CCTA Exam Domains 2026: Complete Guide to All 17 Content Areas

What the 17 CCTA Domains Actually Are

If you're preparing for the Certified Counterintelligence Threat Analyst credential from McAfee Institute, the first thing to understand is where the "17 domains" actually come from. They map to content modules 02 through 18 of the published 19-module CCTA curriculum. Module 01 ("Welcome to the CCTA!") is orientation, and module 19 is the CCTA Final Board Exam itself - neither is a content domain, which is why the working list lands at 17.

It's worth being precise here: these are instructional modules used to organize the 40 hours of coursework, not a publicly verified examination blueprint with disclosed weighting percentages. McAfee Institute has not published an official breakdown of how many questions come from each module. Any allocation you see in a practice bank - including the priority guidance later in this article - is editorial judgment, not a confirmed exam weighting. For a broader orientation to the credential before diving into domains, our What Is CCTA? overview and CCTA Certification page are good starting points.

Cluster 1: OSINT Foundations & the Intelligence Cycle

Five of the 17 domains form the conceptual backbone of the certification. They establish how intelligence analysts think before they ever open a browser tab.

Domains 11 and 12 - Open Source Intelligence and Open Source Intelligence Research - circle back to this cluster later in the curriculum, reinforcing the same foundational vocabulary with applied research techniques. Treat 1, 2, 3, 11, and 12 as a connected unit when you study rather than five isolated topics.

Cluster 2: Privacy, Legal Boundaries & Lab Setup

Before touching investigative tools, candidates need to understand the legal guardrails and the technical environment analysts work inside.

These two domains are easy to underweight because they feel procedural, but they set up everything in the social media and deep web clusters that follow.

Cluster 3: Social Media Investigations & Deception Detection

This is the largest thematic cluster in the 17-domain curriculum, and it's where a lot of the practical investigative skill lives.

Because domains 6, 7, and 10 share a platform-based focus, it's efficient to study them back-to-back rather than spacing them out across your prep schedule.

Cluster 4: Deep Web Access & Advanced Searching

Two domains address where information hides and how to retrieve it efficiently.

These pair naturally with the lab setup content from Domain 5 - you'll want a safe, isolated environment configured before practicing deep web navigation techniques for the exam or in real investigative work.

Cluster 5: Mobile Forensics & Communication Platforms

Three domains shift focus to mobile devices and the apps people use to communicate and connect.

This cluster is heavily scenario-driven. Expect questions that describe a situation involving a messaging app or dating profile and ask what the correct investigative or ethical response would be.

Cluster 6: Applied Methodology & Cyber Threats

The curriculum closes its content portion by tying everything together and introducing the threat landscape.

How the Domains Show Up on Exam Day

The CCTA uses a proctored final exam, and the shared McAfee Institute exam-license overview describes assessments across its credential line as roughly 200 questions, delivered over about three hours, in true/false, multiple-choice, and scenario-based formats, with a 70% passing minimum. Because this figure comes from a shared issuer overview rather than a CCTA-specific confirmation, treat the exact question count and timing as a close estimate rather than a guarantee. If you want a deeper breakdown of how format intersects with difficulty, see How Hard Is the CCTA Exam? Complete Difficulty Guide 2026 and the specifics on CCTA Passing Score 2026: Exactly What You Need to Pass.

Scenario-based questions are especially relevant here given the content: expect situational prompts built around social media profiles, chat conversations, or dating app interactions where you have to apply the correct investigative or privacy-conscious response rather than recall a definition. The 40-hour course length describes instructional time, not the exam duration - don't confuse the two when planning your schedule.

Note also that completing the course does not automatically certify you. You still need to pass the proctored final exam, and the program lists a one-year exam license, meaning your window to sit for that exam is time-bound. For logistics around that window, check CCTA Exam Dates 2026: Testing Windows, Deadlines & Scheduling.

Which Domains Deserve Extra Prep Time

Since there's no officially published weighting across the 17 domains, prioritization here is editorial judgment based on how foundational or scenario-heavy a domain is - not a confirmed scoring breakdown.

• Foundational, hard to skip: Domain 1 (The Foundation of OSINT) and Domain 2 (The Intelligence Cycle) underpin nearly every later module.
• Scenario-dense: Domains 6, 7, 10, 14, and 15 lend themselves naturally to the situational question formats described in the shared exam overview.
• Technical/procedural: Domain 5 (lab/VM setup) and Domain 13 (mobile forensics) reward hands-on familiarity over memorization.
• Synthesis: Domain 16 (Applying Intelligence Methodologies) ties earlier concepts together and is worth reviewing last, after the others are solid.

For a more complete walkthrough of how to sequence your overall preparation - not just domain order - see our CCTA Study Guide 2026: How to Pass on Your First Attempt.

A Domain-Ordered Study Timeline

A simple way to turn 17 domains into a manageable plan is to study them in clusters rather than in strict numerical order, since several domains reinforce each other.

If you're using a timer-based method like Pomodoro blocks or spaced repetition flashcards, apply them inside each week above rather than as a generic study system - for example, spacing repetition specifically on Domain 1 and 2 vocabulary in week one tends to pay off later when Domain 16 asks you to apply those same concepts.

Who Actually Uses These 17 Domains on the Job

The domain list isn't academic - it mirrors the day-to-day work expected of counterintelligence and threat analysts in corporate security, government-adjacent contracting, fraud investigation, and insider threat units. Skills from the social media and deep web clusters map directly to due-diligence and threat-actor research, while the mobile forensics and communication app domains align with digital investigations roles. If you're evaluating whether this skill set fits your career path, our CCTA Jobs page and Is the CCTA Certification Worth It? Complete ROI Analysis 2026 article go deeper on where this credential is applied. You can also review baseline eligibility before enrolling through CCTA Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Before committing time to all 17 domains, it also helps to understand the full cost picture - course access, exam license, and any retake considerations - covered in CCTA Certification Cost 2026: Complete Pricing Breakdown.

Once you've mapped out the domains conceptually, the most effective next step is testing yourself against realistic scenario-style questions on our CCTA practice test platform rather than re-reading notes passively. Running timed sets through the practice exam engine also helps you get comfortable with the roughly three-hour pacing described in the shared exam-license overview before test day arrives.

Frequently Asked Questions