CISSP Domains Study Guide 2026: How to Balance Eight Domains and Pass the CAT Exam in Under 100 Questions

CISSP switched from linear to Computer Adaptive Testing in 2018 and refined the algorithm in 2024. You get a minimum of 100 and a maximum of 150 questions in 3 hours. The engine estimates your ability after every question and decides whether it has enough confidence to score you. Most passers finish between question 100 and 125; extending to 150 usually indicates a borderline candidate.

Two consequences for your study: (1) you cannot go back to previous questions, so first-pass accuracy matters more than in linear exams; (2) the exam gives you HARDER questions when you are doing well, so feeling confused at question 60 is often a good sign, not a bad one. Do not panic-guess based on perceived difficulty.

ISC2 publishes exam outline weights that translate directly into study hours. For a 200 hour plan, allocate roughly:

• Security and Risk Management (16 percent): 32 hours. Governance, compliance, BCP, risk frameworks (NIST RMF, ISO 27005).
• Asset Security (10 percent): 20 hours. Classification, retention, privacy (GDPR, CCPA), data lifecycle.
• Security Architecture and Engineering (13 percent): 26 hours. Crypto primitives, secure design principles, cloud reference architectures.
• Communication and Network Security (13 percent): 26 hours. OSI layers, TLS, IPSec, SDN, zero trust network access.
• Identity and Access Management (13 percent): 26 hours. Federation, SAML, OIDC, privileged access management.
• Security Assessment and Testing (12 percent): 24 hours. Pentest types, audit logs, KPIs and KRIs.
• Security Operations (13 percent): 26 hours. Incident response phases, forensics, DR, monitoring.
• Software Development Security (10 percent): 20 hours. SDLC integration, OWASP Top 10, DevSecOps.

CISSP tests thinking like a security manager, not a hands-on engineer. The exam repeatedly punishes candidates who choose the technically strongest control over the one that a manager would prioritise: risk assessment before mitigation, policy before technology, communication before technical fix.

Rule of thumb: when two answers look right, pick the one that a CISO would tell the board about. If the scenario asks what to do FIRST after a breach, the answer is almost never rebuild the server; it is contain, notify stakeholders per the incident response plan, and preserve evidence.

This is the median plan that ISC2 endorsed instructors report works for full time working professionals.

• Month 1: Read the Official Study Guide (OSG) domains 1 to 4. 40 chapter-end questions daily.
• Month 2: OSG domains 5 to 8. Watch Kelly Handerhan or Larry Greenblatt video series for concepts that did not stick.
• Month 3: Full re-read of weakest 3 domains. Do 500 practice questions from Boson or the Official Practice Tests book.
• Month 4: Weekly 125 question simulators. Debrief EVERY wrong answer. Book exam for last week.

The single closest to the real exam is Boson ExSim. The Official Practice Tests book (Sybex) is easier and better for concept reinforcement. Avoid free brain dumps; the CAT question pool is heavily rotated and outdated leaks will hurt you.

Target 80 percent on Boson before booking. If you plateau at 70 percent, the gap is usually the manager mindset, not knowledge - review questions where you picked the technically correct but management-wrong answer.

Passing the exam makes you an Associate of ISC2. You have 6 years to accumulate 5 years of paid full time experience in 2 or more of the 8 domains, then apply for endorsement by another ISC2 certified professional. A relevant 4 year degree or approved cert (CISA, CISM, CCSP, etc.) waives 1 year of experience.

Endorsement typically takes 4 to 6 weeks. Random audits check documented job responsibilities so keep JD screenshots and manager contact details ready.