ISC2 CC cram sheet and exam-day checklist

Fast distinction drill

Authentication vs authorization: first prove who the identity is; then decide whether that identity may perform the requested action. A successful login does not imply access to every resource.

Business continuity vs disaster recovery: continuity keeps important business functions operating; disaster recovery restores technology and supporting services after disruption. They reinforce each other but answer different questions.

Preventive vs detective vs corrective: preventive controls try to stop an event, detective controls reveal it, and corrective controls help restore or fix conditions afterward. A single technology may support more than one purpose depending on how it is used.

RTO vs RPO: RTO is about how long restoration may take; RPO is about how much recent data loss measured in time the business can accept. Do not swap them.

Alert vs incident: an alert is a signal that warrants evaluation. An incident is a confirmed security event requiring response. Correlation and context matter.

Exam-day checklist

• Read FIRST, NEXT, BEST, MOST likely, and LEAST carefully.
• Eliminate answers that solve a different layer or phase.
• Prefer evidence-driven, authorized, reversible actions when the scenario is still uncertain.
• Do not assume a stronger-sounding control is the correct control for the objective.
• For cloud questions, identify who owns the layer before choosing the action.
• For incidents, preserve the response sequence and verify recovery.
• For governance, identify ownership, requirement, evidence, and review.

Use this after full study, not instead of the current ISC2 outline and hands-on practice.

Translate memorized terms into the action they justify.

When you see confidentiality, ask what unauthorized disclosure would look like and which control prevents or limits it. When you see integrity, ask what unauthorized change would look like and how the organization could detect or prevent it. When you see availability, ask what dependency or failure could make the service unusable and what resilience control addresses that condition.

For governance questions, identify the document or decision level involved. A policy expresses direction, a standard creates a mandatory implementation requirement, a procedure explains repeatable execution, and a guideline recommends practice. Risk treatment decisions also require ownership: mitigation reduces risk, transfer shifts defined consequences, avoidance stops the risk-producing activity, and acceptance deliberately retains residual risk.

For IAM questions, separate proving identity from granting permission. Authentication answers who the subject is; authorization answers what the subject may do. Least privilege limits access to what is necessary, while separation of duties prevents one identity from controlling every step of a sensitive process. Lifecycle thinking adds provisioning, review, role changes, and deprovisioning around those access decisions.

For network questions, identify the failing layer before choosing a tool. A physical link problem, invalid address, missing route, DNS failure, TLS problem, or application error can all feel like a connection problem to the user. For cloud questions, identify the service model and the shared-responsibility boundary before assigning a control to the provider or customer.

For operations questions, distinguish detection from conclusion. An alert, threat-intelligence match, or unusual event is evidence that may justify investigation; it is not automatically proof of compromise. Correlate identity, endpoint, network, cloud, and application evidence when available. During incident response, choose actions that fit the current phase and verify recovery rather than stopping at symptom removal.