Cyclomatic complexity when applied to testing places two bounds on the test cases needed.
From Wikipedia Cyclomatic complexity: Implications for software testing
M is an upper bound for the number of test cases that are necessary to achieve a complete branch coverage.
M is a lower bound for the number of paths through the control flow graph (CFG). Assuming each test case takes one path, the number of cases needed to achieve path coverage is equal to the number of paths that can actually be taken. But some paths may be impossible, so although the number of paths through the CFG is clearly an upper bound on the number of test cases needed for path coverage, this latter number (of possible paths) is sometimes less than M.
All three of the above numbers may be equal: branch coverage <= cyclomatic complexity <= number of paths.
For the code:
if( c1() )
if( c2() )
This has a complexity of 3. Yes, testing TT or FF is two test cases and will cover the branch coverage of the code. The Npath coverage would require four tests.
A module should have at least as many tests as its complexity.
Consider a bug that requires that f1() be called before f3(). The tests TT and FF will not uncover the bug, while the tests TF and FT will show the bug. You should have at least 3 tests for this method according to cyclomatic complexity.
Though the key point in all of this is that the complexity establishes the bounds on the number of tests needed to adiquetly test the code. It does not say what tests you need (nor if you have the right tests).