Question 1Threat modeling
A threat modeling team considers an attacker who signs in to a support portal with an agent's stolen password and then acts as that agent. Which STRIDE category does this threat represent?
How hard is the CISSP exam?
It is broad and it asks for judgement: eight domains, from risk and law to cryptography, networks and secure coding, tested with scenario questions where more than one answer sounds right. The adaptive format keeps every item near the edge of your ability.
| Format | Computerized adaptive test |
|---|---|
| Items | 100 to 150, 25 of them unscored |
| Time | Up to 3 hours |
| Passing standard | 700 out of 1000 scaled points |
| Experience to certify | Five years in two or more domains |
What makes it hard
- Breadth: eight domains, with Security and Risk Management the largest at 16% and no domain below 10%.
- Judgement: many items ask what a manager should do FIRST or what is BEST, so knowing the facts is not enough; you choose between good options.
- Adaptive items: after each answer the next item is picked so you have about an even chance of getting it right, so the exam feels hard throughout by design.
- No going back: once you finalize an answer it cannot be reviewed or changed.
What makes it easier
The judgement follows a few steady principles: people's safety first, senior management owns risk, follow the documented process, understand the business need before choosing a technology, and justify controls by cost. Practicing scenarios against those principles pays off more than memorizing more facts.
How it compares with Security+
Security+ tests hands-on security knowledge at an earlier career stage. The CISSP exam assumes years of experience and asks how a security leader would decide. ISC2 lists Security+ among the credentials that can count for one of the five years of experience.
Try 3 questions
Question 2Authorization mechanisms
Emergency physicians at a trauma center sometimes need records of patients not assigned to them, which normal access rules block. What is the BEST way to meet this need?
Question 3Secure network architecture design
A payment portal still accepts TLS 1.0 and 1.1 so that a few old clients can connect. The compliance team says this fails the organization's encryption standard. What is the MOST appropriate action?
Next step
Questions people ask
Can you pass the CISSP with no experience?
You can sit and pass the exam, but ISC2 certifies only with five years of experience in two or more domains. A candidate without it becomes an Associate of ISC2 and has six years to earn the experience.
What is the hardest part of the CISSP exam?
For most candidates, the judgement questions: choosing the best or first action when several are reasonable. Security and Risk Management is also the largest domain at 16% of the outline.
How long should I study?
ISC2 does not publish study hours. Take the free diagnostic, then use the study planner to share your hours across the domains by weight and weakness.