CISSP / EXAM GUIDE Know the format.
Build a plan for every question.
Understand CISSP questions, timing, and scoring so you can practise with a clear purpose.
Published by PrepForCerts · Editorial responsibility and sources
How Many Questions Are on the CISSP Exam? Understanding the CAT Format
Before scheduling your ISC2 CISSP exam, knowing exactly what you'll face is half the battle. Here's the complete breakdown of questions, timing, and what it takes to pass the CISSP certification.
The ISC2 CISSP certification from ISC2 validates your expertise in this field. This guide covers 100–150 questions across 180 minutes, the 700/1000 passing threshold, and strategic approaches for each question type. From time management to scoring mechanics, here's everything candidates need for effective exam preparation.
Plan your next step
CISSP has 100–150 questions and 180 minutes. All available languages use CAT; questions cannot be revisited. CISSP requires a scaled score of 700/1000. It is not a 70% raw accuracy target. ISC2 does not publish a fixed number of correct answers needed to pass.
- Questions
- 100–150
- Time Limit
- 180 minutes
- Passing Score
- 700/1000
- Question Types
- multiple-choice questions using Computerized Adaptive Testing (CAT)
Provider reference: CISSP requires a scaled score of 700/1000. It is not a 70% raw accuracy target. ISC2 does not publish a fixed number of correct answers needed to pass. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy
The CISSP exam uses Computerized Adaptive Testing (CAT) with 100–150 questions and a 180-minute (3-hour) maximum time limit. The adaptive engine adjusts question difficulty in real-time based on your performance — if you consistently answer correctly, questions get progressively harder; if you struggle, they get easier. The exam can end as early as question 100 once the algorithm reaches 95% statistical confidence in your ability level, either above or below the passing threshold of 700 out of 1,000.
The provider does not publish a verified first-attempt pass rate here. Use your study results and practical skills to identify gaps. The adaptive format makes the exam experience unique and unpredictable compared to fixed-length tests. Understanding how the CAT algorithm works, what the question distribution looks like across 8 domains, and how to manage your time and mindset is critical for success.
How CISSP Adaptive Testing (CAT) Works
The CAT format is fundamentally different from fixed-length exams like Security+ or CEH. Here is exactly how it operates:
- Initial calibration: The exam begins with medium-difficulty questions to establish a baseline of your ability.
- Dynamic adjustment: After each answer, the algorithm selects the next question based on your performance. CAT adapts to its estimate of your ability. The apparent difficulty or question count does not reveal whether you passed.
- Confidence measurement: The algorithm continuously calculates its confidence level in whether you are above or below the passing standard.
- Termination conditions: The exam ends when any of these conditions are met:
- The algorithm reaches 95% confidence (can happen as early as question 100)
- You reach the maximum of 150 questions
- You run out of time (180 minutes)
Critical CAT Rule: No Going Back
You cannot return to previous questions in the adaptive format. Each answer is final and directly influences the difficulty and topic of the next question. This means:
- You cannot flag and revisit questions
- You cannot change previous answers
- You must commit to each answer before moving forward
- Second-guessing is your enemy — trust your first instinct
CISSP Domain Breakdown (8 Domains)
| Domain | % of Exam | ~Questions (at the minimum length) | Key Topics |
|---|---|---|---|
| 1. Security & Risk Management | 16% | Varies by exam form | Governance, compliance, risk assessment, business continuity, ethics |
| 2. Asset Security | 10% | Varies by exam form | Data classification, ownership, privacy, retention, handling |
| 3. Security Architecture & Engineering | 13% | Varies by exam form | Security models, cryptography, physical security, site planning |
| 4. Communication & Network Security | 13% | Varies by exam form | Network architecture, protocols, secure channels, network attacks |
| 5. Identity & Access Management (IAM) | 13% | Varies by exam form | Authentication, authorization, identity federation, access control models |
| 6. Security Assessment & Testing | 12% | Varies by exam form | Vulnerability assessment, penetration testing, auditing, log analysis |
| 7. Security Operations | 13% | Varies by exam form | Incident response, disaster recovery, investigations, change management |
| 8. Software Development Security | 10% | Varies by exam form | SDLC, application security, secure coding, database security |
Study all exam domains because the exam covers the full outline. ISC2 uses an overall scaled passing standard; do not assume a separate published passing percentage for each domain.
Time Management for the CISSP CAT Exam
Plan for the full three-hour allowance and up to 150 questions. Finishing at the minimum question count does not reveal whether you passed.
Recommended Pacing
| Question Range | Target Time | Strategy |
|---|---|---|
| 1–50 | 60 minutes | Establish a steady pace, read carefully, and commit to each answer. |
| 51–100 | 60 minutes | Continue across all domains; difficulty does not reveal the result. |
| 101–125 | 30 minutes | Stay focused if the exam continues after the minimum length. |
| 126–150 | 30 minutes | Use the remaining time carefully up to the maximum length. |
This is an illustrative 180-minute pacing plan for the maximum 150 questions. CAT can finish from 100 questions onward; this plan does not predict exam length or result.
Mental Strategy
- Do not track difficulty. Many candidates try to gauge whether questions are getting harder or easier to predict their score. This is counterproductive and distracting. Focus on each question individually.
- Read the role and decision requested by the scenario. Consider business risk, impact, governance, and policy where relevant. CISSP also tests technical knowledge; a management answer is not automatically correct.
- Eliminate the obviously wrong first. Most CISSP questions have 1-2 clearly incorrect options. Narrow to the remaining 2 and choose based on the principle that best applies.
CISSP vs. Other Advanced Security Certifications
| Certification | Questions | Time | Format | Cost | Experience Required |
|---|---|---|---|---|---|
| CISSP (CAT) | 100–150 (CAT) | 180 minutes (3 hours) | CAT, all available languages | Check current provider price | 5 years (2+ domains) |
| CISM | 150 | 240 minutes (4 hours) | Fixed MC | Check current provider price | 5 years IS management |
| CISA | 150 | 240 minutes (4 hours) | Fixed MC | Check current provider price | 5 years IS auditing |
| CASP+ | Up to 90 | 165 min | MC + PBQs | Check current provider price | 10 years IT (recommended) |
| CCSP | 100–150 (CAT) | 180 minutes (3 hours) | CAT, all available languages | Check current provider price | 5 years (3 in security) |
CISSP Exam Cost and Retake Policy
| Item | Cost |
|---|---|
| First attempt | Check current provider price |
| Retake | Check current provider price |
| Waiting period after failure | 30 days (1st), 60 days (2nd), 90 days (3rd) |
| Maximum attempts per year | 4 attempts in a rolling 12-month period |
| Annual Maintenance Fee (AMF) | US$135 per year for certified ISC2 members |
| CPE credits required | 120 per three-year CISSP cycle; 40 per year is suggested |
How to Prepare for the CISSP
Study Timeline
An example study plan is 3-6 months of dedicated study depending on experience level. The CISSP covers an extremely broad range of topics across 8 domains, making it one of the most study-intensive certifications in cybersecurity.
- Experienced security professionals (5+ years): 2-3 months, 10-15 hours/week
- Mid-career IT professionals transitioning to security: 4-6 months, 10-15 hours/week
- Those near the minimum experience threshold: 6+ months with supplementary hands-on learning
Recommended Resources
- Official (ISC)² CISSP Study Guide (Sybex) — The most comprehensive single resource covering all 8 domains.
- CISSP All-in-One Exam Guide (Shon Harris / Fernando Maymí) — Deeper technical coverage, excellent for engineers.
- Destination Certification MindMap videos — Free YouTube series that maps concepts visually across domains.
- Boson practice exams — Considered the closest match to real CISSP question difficulty and format.
ISC2 CISSP Exam Structure Overview
The ISC2 CISSP exam is designed to thoroughly assess your knowledge and skills. Here's the complete breakdown of what you'll face:
Total Questions: 100–150 Time Allowed: 180 minutes Passing Score: 700/1000 Number of Exams: 1
ISC2 exams are delivered at authorized Pearson VUE testing centers; check current registration and accommodation rules. The questions are designed to test both theoretical knowledge and practical application of concepts.
Types of Questions You Will See
The ISC2 CISSP exam includes multiple-choice questions using Computerized Adaptive Testing (CAT). Understanding each question type helps you prepare effectively:
Multiple-Choice Questions (MCQ) The majority of questions are traditional multiple-choice with four answer options. Select the response required by the current item; you cannot revisit it after continuing.
Adaptive Testing (CAT) The ISC2 CISSP uses Computerized Adaptive Testing, which adjusts question difficulty based on your performance. CAT adapts to its estimate of your ability. The apparent difficulty or question count does not reveal whether you passed. This allows the exam to accurately assess your competency in fewer questions.
Question Distribution by Domain
Questions are distributed across all exam domains based on their weight in the exam objectives. Higher-weighted domains have more questions. Review the official exam objectives to understand the percentage breakdown for each domain.
Time Management Strategy
With 100–150 questions in 180 minutes, time management is critical. Here's how to approach it:
Budget for the full 180 minutes. At the maximum 150 questions, this is 72 seconds per question on average. The exam may end after 100 questions. You cannot revisit answers; pace yourself on the current question.
Pacing strategy for CAT: Answer one question at a time. Read the scenario, eliminate weak options, and commit before continuing. Check the remaining time at intervals and budget for up to 150 questions in 180 minutes. There is no second pass or final answer review.
Don't Get Stuck
CAT requires a final answer before moving on. You cannot flag a question for a later pass; use your time to reason through the current item. Spending too much time on difficult questions can prevent you from answering easier questions you know well.
Scoring and Passing Requirements
Understanding how ISC2 CISSP scoring works helps you set realistic goals:
Adaptive scoring: CAT estimates ability using the exam responses. CISSP requires 700/1000 on a scaled score. This is not 70% raw accuracy. ISC2 publishes no fixed number of correct answers or mistakes allowed. Question count or perceived difficulty does not reveal pass or fail.
Understanding the passing standard: CISSP requires a scaled score of 700/1000. It is not a 70% raw accuracy target. ISC2 does not publish a fixed number of correct answers needed to pass.
Score Report
After the exam, you receive a score report showing your performance by domain. If you don't pass, this report helps identify weak areas for focused study before your retake. Use the available report feedback to identify study topics; it is not a raw percentage breakdown.
How to Prepare for 100–150 Questions
Preparing for 100–150 questions across all domains requires a strategic approach:
1. Master the Exam Objectives Every question is tied to the official exam objectives. Get the current objectives from ISC2 and use them as your study checklist.
2. Practice with Realistic Questions Complete at least 500+ practice questions before your exam. Focus on questions that match the exam format, including multiple-choice questions using Computerized Adaptive Testing (CAT).
3. Time Your Practice Exams Take full-length practice exams under timed conditions. This builds stamina and helps you calibrate your pacing for the real exam.
4. Focus on Weak Domains Use practice test results to identify domains where you score below 80%. Concentrate additional study time on these areas.
5. Understand, Don't Memorize With 100–150 questions covering diverse scenarios, memorization alone won't work. Focus on understanding concepts so you can apply them to novel situations.
More study tips
ISC2 exams emphasize risk management and governance. Understand the "why" behind security controls.
Focus on understanding frameworks and policies, not just technical solutions.
Read the role and decision requested by the scenario. Consider business risk, impact, governance, and policy where relevant. CISSP also tests technical knowledge; a management answer is not automatically correct.
With CAT format, you cannot go back to previous questions. Read each question carefully before answering.
Mistakes to check
Not practicing with realistic scenario-based questions that mirror exam difficulty.
Failing to manage stress and mental fatigue during lengthy exams.
Ignoring the "soft" skills and governance aspects that advanced certs emphasize.
Approaching the exam as a technical test when it often emphasizes management and strategy.
Over-relying on deep technical knowledge without understanding broader organizational context.
Underestimating the length and intensity of advanced certification exams.
Ready to Practice ISC2 CISSP Questions?
Test your knowledge with CISSP practice questions. Practise the tested concepts and identify areas for improvement.
CISSP vs Security+: which fits your next step?
Security+ covers core security concepts and can suit an earlier stage of study. CISSP covers broader security and management responsibilities and requires qualifying experience for certification. Use Security+ to build a foundation; consider CISSP when your work and goals call for wider security decisions.
CISSP uses CAT with 100–150 questions in three hours. Security+ uses multiple-choice and performance-based questions. The two score scales cannot be compared as raw pass percentages.
Frequently Asked Questions
What's the exact number of questions on ISC2 CISSP?
The ISC2 CISSP exam features 100–150 questions. You have 180 minutes to complete all questions. Note that some exams include unscored beta questions being tested for future use.
Does CISSP include unscored questions?
ISC2 may include unscored "beta" or "pilot" questions for future exam development. Since you can't identify which questions are unscored, treat every question as if it counts toward your final CISSP score.
What question formats does CISSP use?
The ISC2 CISSP exam includes multiple-choice questions using Computerized Adaptive Testing (CAT). Expect a mix of single-answer and multiple-response formats. Some questions require selecting multiple correct answers, which will be clearly indicated.
How many minutes do I get for CISSP?
Budget for the full 180 minutes. At the maximum 150 questions, this is 72 seconds per question on average. The exam may end after 100 questions. You cannot revisit answers; pace yourself on the current question.
Does CISSP allow reviewing previous questions?
No. ISC2 CISSP uses Computerized Adaptive Testing (CAT), which requires answering each question before moving on. You cannot return to previous questions.
What's the minimum passing score for ISC2 CISSP?
CISSP requires a scaled score of 700/1000. It is not a 70% raw accuracy target. ISC2 does not publish a fixed number of correct answers needed to pass.
What's the margin for error on CISSP?
CISSP requires a scaled score of 700/1000. It is not a 70% raw accuracy target. ISC2 does not publish a fixed number of correct answers needed to pass.
Is every CISSP exam different?
Yes, ISC2 CISSP draws questions from a large pool and randomizes order. An exam form can vary, but do not assume every question will be new. Prepare against the objectives instead of memorizing earlier items. This prevents memorization of specific question sequences.
How many questions are on the CISSP exam?
The CISSP CAT exam has 100–150 questions. The adaptive engine determines the exact number based on your performance — it can end as early as question 100 once the algorithm reaches 95% confidence.
What is the CISSP passing score?
700 out of 1,000. Due to the adaptive format, this represents consistent performance above the competency threshold across all 8 domains.
How does CISSP adaptive testing work?
The CAT algorithm selects each question based on your previous answers. CAT adapts to its estimate of your ability. The apparent difficulty or question count does not reveal whether you passed. The exam ends when the engine reaches 95% statistical confidence.
Can you go back on CISSP questions?
No. The adaptive format does not allow you to return to previous questions. Each answer is final.
How long is the CISSP exam?
180 minutes (3 hours) maximum. Many candidates finish in 2-3 hours if the adaptive engine reaches a confident determination.
Does finishing at the minimum length questions mean I passed?
Not necessarily. Finishing at the minimum length means the engine made a confident determination — which could be either pass or fail.
How much does the CISSP exam cost?
$749 USD per attempt, with a mandatory 30-day waiting period after failure.
What are the CISSP experience requirements?
5 years of cumulative paid work experience in 2 or more of the 8 CISSP domains. A 4-year degree or approved credential can waive 1 year.
Practice CISSP Questions
Prepare for the CAT format with adaptive-style practice tests covering all 8 domains.
Start Free Practice Test →Related Resources
Related CISSP resources
Practice and exam format
- Free ISC2 CISSP Practice Test
Test your knowledge with realistic exam questions.
- Official SSCP exam format
How many questions
Study and requirements
- What Is CISSP?
Complete certification overview and career benefits.
- CISSP Study Guide
- What If I Fail CISSP?
If you fail
- How to Pass ISC2 CISSP
Study strategies and exam tips.
- CompTIA A+ Exam Objectives Explained (2026 Domain Guide)
Exam objectives
- CompTIA Network+ Exam Objectives & Domains (2026)
Exam objectives
- CISSP Without Experience: 2026 Guide
Without experience
Renewal and next steps
- Does CISSP Expire?
CISSP renewal requirements and validity period.
Does it expire?
- Is CISSP Worth It?
Worth it?
- CISSP Career Path
Career path