CISSP Exam Overview
What to Expect
The Certified Information Systems Security Professional exam costs $749 USD This is among the most expensive IT certification exams. The price reflects the exam's prestige and the professional level it targets. You'll face 125 questions in 180 minutes, giving you roughly 1 minute and 26 seconds per question. Scaled score with a passing threshold of 700 out of 1000. The CAT format adjusts question difficulty based on your responses. Getting harder questions is actually a good sign.
Prerequisites and Audience
Five years of cumulative paid work experience in two or more of the eight CISSP domains. A four-year college degree or approved credential waives one year. You can pass the exam first and become an Associate of ISC² while gaining the required experience. Security managers, directors, executives, and senior security practitioners. CISSP is not for entry-level professionals; it's designed for people who make security decisions, manage security programs, and understand risk at an organizational level.
Staying Certified
Three-year cycle requiring 120 CPE credits (minimum 40 per year) plus a $125 annual maintenance fee. CPEs can be earned through training, conferences, teaching, volunteering, and self-study.
Recent Changes
Updated in April 2024 to use CAT format in all languages (previously only English). The exam is now 100 to 150 questions in three hours, down from 125 to 175 questions in four hours. The adaptive format means the exam ends once it has enough statistical confidence in your ability.
CISSP What the Exam Tests
Eight domains: Security and Risk Management (16%), Asset Security (10%), Security Architecture (13%), Communication and Network Security (13%), Identity and Access Management (13%), Security Assessment and Testing (12%), Security Operations (13%), and Software Development Security (10%). The exam uses Computerized Adaptive Testing in all languages.
Security and Risk Management
Security and Risk Management accounts for 16% of questions. While not the heaviest domain, it can make the difference between passing and failing. Don't neglect it.
Communication and Network Security
Communication and Network Security accounts for 13% of questions. While not the heaviest domain, it can make the difference between passing and failing. Don't neglect it.
Identity and Access Management (IAM)
Identity and Access Management (IAM) accounts for 13% of questions. While not the heaviest domain, it can make the difference between passing and failing. Don't neglect it.
Security Architecture and Engineering
Security Architecture and Engineering accounts for 13% of questions. While not the heaviest domain, it can make the difference between passing and failing. Don't neglect it.
Question Format
Multiple-choice and advanced innovative items (drag-and-drop, hotspot, reordering). The innovative items test application of concepts, not just recall. Every question requires thinking about what a security manager would do.
CISSP How to Prepare
Study Timeline
Most candidates need three to six months of dedicated study. This is a mile-wide exam covering eight domains of security knowledge. Even experienced security professionals find domains outside their specialty require significant study.
Top Resources
The official ISC² CISSP Study Guide (Sybex), the CISSP CBK Reference, and the Destination Certification MindMaps. Larry Greenblatt's CISSP bootcamp and Kelly Handerhan's Why You Will Pass the CISSP video are legendary community resources.
Common Mistakes
Studying like a technician when the exam wants you to think like a CISO. When a question asks about a security incident, the answer is usually about risk assessment, business impact, and management response, not which firewall rule to write. If the answer seems too technical, it's probably wrong.
Hands-On Advice
This isn't a hands-on exam in the traditional sense. Instead, practice security decision-making: read case studies of breaches and analyze what went wrong from a governance perspective. Map security controls to business objectives. Review real BCP/DRP plans. The mental shift from "how to configure" to "how to manage" is what makes or breaks CISSP candidates.
CISSP Exam Day Strategy
Testing Options
Pearson VUE testing centers and online proctoring. Given the three-hour duration and high stakes, many candidates prefer testing centers.
Time Management
The CAT format means the exam can end as early as 100 questions or continue to 150. You have three hours total. Don't rush early questions hoping to finish faster — the CAT needs consistent correct answers, especially at the start. Budget about 1.5 minutes per question.
CISSP Why Practice Tests Matter
Practice tests are the single most effective study tool for the CISSP exam. They reveal your weak domains before the real exam does, and getting questions wrong in practice is how you learn. Each practice test here mirrors the real exam format: 125 questions, timed at 180 minutes, with the same 8-domain distribution.
Don't just take practice tests and check your score. Review every wrong answer and understand why the correct option is better. For the CISSP, pay special attention to Security and Risk Management (16%) and Communication and Network Security (13%) questions since they carry the most weight.
