CISSP Exam: CAT Format, Domains, Questions, Cost and Difficulty

The CISSP exam is a computer adaptive test (CAT) of 100 to 150 items in up to 3 hours, passing at 700 out of 1000, across eight domains, per ISC2. The exam fee is $749 in the Americas, and to hold the full credential you need five years of paid security experience. Pass without it and you become an Associate of ISC2.

That is the whole exam in one paragraph. The rest of this guide covers what each of those facts means for you: how the adaptive engine decides when you are done, why you will see stale numbers like "250 questions" or "125 to 175" online, how the eight domains are weighted, what the full cost and eligibility path looks like, why strong engineers fail it, and whether it is worth it at your career stage.

Last updated: September 2026.

Quick takeaways

• Format: CAT, 100 to 150 items, up to 3 hours, per ISC2. Since April 15, 2024, every CISSP exam in every language (Chinese, English, German, Japanese and Spanish) is adaptive.
• Scoring: a scaled 700 out of 1000. There is no fixed percentage you must get right, and 25 of your items are unscored pretest questions you cannot identify.
• No going back: once you confirm an answer, it is locked.
• Domains: eight, from Security and Risk Management at 16 percent down to Asset Security and Software Development Security at 10 percent each.
• Cost: $749 exam fee (Americas), $50 to reschedule, $100 to cancel, then a $135 annual maintenance fee once certified.
• Eligibility: five years of cumulative paid work in two or more domains. A qualifying degree or an approved credential waives one year.
• Difficulty: the exam rewards the security manager's answer, not the technician's fix. That, not obscure facts, is why people fail.

The current CISSP exam format, per ISC2

Attribute	CISSP (current)
Format	Computerized adaptive testing (CAT), all languages
Number of items	Minimum 100, maximum 150
Scored vs unscored	25 unscored pretest items sit inside every exam
Time limit	Up to 3 hours
Passing score	700 out of 1000 (scaled)
Question types	Multiple choice and advanced innovative items
Domains	8
Review answers?	No. A confirmed answer cannot be changed

Official source: the ISC2 CISSP exam outline and ISC2's computerized adaptive testing page.

How the adaptive engine works

A linear exam gives everyone the same fixed set of questions. A CAT starts you at a moderate difficulty and, after each answer, re-estimates your ability and picks the next item to match. Answer correctly and the next item is harder. Miss and it eases off. The engine is homing in on your true level as efficiently as it can.

The exam ends in one of three ways: the engine is statistically confident you are above or below the passing standard, you reach the 150-item maximum, or you hit the 3-hour limit. That is why one candidate finishes at 100 items and another at 147. Neither number tells you the result on its own.

Two consequences matter on test day:

• Rising difficulty is a good sign. If the questions feel relentlessly hard, the engine probably thinks you are above the standard and is pushing to confirm it. Candidates who read that as failure start to panic, which is exactly backwards.
• Do not read your fate from the item count. Picture two people who both pass. One answers the early questions cleanly and finishes at 108 items in about two hours. The other is uneven across domains, hovers near the line, and runs to 147 items. Same result, very different screens.

Pacing a variable-length exam

Three hours for up to 150 items is about 72 seconds per question, but you will not spend it evenly. Because there is no fixed finish line and no going back:

• Do not rush the opening block. Early answers shape the engine's first estimate, and you cannot return to fix a careless miss.
• Do not bank time for a final sprint. The exam may end at item 100. Answer each question deliberately and trust the engine to stop when it is ready.
• Answer every item as if it counts. The 25 pretest items are mixed in and look identical to scored ones.

PrepClubs' guide to adaptive versus static tests covers the general skip-and-guess logic, and the short version for the CISSP is simple: you cannot skip, so first-pass accuracy is the whole game.

How the CISSP format changed over time

Search "how many questions is the CISSP" and you will find 250, 125 to 175, and 100 to 150. Each was true once. Stale pages preserve every version.

Period	Format	Items	Time
Before December 2017	Linear (fixed form), all languages	250	Up to 6 hours
December 2017 to May 2022	CAT in English, linear elsewhere	100 to 150 (English)	Up to 3 hours (English)
June 1, 2022 to April 14, 2024	CAT in English, linear elsewhere	125 to 175 (English)	Up to 4 hours (English)
April 15, 2024 onward	CAT in all languages	100 to 150	Up to 3 hours

So "250 questions over 6 hours" is the retired linear exam, which non-English candidates took until April 2024. "125 to 175 in 4 hours" is the June 2022 change, when ISC2 doubled the unscored pretest items from 25 to 50. Both are gone. If a study guide tells you to prepare for either, it is out of date. The current numbers come from the ISC2 outline: 100 to 150 items, 3 hours, every language.

The 8 CISSP domains and their weights

The current outline has been in effect since April 15, 2024.

#	Domain	Weight
1	Security and Risk Management	16%
2	Asset Security	10%
3	Security Architecture and Engineering	13%
4	Communication and Network Security	13%
5	Identity and Access Management (IAM)	13%
6	Security Assessment and Testing	12%
7	Security Operations	13%
8	Software Development Security	10%

The gap between the largest domain and the smallest is six points. That is the "mile wide, inch deep" reputation in numbers: you cannot pass by being excellent at two domains, because even the largest is about a sixth of the exam. The 2024 refresh was small. Domain 1 rose from 15 to 16 percent and Domain 8 fell from 11 to 10 percent. If a guide shows 15 and 11, it predates April 2024.

What each domain covers

• 1. Security and Risk Management (16%): governance, compliance and legal issues, the ISC2 Code of Ethics, policies and standards, risk identification and response, threat modeling, business continuity and awareness. It is the heaviest domain and the risk-based logic behind the correct answer in every other one.
• 2. Asset Security (10%): classification, ownership and roles, retention and destruction, and the controls that protect data at each stage of its lifecycle.
• 3. Security Architecture and Engineering (13%): secure design principles, security models, cryptography, physical security and system capabilities. Many candidates rate it the hardest because of the crypto and the abstract models.
• 4. Communication and Network Security (13%): secure network architecture, secure channels, network components and protocol security.
• 5. Identity and Access Management (13%): identification, authentication and authorization, the identity lifecycle, access control models such as RBAC and ABAC, and federation.
• 6. Security Assessment and Testing (12%): test strategies, control testing, security process data, analyzing results and audits. It is about proving security works, not building it.
• 7. Security Operations (13%): investigations, logging and monitoring, incident management, patch and vulnerability management, and disaster recovery.
• 8. Software Development Security (10%): security in the development lifecycle, secure coding, assessing software security and the risk of acquired software.

Turning the weights into a study budget

If you have 40 focused hours left, spread them roughly like this: about 6.5 hours on Domain 1, about 5 hours on each of the 13 percent domains and Domain 6, and about 4 hours each on Domains 2 and 8. Give Domain 1 the most time, and do not skip a small weak domain. On an exam where the margin is thin, an ignored 10 percent domain is a block of lost marks. The full weighted plan is in our CISSP practice test and study plan guide.

What the CISSP costs, and the fees people miss

Cost item	Amount	Notes
Exam registration (Americas)	$749	One attempt. Regional pricing applies elsewhere
Retake	$749 each	No free retake
Reschedule	$50	Per ISC2
Cancellation	$100	Per ISC2
Annual Maintenance Fee (CISSP)	$135 per year	Starts once you are certified. One AMF covers all your ISC2 certifications
Annual Maintenance Fee (Associate)	$50 per year	While you earn the experience

Sources: ISC2's exam management page and AMF overview. Once certified, you also need 120 CPE credits per three-year cycle.

A self-study candidate who passes first time is looking at the $749 fee, study material and the first $135 AMF. The biggest lever on total cost is not a discount code. It is passing the first time, because a resit is another full $749.

Eligibility: the five-year rule and the Associate path

To hold the CISSP, ISC2 requires five years of cumulative, full-time paid work experience in two or more of the eight domains, per its experience requirements page. A few details matter:

• One-year waiver. A bachelor's or master's degree in computer science, IT or a related field, or a credential on ISC2's approved list, can satisfy one year. Only one waiver applies. ISC2 revised that approved list on April 1, 2026, so check the current version before you count on it.
• Part-time work counts. Part-time work of 20 to 34 hours a week counts pro rata (1,040 hours equals six months), and documented paid or unpaid internships are accepted.
• You can sit the exam first. The experience rule is for certification, not for the exam. Pass without it and you become an Associate of ISC2, with six years to earn the five years of experience.
• Endorsement. After passing, an active ISC2 member in good standing must endorse your experience within nine months. ISC2 can act as the endorser if you do not know one.

How hard is the CISSP, really?

It is hard, but not because the facts are obscure. Most of the material is familiar to anyone who has worked in security for a few years. It is hard for three reasons.

1. It wants the manager's answer. The exam is written for someone who owns a security program. Several options are often technically defensible, and the correct one follows sound risk process: understand the impact, assess, then act, and leave decisions with the accountable owner.
2. It is broad. Eight domains, none above 16 percent, all fair game. A strong domain cannot carry a weak one.
3. It adapts. The questions get harder as you do well and there is no going back, so it never settles into a comfortable rhythm.

ISC2 does not publish an official pass rate, so treat any "X percent pass" figure online as an estimate, not a fact.

Why technical people fail: three real practice questions

These come verbatim from PrepClubs' CISSP bank. Each tests the same instinct: assess or escalate before you act.

From PrepClubs CISSP Practice Test 1, question 11 (Domain 1):

A newly appointed security officer discovers that a legacy application handling customer data has never been formally risk assessed. What should the officer do FIRST?

A. Shut the application down until it can be fully secured B. Encrypt the application's database as a compensating control C. Perform a risk assessment and report residual risk to management D. Report the finding to the board of directors as a confirmed breach

Answer: C. The officer does not yet know the application's real exposure or how critical it is to the business, so the first step is a risk assessment, with residual risk reported to management, who own the decision. Shutting it down (A) could do more damage than the unknown risk. Encrypting the database (B) guesses at the exposure. A missing assessment is not a breach (D).

From PrepClubs CISSP Practice Test 1, question 8 (Domain 1):

An organization is starting a business continuity program. Which activity should be completed FIRST to ensure the resulting plans are driven by actual business impact?

A. Contract an alternate processing site for IT recovery B. Draft disaster recovery runbooks for the data center C. Purchase business interruption insurance for key products D. Conduct a business impact analysis of critical functions

Answer: D. The business impact analysis identifies critical functions, dependencies and recovery objectives such as RTO and RPO. The alternate site, the runbooks and the insurance all have to be sized against those findings, so they come later.

From PrepClubs CISSP Practice Test 1, question 14 (Domain 1):

During an annual risk review, a business unit head wants to formally accept a residual risk that exceeds the organization's documented risk appetite. What is the BEST course of action for the security manager?

A. Let the business unit head sign the acceptance themselves B. Escalate the acceptance to the senior risk owner for decision C. Refuse the acceptance and mandate a specific technical control D. Record the risk as accepted and close it in the register

Answer: B. A risk above the documented appetite is beyond what a unit head is delegated to accept, so it goes to the senior risk owner. The security manager advises and escalates. Mandating a control (C) oversteps that role, and quietly closing the risk (D) hides it from the people accountable for it.

Almost every strong engineer's instinct on questions like these is to fix, block or shut down. The CISSP keeps rewarding the person who assesses, informs the owner and follows the process. Once you see that pattern, questions that felt like tricks start to make sense.

Difficulty depends on who you are

• Security managers and GRC professionals usually find the framing natural. Their work is filling breadth gaps.
• Strong technical engineers know enough content but must unlearn the fix-it-first reflex. They need scenario practice with rationales more than more reading.
• Newer professionals face the eligibility gate first and then the full breadth, so they need the most time.

Is the CISSP worth it?

For a mid-career security professional with the experience behind it, usually yes. For a beginner, usually not yet, because the credential waits for the five years regardless of how well you study.

Career stage	Worth it now?	Why
No security experience	Not yet	You can only hold the Associate title. Security+ opens entry-level doors faster
1 to 3 years in security	Sometimes	Sit the exam early, hold the Associate title, certify later
4+ years, individual contributor	Usually	You meet or nearly meet the rule, and it opens senior roles
Management track	Strong yes	CISSP is often a listed requirement for security lead and manager roles
Established manager or CISO track	Yes	Close to a baseline credential at this level

Reported CISSP salaries in the US cluster in six figures, but be careful with cause and effect: holders are experienced by definition. The clearest value is access. It keeps you out of the auto-reject pile for senior roles that list it. If you are earlier in your career, see how it compares with Security+ and ISACA CISA in CISSP vs CISA vs Security+, and start with the Security+ practice test guide or the full CompTIA certifications list.

How the format should shape your preparation

• Build breadth first. The engine draws from all eight domains. Consistent competence beats a spike in one area.
• Practice committing. Work timed sets where you cannot go back, so locking an answer feels normal.
• Read every rationale, including on questions you got right. Getting a CISSP question right for the wrong reason is a trap that the adaptive engine will find.
• Get used to hard questions. Practice at a level that pushes you, so rising difficulty on the day feels routine.
• Rehearse the full 3 hours. A 125-question timed set builds the stamina a long adaptive run demands.

FAQ

How many questions are on the CISSP exam?

Between 100 and 150 items, per ISC2. The exact number varies because the adaptive engine ends the exam once it is confident of your result. Twenty-five of the items are unscored pretest questions you cannot identify.

How long is the CISSP exam?

Up to 3 hours, in every language, per ISC2. It can end earlier if the engine reaches a confident decision.

What is the CISSP passing score?

700 out of 1000, a scaled score. Because it is scaled and adaptive, there is no fixed percentage of questions you must get right.

Is the CISSP still 250 questions and 6 hours?

No. That was the linear format, which non-English candidates took until April 15, 2024. Every CISSP exam is now a CAT of 100 to 150 items in up to 3 hours. The "125 to 175 items in 4 hours" figure is also retired; it applied from June 2022 to April 2024.

Can you go back to previous questions on the CISSP?

No. Once you confirm an answer, it cannot be reviewed or changed, per ISC2.

How much does the CISSP cost?

$749 for the exam in the Americas, with regional pricing elsewhere. Rescheduling costs $50, cancelling costs $100, and certified members pay a $135 annual maintenance fee.

Can I take the CISSP without five years of experience?

Yes. Pass without it and you become an Associate of ISC2, with six years to earn the experience and convert to full CISSP.

Which CISSP domain is the hardest?

Many candidates name Domain 3, Security Architecture and Engineering, because of the cryptography and abstract models. Your own weak domains are what matter, so find them with a diagnostic before you plan your hours.

Related on PrepClubs

• CISSP practice test, question strategy and study plan: how to read BEST and FIRST questions and a domain-weighted plan.
• CISSP vs CISA vs Security+: which security or audit certification fits your career.
• Security+ practice test: the entry-level certification most people hold before the CISSP.
• CompTIA certifications list: where CompTIA's certifications sit below the CISSP.

Prepare for the exam you will actually sit

The CISSP rewards steady, careful, manager-minded answers across all eight domains, under an engine that gets harder as you improve. PrepClubs' CISSP track is built for that: a 25-question diagnostic to find your weak domains, then 10 full-length practice tests of 125 original scenario questions each, weighted to the current outline, with a written rationale on every answer explaining why the best option beats the plausible ones. It is backed by our Money-back Guarantee, and more than 3,700 students have prepared with PrepClubs. Practice at prepclubs.com/tests/cissp.