10.1. Exam Strategy and Time Management
The CISSP is administered as a Computerized Adaptive Test (CAT): 125–150 questions, 3 hours, minimum 700/1000 passing score. The adaptive engine adjusts question difficulty based on your responses — every correct answer increases the next question's difficulty; every incorrect answer decreases it. You pass when the engine is statistically confident your ability is above the passing threshold; you fail when it is confident you are below.
What this means for strategy:
The exam tests judgment, not just knowledge. Questions are written at the management and senior practitioner level — you are expected to think like a CISO making decisions under uncertainty, not a junior analyst executing procedures. When two answers both seem correct, the right answer is almost always the one that:
- Addresses the root cause rather than the symptom
- Prioritizes risk management over technical solutions
- Considers the broadest scope (protects the organization, not just the system)
- Follows the sequence of operations correctly (contain before eradicate; design before implement)
Time management:
- 3 hours ÷ 150 questions = 72 seconds per question
- Do not spend more than 2 minutes on any single question — commit and move forward
- CAT does not allow returning to previous questions
The "think like a manager" filter:
| If the question asks... | The answer is probably about... |
|---|---|
| "What should you do FIRST?" | The first step in the correct process sequence |
| "What is MOST important?" | The highest-risk or highest-impact option |
| "Which is BEST?" | Addresses root cause, not symptom |
| "What should you do NEXT?" | The next step in the lifecycle/process |
| "Which is LEAST likely to..." | The option that doesn't fit the pattern |
