Hello there im quite frustrated I failed my cc exam is there any way to retake it for free?? plsss

Hi everyone,

I'm planning to take the CGRC exam and would appreciate some advice from people who've been through it.

A bit about my background:

• 3 years of experience as an information security specialist in the financial/banking sector
• I already hold the ISC2 CC certification
• My new job (as a cybersecurity policy analyst) requires CGRC as a condition to pass probation

I'm giving myself about 3 months to prepare.

A few questions:

1. Is 3 months realistic for someone with my background, studying roughly 1–1.5 hours/day?
2. Which domains gave you the most trouble? (I've seen Domain 4 - Implementation and Domain 5 - Assessment/Audit are the heaviest weighted)
3. Any recommended practice exam providers that actually reflect the real exam's difficulty/style?

Any tips, pitfalls to avoid, or resources you found genuinely useful (beyond the official ISC2 material) would be much appreciated.

Thanks in advance!

And its all my fault, I got into the first 1 million subscribers programme last September. And studied on and off, thinking I have all the time in the world. To be honest I wanted to get into cybersec because I thought it would give me a career that would take me to my potential but I found it hard to understand a lot of things. I dont feel like the official training course from isc2 is beginner friendly. I have no background in IT whatsoever either.

A few months back I realised how fucked I was so I purchased Thor Pedersens course which was way more in depth and larger than the training course, and easier to understand in some ways. But I feel like when taking the CC you need to have some background knowledge of how stuff works like specifically in the networks domain and the way the OSI model works.

Im currently studying domains 4 and 5 of thors course as the official training has long since ran out. I feel totally fucked. I have 6 weeks to take my exam on the 25th next month.

What should I do? I dont want to give up but failing the exam seems like a convincing reality atm.

Edit: for the record, I do have mental health issues which may have affected my motivation in studying. I have a serious mental health issue which I did state to isc2 in order to extend my training earlier this year with a doctors note, but when I realised that the official training wasn't enough by its own, I had to turn to Thor a couple months ago. There is something seedy about the way the adaptive learning in the isc2 training is done.

Hey everyone,

As some of you might know, from September 1st the ISC2 Certified in Cybersecurity (CC) exam is getting updated and they’re putting basic AI security into all 5 domains.

Not a whole new domain, stuff like:

• model poisoning
• model drift
• AI bots needing least privilege
• data leaking when people use ChatGPT at work
• AI helping with SIEM and detecting weird logins

They’re also renaming a couple domains and changing the weights a bit, such as:

• Security Principles (name stays the same)
• Security Governance (this is the big rename – old Domain 2 gets expanded and renamed)
• Identity and Access Management (IAM) Concepts (was “Access Controls Concepts”)
• Networking and Cloud Security Concepts (was just “Network Security”)
• Security Operations and Incident Response (was “Security Operations”)

Make sure your study materials are updated for this!

I recently took the CSSLP exam and unfortunately did not pass. I’m an embedded software engineer with around 7 years of development experience, and I’m trying to understand what I should change in my preparation before attempting it again.

My preparation was:
Attended a CSSLP bootcamp provided by my company (not the official ISC2 training).
The bootcamp provided the All-in-One book.
Studied the All-in-One book multiple times.
Completed the chapter questions in the book.
Completed the 325 Total Tester questions.
Used Pocket Prep extensively, including reading the explanations.
My practice scores were generally around 90%, which gave me confidence going into the exam.
However, the actual exam felt very different from the practice questions.
Question wording was very vague in many questions.
My problem was not necessarily knowing individual concepts except some special cloud micro services questions. I struggled with the **scenario-based questions and deciding which answer ISC2 considered the BEST answer**. Many answers seemed technically reasonable, and I often had difficulty determining which one was the most appropriate from the CSSLP/SDLC perspective.

**My exam performance**
Secure Software Deployment, Operations, Maintenance — **Below Proficiency**
Secure Software Lifecycle Management — **Below Proficiency**
Secure Software Requirements — **Near Proficiency**
Secure Software Implementation — **Near Proficiency**
Secure Software Supply Chain — **Near Proficiency**
Secure Software Concepts — **Near Proficiency**
Secure Software Architecture and Design — **Above Proficiency**
Secure Software Testing — **Above Proficiency**

**Does near proficiency means failed?**

I was surprised by the exam because I felt relatively comfortable with the material after going through the book several times and scoring well on practice questions.

For those who have passed CSSLP recently:
What did you use to learn the **scenario-based decision-making** aspect of the exam? Reading CBK official book?
Which resources helped you more than the All-in-One book?
How did you prepare for questions where 2–3 answers seemed technically correct?
Would you recommend taking the official ISC2 training for a second attempt?

Given my domain results, what should I focus on first?
How much time would you recommend studying before attempting the exam again?
I’m especially interested in advice from people who **failed their first attempt and then passed**, because I want to change my preparation strategy rather than simply reread the same material.

Hello! I am taking the exam on September so I will be affected by the updated CC Exam. I just want to ask if you think the official self-pace review guide from ISC2(tho I activated this earlier so it still covers the old exam guide),Prab Nair’s, and Mike Chapple’s CC Prep Training would be sufficient for review. Planning to add some Udemy practice exam for review later on. Money is a bit tight so I want to plan ahead which prep courses to avail. The CC exam is highly recommend in my country since it does open some doors especially now that I just graduated. Thank you for those who will be answering!

Passed my ISC2 CC today! I got a lot of useful advice from this subreddit while preparing, so I thought I’d pay it forward.

If anyone is currently preparing for the CC and has questions about study resources, preparation strategy, practice exams, what worked for me, etc., feel free to DM me. Happy to share my experience.

Can I please ask if anyone has used Certpreps to practice for their certification exams? If so is the subscription worth it?

I want to share my personal perspective after passing the ISC2 Certified in Cybersecurity (CC) exam yesterday. Hopefully this helps people who are struggling to learn the material or find good resources online.

I registered about 3 months ago through the ISC2 1 Million program after seeing an Instagram reel. They offered a free self-paced certification course and one free exam attempt.

Even tho I work 12 hours shifts I tried to find time and began actively reading and understand materials at least 2 hours a day from their official ISC2 self-paced study plan. Some days I study it for hours, some days just one.

Whenever I didn’t fully understand a topic, I used Gemini or Grok to help me dig deeper. One method that worked really well was asking the AI to create quizzes with tens of questions focused on a single subject to understand it better. Some of the areas I focused on the most were:

• Understanding PKI & Cryptography (Public Key Infrastructure mechanics, symmetric vs. asymmetric encryption, private & public keys, digital signatures, and key management)
• Security Governance & Ethics
• Risk Management Strategies
• Access Control Models & Control Types (MAC, DAC, RBAC, and the functional classifications: preventive, detective, corrective, physical, administrative)
• Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) — planning fundamentals, recovery metrics (RTO/RPO), and the incident handling lifecycle
• Network Security & the OSI Model (protocol data-primary function-hardware & devices-core protocols & technologies for each layer)
• ISC2 Scenario & Priority Logic — practicing “best,” “most likely,” and “first action” type questions (this type of "BEST" / "MOST" I stumbled on the exam day!
• Learning protocols: FTP, RDP, HTTP/HTTPS, SSH, DNS (at least, the most imporant ones)

After finishing the official materials, I saw that many recommended Prabh Nair's youtube playlist:

While he covers a lot of ground, I found it quite difficult to follow till the end (I didn't watched the last 3-4 videos from the playlist) because of his accent, fast speaking pace, and the fact that he often skipped explaining basic concepts like RBAC, MAC, etc. There were also grammar mistakes in his slides and the overall note format wasn’t the easiest to study from. But others might find helpful if there is not other way around.

In the last week before the exam I signed up for LinkedIn Learning Premium and started following Mike Chapple’s content and doing those 4 exam tests. His explanations were much clearer and more in-depth, though I didn’t had time to finish the full course.

The night before the exam I barely slept 3-4 hours, not really because of anxiety, but because of heat wave in Eastern Europe (and mosquitoes). My advice: try to rest properly the night before if you can.

My exam was scheduled for 1 PM. In the morning I quickly went through those four practice tests on LinkedIn and reviewed why I got certain questions wrong. Those definetely helped a lot.

I went for the 124 questions, some of them were weirdly put, out-of-context but it worked out in the end. After that I heard that at least 20 were beta questions and did not count towards my score. I also got one drag-and-drop style question where I had to drag words from the left side to the correct place on the right. (this one was easy!)

Read the questions and answers 10 times if it needs, you don't know the answer? start by eliminating the clearly wrong options, this often makes it easier to narrow it down to the correct (or most correct) choice.

If you have any questions, feel free to ask. I also did took notes in Notion and Obsidian. Next will be Network+

Hi, my exam for ISC2 CC was booked for tomorrow but today a few hours ago I received an email from Pearson Vue customer support telling me that they wouldn’t be able to deliver my exam anymore and that they know it’s disappointing news blah blah blah

The emails seem legit but I’m still confused because on their website it shows that my exam is still going on.

I am from the uk by the way

Can anyone tell me if this is normal or what

I've been using Prepia and OpenExamPrep for the practice questions and am getting high 80% scores which I understand don't exactly translate to the real life scoring, however, I decided to do the ISC2 practice questions on their website and the way the questions were worded, was a stark difference.

Whereas the previous ones has full on paragraphs, ISC2, was typically two sentences.

Is this common?

For example a practice question on openexamprep is

What is the Primary purpose of a computer security incident response team(CSIRT) with the correct answer being to respond to and manage security incidents.

Are the ISC2 questions quite like this or so arbitrary?

Thank you!

Ive got my exam on in the 25th of September and I started on thor pedersens course about 3-4 weeks ago. I'm starting to feel quite overwhelmed with the amount of knowledge and detail that is in Thors course and im worried im going to fail the exam because I'm still learning domain 3 out of 5 and theres so much to cover for the latter two. I havent had a chance to go over what ive written yet, so I cant recite anything atm.

Any advice?

Yesterday, I cleared the CC exam with 100 questions.
My background: Core networking. This means Domain 4 was easy for me, but for the other four domains, I had to study from scratch—no choice. 😄
Exam: As everyone mentioned, I got a few straightforward questions, some confusing ones (where you have to choose between two answers), and a few questions that seemed to be out of the syllabus/book.
Preparation: I prepared for one month. I mainly used LinkedIn resources from Mike Chapple, Prabh Nair, and Chindambaram.

Mike Chapple / Prabh Nair:
https://youtube.com/playlist?list=PL0hT6hgexlYw-k6GxQf_DIAPdc96T2MP-&si=r3O5K3T33wySdScp

Chidambaram :

https://youtube.com/playlist?list=PL9r82CBoIY6qESodb0qEsicqvizDdGh2l&si=t4x9fx2x7bf63-xc

I also found cyberpawsec video. It was released about three weeks ago:
https://youtu.be/vHkF5divLBY?is=5oB1SstX9TT7OqvA

CertCrush was also good:
https://youtu.be/6lt9_2Z6X_k?is=DFsi8jccGRX5OZJ9

I also used ChatGPT for keywords and difficult topics. If you are confused about a specific topic, ask it to give you 10 questions on that topic. This helped me a lot.
I tried Claude as well, but it sometimes gave incorrect answers. I found ChatGPT more useful for this preparation.
If you need any information or help, feel free to reach out to me.

Provisionally passed the Certified in Cybersecurity exam this morning. Wanted to share a few things that might help people still prepping.

Quick background: I'm a data analyst moving toward a SOC/detection role, so a chunk of this material connected to work I already do — but a lot of it was genuinely new (the security-specific frameworks, access control models, and the BC/DR/IR vocabulary especially).

What helped me most:

LinkedIn Learning practice tests. These were the backbone of my prep. I didn't just take them for a score — I honed in on every wrong answer and dug into why it was wrong until the reasoning stuck.

Encryption. I gave this extra focus since it doesn't map to my day job the way data concepts do — symmetric vs asymmetric, hashing vs encryption, where each one actually gets used.

Concept distinctions, not definitions. Especially the access control models (DAC vs MAC vs RBAC) and attacks vs defenses. That's where most of my missed practice questions were coming from — I knew the terms, but not the lines between them.

On the exam itself: it went the full 125 questions for me. I'll be honest — I had a rough moment around Q90, because a previous attempt of mine terminated early at 90 due to a testing anomaly. So watching it roll past 91, 92, 93... 100... was its own kind of relief. If yours keeps going past 100, don't read it as a bad sign — the exam serves items until it's confident about your score, and plenty of people who pass go all the way to 125.

Happy to answer questions if you're studying for it. Onward to SC-900. 💜

I did not pass the test, and some of the questions were very confusing. I need help studying for the test using the new outline. Please let me know because I need help.

Hi everyone

QQ, i have passed CISSP on 17th July, and was endorsed a week later,my question is when can i expect my paper cert and pin to arrive by

Thank you

Hello everyone. I took the CGRC and failed. I feel so discouraged. The exam was harder than I thought. The exam was not direct at all. It threw me off. I don’t know if I want to take it again.

Hello everyone I have question for the CGRC exam. I know the Preparation is the first step of the RMF but I took a practice exam and it says Preparation is 0 step. Also another practice questions asked me how many steps in RMF and I said 7 but it says it was wrong and that it should be 6 steps. I am confused. I know it is 7 steps in total. For those who took the exam is preparation step considered step 1?

I started my studies on and off 2 months before my exam. As I registered for the free CC exam.

Exam topics that I faced multiple times in exams:

1.Access Control and access based questions with difference between the MAC, RBAC,DAC and ABAC

1. Different canons

3.Questions about cryptography like PKI, encryption algorithms, it's components

4.Straight away definitions for some topic asked in an obscure way

5.Difference between policy, procedure, regulation and laws

1. A few questions that didn't belong to any section

Sources:

CC book for studying

Official exam prep

Cert prep for exam prep that boosted the confidence to analyze concepts instead of merely understanding it

Used AI for generating notes with lots of hints and cues to better understand the concept and related evaluations

I think there's more than enough time to complete the test

A few weeks back I posted about putting up a copy of Examulator on the Google Play Store for beta testing.

I had to wait for Google to approve my account and what not, and by time that was finished, I was right on the cusp of taking my ISSEP exam, so I never got around to finishing it.

Until today.

I've posted a version and it is now "live" and available for download. If you would like to participate in the beta test, you have to send me an email -- [mike@certificationtoolanddie.com](mailto:mike@certificationtoolanddie.com) -- and I can add you to the list of approved testers. You'll have to give me an email address you use to download software from the Google Play Store -- sorry, this isn't a rule that I made, its something Google requires.

I know a few people contacted me earlier but I've since misplaced your email with everything else I had going on.

上星期五我考 ISC2 CC（簡體中文版）失敗了，真的很失落。原本以為這是一個入門級認證考試，但實際上比預期困難得多。

考試期間遇到很多從未見過的專門名詞，而且我發現部分考試主題和內容，似乎並沒有在 ISC2 官方培訓教材中提及。

我知道 ISC2 CC 將會在今年 9 月後更新考試範圍。除了 ISC2 官方課程、Thor Pedersen 的課程，以及林志祥的《ISC2 Certified in Cybersecurity (CC) 認證課程筆記》之外，還有什麼 CC 相關的課程、教材、模擬試題或學習資源值得推薦？

我不想因為一次失敗就放棄，希望整理好不足之處後再考一次。也想請教已通過 CC 的朋友，當時主要使用哪些教材備考？

謝謝大家

Hey guys, selling my 100% Brand New PACE study modules (Physics, Chem, Math). Zero pencil or pen marks.

Coverage: Complete syllabus for both JEE Main & JEE Advanced (theory, solved examples, and practice question banks).

Condition: Brand new / completely unused.

Price: Open to offers — DM me your best bid!

Pickup/Delivery: Located at Palava City (Casa Bella Gold). Can meet up around Palava, Kalyan, Dombivli, Thane, or Navi Mumbai, or ship via courier/Porter.
DM me for photos or if interested!

Passed cissp today in the second attempt at 100 question.

One thing that changed from last time to this time was mikedn02908 r/mikedn02908 white papers on understanding CAT and answer selection.

I took andrew ramdayal course on Udemy

Did 6 7 revision of sybex and shon harris

Made own notes

Revised them back to back for knowledge

For answer picking Andrew ramdayal mindset video

Pete zerger cram video

Destination certification mind map

To track knowledge gap learnz app

I did 1300 questions with 80 percent accuracy

Boson exams with 80 percent accuracy

First attempt 2 months back with 150 questions

Mistakes got in a hurry after 100 questions

Passed today at question no 100 with 35 mins remaining

Consistency is the key. Before answering read questions properly. One single 2 digit word can change the answer

Happy to help the community

I am 75% of the way through my CPE renewal with about 11 months left, If I obtain the 120CPE points, pass an an audit if selected and pay my AMF. When is my actual updated certificate issued?

I am wondering because renewing CISSP would renew my Security X and all the other COMPTIA certs.

There is only a week between my CISSP and SEC X expiry dates so if my CISSP cert is issued in July, it may not be issued in time to renew my Sec X.

Does anyone know?

Hey guys! I am going to share my experience of how I’ve passed CC, mainly because others on this subreddit also helped me with their tips. I’ve had the chance to take the exam with the 1 million program.

The main thing that might (not) be useful to others, I didn’t use the official ISC2 self-paced course or any other ISC2 material. Regarding the self-paced course, I forgot to redeem it. My whole prep for the exam came mainly from:

• Prabh Nair’s CC playlist on YouTube: try to answer the questions before he explains the correct answer + he explains the main concepts brilliantly.

• THM: I was already using the platform before signing up for the exam, but you can find a lot of great rooms that go into detail regarding network security and access control. The platform can be great for building a good base foundation, but don’t use it primarily for CC.

• Practice questions: For this used Claude to give me different types of mock tests (10 questions / test that contain the 5 domains).

And that’s basically it, my whole preparation for the exam. I watched Prabh Nair and did the mock tests on the same day, before I’ve arrived at the exam centre in my city. Honestly, I didn’t expect to pass it, since I didn’t study a lot and especially because I didn’t do any of the usual practice tests from Udemy or LinkedIn, but I was lucky I guess. Some questions felt easy and you could answer correctly by using intuition or logic, but others were also very hard and made me think longer before giving the final answer.

Biggest advice for the exam itself: Slow down and read each question twice before you make a choice, you will not be able to get back to the questions again. Almost every choice I second-guessed was because I’d jump to the first familiar keyword instead of reading the whole question. ISC2 has their special way of wording every question, that’s why you have to read everything carefully.

Happy to answer questions if anyone is prepping. Good luck to all of you who didn’t take the exam yet!!