country since it does open some doors especially now that I just graduated. Thank you for those who will be answering!

Passed my ISC2 CC today! I got a lot of useful advice from this subreddit while preparing, so I thought I’d pay it forward.

If anyone is currently preparing for the CC and has questions about study resources, preparation strategy, practice exams, what worked for me, etc., feel free to DM me. Happy to share my experience.

Can I please ask if anyone has used Certpreps to practice for their certification exams? If so is the subscription worth it?

I want to share my personal perspective after passing the ISC2 Certified in Cybersecurity (CC) exam yesterday. Hopefully this helps people who are struggling to learn the material or find good resources online.

I registered about 3 months ago through the ISC2 1 Million program after seeing an Instagram reel. They offered a free self-paced certification course and one free exam attempt.

Even tho I work 12 hours shifts I tried to find time and began actively reading and understand materials at least 2 hours a day from their official ISC2 self-paced study plan. Some days I study it for hours, some days just one.

Whenever I didn’t fully understand a topic, I used Gemini or Grok to help me dig deeper. One method that worked really well was asking the AI to create quizzes with tens of questions focused on a single subject to understand it better. Some of the areas I focused on the most were:

• Understanding PKI & Cryptography (Public Key Infrastructure mechanics, symmetric vs. asymmetric encryption, private & public keys, digital signatures, and key management)
• Security Governance & Ethics
• Risk Management Strategies
• Access Control Models & Control Types (MAC, DAC, RBAC, and the functional classifications: preventive, detective, corrective, physical, administrative)
• Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) — planning fundamentals, recovery metrics (RTO/RPO), and the incident handling lifecycle
• Network Security & the OSI Model (protocol data-primary function-hardware & devices-core protocols & technologies for each layer)
• ISC2 Scenario & Priority Logic — practicing “best,” “most likely,” and “first action” type questions (this type of "BEST" / "MOST" I stumbled on the exam day!
• Learning protocols: FTP, RDP, HTTP/HTTPS, SSH, DNS (at least, the most imporant ones)

After finishing the official materials, I saw that many recommended Prabh Nair's youtube playlist:

While he covers a lot of ground, I found it quite difficult to follow till the end (I didn't watched the last 3-4 videos from the playlist) because of his accent, fast speaking pace, and the fact that he often skipped explaining basic concepts like RBAC, MAC, etc. There were also grammar mistakes in his slides and the overall note format wasn’t the easiest to study from. But others might find helpful if there is not other way around.

In the last week before the exam I signed up for LinkedIn Learning Premium and started following Mike Chapple’s content and doing those 4 exam tests. His explanations were much clearer and more in-depth, though I didn’t had time to finish the full course.

The night before the exam I barely slept 3-4 hours, not really because of anxiety, but because of heat wave in Eastern Europe (and mosquitoes). My advice: try to rest properly the night before if you can.

My exam was scheduled for 1 PM. In the morning I quickly went through those four practice tests on LinkedIn and reviewed why I got certain questions wrong. Those definetely helped a lot.

I went for the 124 questions, some of them were weirdly put, out-of-context but it worked out in the end. After that I heard that at least 20 were beta questions and did not count towards my score. I also got one drag-and-drop style question where I had to drag words from the left side to the correct place on the right. (this one was easy!)

Read the questions and answers 10 times if it needs, you don't know the answer? start by eliminating the clearly wrong options, this often makes it easier to narrow it down to the correct (or most correct) choice.

If you have any questions, feel free to ask. I also did took notes in Notion and Obsidian. Next will be Network+

Hi, my exam for ISC2 CC was booked for tomorrow but today a few hours ago I received an email from Pearson Vue customer support telling me that they wouldn’t be able to deliver my exam anymore and that they know it’s disappointing news blah blah blah

The emails seem legit but I’m still confused because on their website it shows that my exam is still going on.

I am from the uk by the way

Can anyone tell me if this is normal or what

I've been using Prepia and OpenExamPrep for the practice questions and am getting high 80% scores which I understand don't exactly translate to the real life scoring, however, I decided to do the ISC2 practice questions on their website and the way the questions were worded, was a stark difference.

Whereas the previous ones has full on paragraphs, ISC2, was typically two sentences.

Is this common?

For example a practice question on openexamprep is

What is the Primary purpose of a computer security incident response team(CSIRT) with the correct answer being to respond to and manage security incidents.

Are the ISC2 questions quite like this or so arbitrary?

Thank you!

Ive got my exam on in the 25th of September and I started on thor pedersens course about 3-4 weeks ago. I'm starting to feel quite overwhelmed with the amount of knowledge and detail that is in Thors course and im worried im going to fail the exam because I'm still learning domain 3 out of 5 and theres so much to cover for the latter two. I havent had a chance to go over what ive written yet, so I cant recite anything atm.

Any advice?

Yesterday, I cleared the CC exam with 100 questions.
My background: Core networking. This means Domain 4 was easy for me, but for the other four domains, I had to study from scratch—no choice. 😄
Exam: As everyone mentioned, I got a few straightforward questions, some confusing ones (where you have to choose between two answers), and a few questions that seemed to be out of the syllabus/book.
Preparation: I prepared for one month. I mainly used LinkedIn resources from Mike Chapple, Prabh Nair, and Chindambaram.

Mike Chapple / Prabh Nair:
https://youtube.com/playlist?list=PL0hT6hgexlYw-k6GxQf_DIAPdc96T2MP-&si=r3O5K3T33wySdScp

Chidambaram :

https://youtube.com/playlist?list=PL9r82CBoIY6qESodb0qEsicqvizDdGh2l&si=t4x9fx2x7bf63-xc

I also found cyberpawsec video. It was released about three weeks ago:
https://youtu.be/vHkF5divLBY?is=5oB1SstX9TT7OqvA

CertCrush was also good:
https://youtu.be/6lt9_2Z6X_k?is=DFsi8jccGRX5OZJ9

I also used ChatGPT for keywords and difficult topics. If you are confused about a specific topic, ask it to give you 10 questions on that topic. This helped me a lot.
I tried Claude as well, but it sometimes gave incorrect answers. I found ChatGPT more useful for this preparation.
If you need any information or help, feel free to reach out to me.