What we cover: Certification demand and career-market positioning for security roles.

Why it matters: Credential selection influences role alignment and signals baseline competency expectations in security hiring.

Exam relevance: Not directly tested; only supports understanding certification scope and role expectations referenced in workforce context items.

What we cover: The exam domain structure and how core security topics map across governance, technical controls, and operations.

Why it matters: Domain mapping supports selecting appropriate control categories and maintaining defense-in-depth across people, process, and technology.

Exam relevance: Appears as domain-to-concept alignment and scenario-based control selection across governance, asset handling, IAM, testing, operations, and secure development.

What we cover: A study approach emphasizing knowledge application, question deconstruction, best-answer selection, and time management.

Why it matters: These skills enable accurate security judgment under constraints rather than memorization.

Exam relevance: Questions test scenario interpretation, keyword-driven intent, and choosing the best control or action within time limits.

What we cover: Selecting complementary study resources using videos and books to cover the full exam objective set.

Why it matters: Multiple independent sources reduce blind spots and improve accuracy of security concept interpretation.

Exam relevance: Tested indirectly through scenario judgment requiring correct perspective and precise terminology across domains.

What we cover: Free security study resources including OWASP Top 10 and NIST special publications as reference frameworks.

Why it matters: Framework familiarity improves correct control selection and mitigation alignment across common attack and defense concepts.

Exam relevance: Tested through scenario prompts requiring identification of attack type and best mitigation using OWASP and NIST concepts.

What we cover: Practice-question strategy focused on reviewing uncertain and incorrect items and avoiding answer memorization. 

Why it matters: Targeted restudy closes knowledge gaps and improves conceptual accuracy for security decision-making. 

Exam relevance: Tested through scenario questions requiring keyword-driven option selection and distinguishing similar answers under time pressure.

What we cover: Study resource selection based on budget and learning style for exam preparation.

Why it matters: Matching materials to constraints improves coverage consistency and reduces gaps in security knowledge.

Exam relevance: Not directly tested; supports preparation strategy rather than any objective or scenario decision.

What we cover: How to structure and adapt a study plan using iterative review and practice testing.

Why it matters: A feedback-driven plan targets weak knowledge areas and improves retention through deliberate review.

Exam relevance: Tested indirectly through scenario-based selection of best answers requiring broad recall and consistent performance under timed questions.

What we cover: How to approach scenario-based practice questions using concept explanation, question deconstruction, and time management.

Why it matters: It improves control selection judgment and prevents memorization from replacing correct security reasoning.

Exam relevance: It appears as best-first-least scenario choices requiring management-oriented answers and careful reading of what is asked.

What we cover: Test-taking strategy for deconstructing questions using keywords, indicators, and answer elimination. 

Why it matters: It improves accuracy by aligning selections to stated constraints and required priority. 

Exam relevance: Appears as best or first choice items where distractors are plausible and order or precision decides.

What we cover: How to align certifications to a target security role by working backward from job requirements.

Why it matters: Role-aligned credential planning supports appropriate skill development and reduces mismatched security responsibilities.

Exam relevance: Minimal direct coverage; may appear indirectly in questions mapping job roles to security responsibilities and baseline certification scope.

What we cover: Study planning and habit formation to improve focus and consistency. 

Why it matters: Consistent, single-task focus improves knowledge retention and reduces errors from fatigue and distraction. 

Exam relevance: Appears as time-management and prioritization judgment when selecting the best next action under constraints.

What we cover: Exam administration policies including registration identity matching, unscored items, scoring scale, and rescheduling windows. 

Why it matters: Correct administrative compliance prevents denial of entry and supports ethical, professional conduct expectations. 

Exam relevance: Tested as policy and process knowledge, including recognizing unscored questions and interpreting scaled scoring versus percent-correct.

What we cover: Testing center exam-day procedures including check-in, identification verification, NDA timing, breaks, and proctoring controls.

Why it matters: Following administrative security controls prevents disqualification and preserves exam integrity and chain of custody.

Exam relevance: Appears as policy and procedure recognition questions about identification requirements, prohibited items, timing rules, and reporting misconduct.

What we cover: Exam-day logistics and proctoring rules that constrain time, materials, and conduct.

Why it matters: Preparation must align with testing constraints to preserve focus and avoid disqualification.

Exam relevance: Tested indirectly through time-management decisions and interpreting question formats under strict exam conditions.

What we cover: Computerized adaptive testing behavior including question difficulty adjustment, weighted scoring, unscored items, and answer review limits.

Why it matters: Understanding adaptive scoring constraints improves time allocation and reduces errors from second-guessing.

Exam relevance: Appears as test-taking mechanics questions requiring correct identification of adaptive rules and constraints.

CISSP CAT FAQ As of April 15th, 2024:

• 3-hour exam.

• Minimum 100 questions, maximum 150 questions (25 beta questions).

• No ability to review questions.

The ISC2 announcement: Effective Dec. 18, 2017: ISC2 will introduce Computerized Adaptive Testing (CAT) for all English CISSP exams worldwide. CISSP CAT enables you to prove your knowledge by answering fewer items and completing the exam in half the time.

Source: www.isc2.org/certifications/CISSP/CISSP-CAT

What is CAT: http://www.iacat.org/what-is-cat

What we cover: Post-exam certification lifecycle requirements including endorsement, experience validation, audits, and continuing education maintenance. 

Why it matters: Credential governance enforces verified competence and ongoing professional currency through documented experience and education. 

Exam relevance: Tested as governance and compliance knowledge, focusing on endorsement prerequisites, audit purpose, and continuing education obligations.

Each year to keep your certification current you need to earn a certain amount of CPE's.

This is what you need for the CISSP certification.

You can either do purely group A CPE's or chose to do up to 10 group B CPE's per year.

Group A Credits: Domain-Related Activities

Group A credits relate directly to the cyber security profession. Generally, this consists of activities in the areas covered by the specific domains of the respective credential.

Group B Credits: Professional Development/Knowledge Sharing

Group B credits are earned for completion of general professional development activities which enhance your overall professional skills, education, knowledge, or competency outside of the domains associated with the respective certifications. These generally include professional development programs, such as management courses. While these do not apply directly to the domains, (ISC)² recognizes these skills are vital in the growth of all professionals and their credentials.

More in-depth on how CPE's work:

ISC2 explaining how the CPE’s work

• Free CPE’s:

• ISC2 – 500+ CPE’s available (Webinar).

• SANS – 500+ CPE’s available (Webinar).

• ISACA – 100+ CPE’s available (Webinar).

• Infosecurity-magazine - 350+ CPE’s available (Webinar).

• wh1t3rabbit – 250+ CPE’s available (Podcast).

• OWASP - 100+ CPE’s available (Podcast).

• Certs.org – 200+ CPE’s available (Podcast).

• Edx.org – 250+ CPE’s available (Online training).

• Coursera – 250+ CPE’s available (Online training).

• Securitytube – 10,000+ CPE’s available (Videos).

• Youtube – 100,000+ CPE’s available (Videos).

What we cover: Retake strategy using domain proficiency feedback and disciplined test-taking technique. 

Why it matters: Targeted remediation improves knowledge retention and reduces repeated errors under time pressure. 

Exam relevance: Tested indirectly through scenario questions requiring precise reading, option elimination, and selecting best answers.