On this page
Intro
The Certified Information Systems Security Professional (CISSP) credential from ISC2 is aimed at experienced security practitioners who design, manage and oversee security programs. This guide turns the CISSP exam outline into manageable study tasks, with CertMonk as one option for reviewing what you learn. The exam scope comes from ISC2’s CISSP exam outline page; the study plan below is our suggested approach.
Exam at a glance
| Detail | CISSP |
|---|---|
| Exam | CISSP, eight domains |
| Questions | 100 to 150 items |
| Time | 3 hours |
| Format | Computerized adaptive testing (CAT), with multiple-choice and advanced item types |
| Passing score | 700 out of 1,000 points |
| Price | Check the vendor’s site for current pricing |
| Current outline | Effective April 15, 2024 |
| Next outline | A new outline takes effect April 15, 2027 |
Source: ISC2’s CISSP exam outline page, reviewed November 7, 2026.
Version update: ISC2 states that a new exam outline takes effect April 15, 2027. The current outline remains in effect until then. If your exam date falls near that change, check the ISC2 page and match your materials to the outline that applies on your test day.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Security and risk management | 16% | Set the principles, governance, law and risk thinking behind a security program. |
| Asset security | 10% | Classify information and protect it through its life cycle. |
| Security architecture and engineering | 13% | Build secure designs and choose sound cryptographic and physical protections. |
| Communication and network security | 13% | Secure network design, components and communication channels. |
| Identity and access management (IAM) | 13% | Control who and what can reach resources, and for how long. |
| Security assessment and testing | 12% | Plan and evaluate assessments, audits and testing, and report the results. |
| Security operations | 13% | Run day-to-day protection, investigations, incident response and recovery. |
| Software development security | 10% | Build security into software and the way it is created. |
Domain labels and average weights follow ISC2’s exam outline page. Use the full official exam objectives as your coverage checklist; a domain’s weight should help allocate attention without becoming a reason to skip smaller topics.
What each domain really tests
Security and risk management
This domain sets the frame for the rest of the exam. Learn the core security principles, governance structures, and how policies, standards, procedures and guidelines relate. Study risk: identification, analysis, treatment options and how leaders decide what is acceptable.
Expect the exam to reward a manager’s viewpoint. When a scenario describes a problem, ask what supports the organization’s goals, what law or ethics require and what a sensible next step is. Add notes on professional ethics, business continuity planning, personnel security and supply chain risk.
Asset security
Start with identifying and classifying information, then follow the life cycle from collection to disposal. Learn the roles that own, steward and use data, and what each is responsible for. Compare handling requirements for different sensitivity levels and what data retention and remediation mean.
Study privacy at the level of principles and responsibilities. Write a one-page summary of how an asset moves from creation to secure destruction, with the control that applies at each step.
Security architecture and engineering
Think about secure design before specific products. Review design principles such as defense in depth and least privilege, security models, and how system and hardware features support protection. Compare the kinds of cryptography by their purpose, and understand key management as a process, not just an algorithm.
Include physical and environmental security, since facility design belongs here too. Practice explaining why a design choice reduces risk and what trade-off it creates. Cover vulnerabilities in different system types, from traditional servers to cloud and embedded systems.
Communication and network security
Study network models and secure design for both wired and wireless environments. Learn how segmentation, filtering and monitoring contribute to protection, and how secure channels protect data in transit. Review network components and what each adds or exposes.
Draw a network, mark the trust boundaries and list the controls at each crossing. Then ask what an attacker could do if one control failed. This habit moves your thinking from definitions to design.
Identity and access management (IAM)
Separate identification, authentication, authorization and accounting, and study how they fit together. Compare authentication factors and the strengths of each, and learn how federation and single sign-on shift trust between systems.
Review access control models and how they match different organizational needs. Cover the identity life cycle, from provisioning through review to removal, and the ways privileged access gets managed. Write a short example of a user whose role changes, and list the access actions that should follow.
Security assessment and testing
Learn the purpose of audits, vulnerability assessments, penetration tests and security reviews, and when each fits. Study how test strategies are planned, how results are analyzed and how findings reach decision-makers.
Add security control testing, log review and metrics. A good answer here often depends on scope and authorization, so train yourself to ask what has been approved before any testing takes place.
Security operations
This domain covers the daily work. Study logging and monitoring, investigations and evidence handling, incident management, change and configuration management, and resource protection. Include backup, recovery and disaster recovery planning, and the difference between keeping services running and restoring them.
Walk through an incident from detection to lessons learned and note who is involved at each stage. Also review physical security, personnel safety and the idea of separating duties.
Software development security
Learn how security fits into software development life cycles and the common methodologies. Study secure coding practices, the kinds of weaknesses that lead to compromise and how code is reviewed and tested.
Include the security of development environments, source control and third-party components. Write what a team should check before release and what it should monitor afterward.
The coverage above is organized from ISC2’s published outline summary; the note-taking exercises are study suggestions.
A realistic 30-day study plan
Treat this as a starting schedule, not a deadline you must meet. CISSP is broad, and ISC2 states a work-experience requirement of five years of cumulative, full-time experience in two or more of the eight domains, with some allowances; check the details on its site. If you are newer to the field, treat 30 days as a review window, not a first pass.
Days 1–7: governance and risk
Save the outline and mark each topic as familiar, uncertain or new. Spend the week on security and risk management and asset security. After each session, close your notes and explain one idea aloud, using a manager’s viewpoint.
Keep a learning log with three columns: topic, misunderstanding and next action. A next action should be specific, such as comparing two risk treatments. “Study more” is too broad to help tomorrow.
Days 8–14: architecture and networks
Cover architecture and engineering, then communication and network security. Alternate reading with a session that produces something: a diagram, a comparison sheet or a written explanation. At the end of the week, revisit week one without looking at your notes first.
Reserve one session for catching up. If several concepts remain unclear, reduce the new material instead of lengthening your study days.
Days 15–21: identity and assessment
Study IAM and security assessment and testing. Use untimed practice to expose reasoning gaps, then return to the relevant topic before trying again. End the week with mixed review. Record correct guesses as uncertain knowledge. They need follow-up even though a practice score may count them as correct.
Days 22–28: operations, development and pacing
Cover security operations and software development security, then revisit your weakest domains. Add timed practice once you can explain the material without help. Because the real exam adapts, practice staying steady through questions that feel hard instead of trying to judge your score as you go.
Days 29–30: make a readiness decision
Review concise notes and remaining uncertainties. Check your exam outline version and booking details with ISC2. If important topics still feel unfamiliar, plan another week; finishing a calendar is not evidence that learning is complete.
Common mistakes and how to avoid them
- Answering as a technician instead of a manager. Ask what supports the organization’s goals and what risk decision is being made.
- Memorizing lists without relationships. Connect each concept to the domain it serves and the problem it addresses.
- Treating all domains as equal in weight. Use the weights to plan your time, but cover every domain.
- Skipping the life-cycle view. Practice following assets, identities, code and incidents from start to finish.
- Counting lucky guesses as mastery. Flag them for review alongside incorrect responses.
- Repeating a familiar set until the score rises. Return to the underlying concept and explain it without answer choices.
How to use practice questions well
Begin untimed. Read the explanation for your selected answer and for each alternative, then identify the distinction you missed. Wrong-answer explanations matter because they can reveal why a familiar term does not fit the situation being described.
CertMonk offers explanations for every answer choice, randomized practice tests, timed practice and an untimed learning mode, plus flip-card flashcards, study games and progress by exam domain. Use those tools for different jobs: explanations for reasoning, flashcards and games for recall, and domain progress to choose what to review next.
After a practice session, choose a small number of gaps to repair. Read the relevant material, write a short explanation and revisit it later. Add timed practice when the concepts feel more stable. Treat practice results as feedback about your preparation, not a prediction of your exam result.
Free practice questions
Use the free samples below to explore the format and review the explanations without a purchase.
A company planned to store customers’ payment card numbers for one-click checkout. After reviewing the risk and compliance cost, it cancels the feature and stores no card numbers at all. Which risk response has it chosen?
- ARisk mitigation, because the company has reduced the likelihood that card data is breached.
- BRisk acceptance, because the company has made a documented decision about the card-data risk.
- CRisk avoidance, because the company stopped the activity that would have created it.
- DRisk transfer, because the payment processor will now carry the risk of storing the card numbers.
Show the answer and explanation
Answer: C. Risk avoidance, because the company stopped the activity that would have created it.
Correct. Avoidance removes the risk by not undertaking the activity that gives rise to it.
Why not the others
- A. Mitigation keeps the activity and adds controls. The company has stopped the activity entirely.
- B. Acceptance means living with a risk. Here the activity, and so the risk, no longer exists.
- D. The scenario says the feature is canceled, not handed to a processor. Nothing is transferred.
Takeaway: The four responses are avoid (stop the activity), mitigate (reduce), transfer or share, and accept. Canceling the activity that creates a risk is avoidance.
A team deploys its web application to a platform as a service offering, where the provider runs the operating system and language runtime. A penetration test finds an injection flaw in the application code. Who is responsible for fixing it?
- AThe penetration testing firm, because it found the flaw and is best placed to write the code change.
- BThe customer, because in PaaS the application code and configuration are the customer’s.
- CThe provider, because a PaaS provider is responsible for every layer of security from the hardware up to the application.
- DBoth parties equally, so neither should act until the contract is reviewed to decide who pays for the fix.
Show the answer and explanation
Answer: B. The customer, because in PaaS the application code and configuration are the customer’s.
Correct. In PaaS the provider manages the platform, but the customer remains responsible for the code it deploys, its data and its application settings.
Why not the others
- A. Testers report findings. Remediation belongs to the owner of the code.
- C. That describes SaaS more closely, and even there customers keep some duties. In PaaS the application is the customer’s.
- D. Delaying the fix over contract wording leaves the flaw exploitable, and the layer at fault is clearly the customer’s.
Takeaway: Responsibility shifts with the service model: IaaS customers manage guest OS upward, PaaS customers manage their code, data and configuration, and SaaS customers manage their data, identities and settings.
Source: NIST SP 800-145: The NIST Definition of Cloud Computing
An audit of 4,000 Linux servers finds tens of thousands of SSH authorized keys, many with no known owner, some belonging to staff who left years ago and some granting root access to automated processes. What should the security manager do FIRST?
- ARotate each server’s SSH host key pair so that stolen host keys become useless.
- BInventory all authorized keys, assign owners, remove orphaned keys and bring provisioning under central management.
- CLeave existing keys in place because removing them may break automation.
- DDisable SSH keys everywhere and return to password authentication for every administrative login.
Show the answer and explanation
Answer: B. Inventory all authorized keys, assign owners, remove orphaned keys and bring provisioning under central management.
Correct. SSH keys are credentials. Discovery, ownership, removal of orphans and managed provisioning restore control.
Why not the others
- A. Host keys authenticate servers. The problem is user authorized keys, which host key rotation does not touch.
- C. Unmanaged keys of former staff are live access paths. The risk of breakage is managed through discovery and owners, not by ignoring it.
- D. Passwords are weaker and do not suit automated processes. The problem is unmanaged keys, not key authentication.
Takeaway: SSH user keys are access credentials. Inventory them, assign owners, remove orphaned keys and manage provisioning centrally.
Source: NIST IR 7966: Security of Interactive and Automated Access Management Using Secure Shell (SSH)
An access control matrix has subjects as rows and objects as columns. A security architect wants a structure that, for each user, lists every object that user may access and the rights held. Which structure is this?
- AA role definition, grouping the permissions needed for a job function across many users at once.
- BA capability list, held for each subject and naming the objects it may use.
- CA security label, assigned to each object to show its classification and compartments.
- DAn access control list, attached to each object and naming the subjects that may use it.
Show the answer and explanation
Answer: B. A capability list, held for each subject and naming the objects it may use.
Correct. A capability list is a row of the matrix: for one subject, the objects it can access and the rights on each.
Why not the others
- A. A role groups permissions for many people. It is not the per-user row of the matrix that the scenario describes.
- C. Labels support mandatory access control decisions. They do not list which objects a given user may reach.
- D. An ACL is a column of the matrix: it is stored with the object and lists subjects. The architect wants the per-user view.
Takeaway: In the access control matrix, an ACL is a column (per object, listing subjects) and a capability list is a row (per subject, listing objects and rights).
Source: NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
Ransomware is spreading through a manufacturing network. Isolating the affected segment will halt a production line worth a large sum per hour. The plant manager objects. According to good incident management practice, how should this decision be made?
- ABy the SOC analyst on duty, who can see the malware spreading and should act without consulting anyone else.
- BBy waiting until the end of the shift so production can finish before any systems are isolated.
- CBy the plant manager alone, since the production line is the manager’s responsibility and the cost falls on the plant.
- DUsing containment criteria and decision authority agreed in advance in the incident response plan.
Show the answer and explanation
Answer: D. Using containment criteria and decision authority agreed in advance in the incident response plan.
Correct. Agreeing criteria and authority beforehand, weighing spread against business impact, means a timely decision can be made under pressure.
Why not the others
- A. Analysts act within agreed authority. A decision with major business impact should follow the defined escalation.
- B. Waiting lets ransomware spread further, potentially causing far greater losses.
- C. The plant manager’s view matters, but containment for a spreading attack affects the whole organization.
Takeaway: Containment decisions balance spread against business impact; the incident response plan should define criteria and who has authority to make them.
FAQ
How many questions are on the CISSP exam?
ISC2 lists 100 to 150 items, delivered with computerized adaptive testing, according to its exam outline page.
How long is the exam?
ISC2 lists a time limit of 3 hours.
Do I need work experience first?
ISC2 describes a requirement of five years of cumulative, full-time experience in two or more of the eight domains, with some allowances for education and credentials. It also describes a path for people who pass the exam without the experience. Check its site for the current rules.
Is a new exam outline coming?
ISC2 states that a new outline takes effect April 15, 2027. Confirm which outline applies on your test date.
Is 30 days enough to prepare?
It can be a useful planning window for review, but your starting knowledge and available time decide whether it is realistic. Extend it if you cannot yet explain the domains or apply them to scenarios.
How should I decide what to revise next?
Start with concepts you cannot explain and mistakes that recur across practice sessions. Use domain weights to balance the remaining schedule, while keeping every domain on your checklist.
Next step
Try free practice questions → https://app.certmonk.app/samples
