ISC2 · CISSP
CISSP (Certified Information Systems Security Professional) practice exams
The senior information-security certification — eight domains, a manager's mindset, and the highest salary ceiling on the roadmap.
Or read 15 sample questions with answers.
Try a real CISSP question
Which framework focuses on the governance and management of enterprise IT, aligning IT with business goals?
About the CISSP exam
The CISSP, from ISC2, is an advanced, experience-gated certification covering the eight domains of the Common Body of Knowledge: security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security.
It is not a hands-on technical exam. It rewards the perspective of someone who designs and governs a security programme: risk-based decisions, understanding why a control exists, and always weighing business impact. Earning the certification also requires five years of relevant paid work experience (with some reductions) and endorsement by an existing ISC2 member.
The real exam
Public information published by ISC2. A CertRidge practice exam matches this format — it is not a copy of the exam's contents.
- Format
- The English exam is Computerized Adaptive Testing (CAT): 100–150 items in up to 3 hours, with multiple choice and advanced item types. Delivered at Pearson VUE test centres.
- Cost
- Approximately 749 USD, before regional pricing and taxes.
- Scoring
- A scaled score of 700 out of 1000 is required to pass. Because the exam is adaptive, the result is pass/fail — there is no percentage reported.
- Validity
- Valid for 3 years, maintained by earning 120 continuing professional education (CPE) credits per cycle and paying the annual maintenance fee.
Practice by exam domain
CertRidge practice exams draw questions in these same proportions, from a bank of 598 CISSP questions. Open a domain for what it covers and free questions with answers.
- Security and Risk Management· 103 questions16%
- Asset Security· 64 questions10%
- Security Architecture and Engineering· 82 questions13%
- Communication and Network Security· 79 questions13%
- Identity and Access Management (IAM)· 78 questions13%
- Security Assessment and Testing· 59 questions12%
- Security Operations· 76 questions13%
- Software Development Security· 57 questions10%
Who it's for
- Experienced security practitioners moving into security management, architecture, or governance roles
- Security engineers, analysts, and consultants who need the credential that gates senior and leadership job postings
- GRC, audit, and risk professionals who need demonstrable breadth across all eight security domains
How to prepare
- Answer as a risk manager, not a technician: identify the asset and the risk, consider business impact, and choose the response a prudent, senior professional would — the 'best' answer, not merely a correct one.
- Domain 1 (Security and Risk Management, 16%) is the anchor: quantitative risk (SLE = AV × EF; ALE = SLE × ARO), due care vs due diligence, governance, and the ISC2 Code of Ethics canon order.
- Know the classic models and what they protect: Bell-LaPadula (confidentiality), Biba (integrity), the reference monitor properties, and fail-secure vs fail-safe.
- Be precise on operations: incident response order, separation of duties / job rotation / mandatory vacation, RAID levels, and full vs differential vs incremental backup restore chains.
See the free CISSP cheat sheet for a one-page domain summary, the CISSP study guide for how to plan your preparation, and the content policy for how these questions are written.
Free CISSP practice resources
- 15 free CISSP practice questionsSpread across every domain, each with the answer and an explanation for every option.
- Free 10-question diagnosticA quick, scored check of where you stand, with no account needed.
- CISSP cheat sheetThe domains and the facts that come up most, on one page.
- CISSP study guideHow to plan your preparation, week by week.
CISSP questions, answered
- How much does the CISSP exam cost?
- Approximately 749 USD, before regional pricing and taxes.
- What is the CISSP passing score?
- A scaled score of 700 out of 1000 is required to pass. Because the exam is adaptive, the result is pass/fail — there is no percentage reported.
- How many questions are on the CISSP exam?
- The English exam is Computerized Adaptive Testing (CAT): 100–150 items in up to 3 hours, with multiple choice and advanced item types. Delivered at Pearson VUE test centres.
- How long is the CISSP certification valid?
- Valid for 3 years, maintained by earning 120 continuing professional education (CPE) credits per cycle and paying the annual maintenance fee.
- What are the CISSP experience requirements?
- You need at least five years of cumulative, paid work experience in two or more of the eight CISSP domains. A four-year degree or an approved credential can count for one of those years. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it.
- How hard is the CISSP exam?
- It is an advanced exam that covers a broad set of security domains from a management and risk perspective. Because it is adaptive, the questions adjust to your answers, and the exam ends once the system is confident of your result.
- Where can I practise CISSP questions for free?
- CertRidge has a free 10-question CISSP diagnostic with every answer explained, no account needed, and 15 free sample questions with answers at certridge.com/certifications/isc2-cissp/practice-questions. All questions are original, written to the published exam objectives.