Question bank
2,400items
Calibrated to ISC² objective weights. Quarterly review.
ExamCert · Monograph No. 03
May 2026 · 12 min
Monograph No. 03 · ISC² · Senior
CISSP® Practice Test 2026 — ISC² Certified Information Systems Security Professional Exam Preparation
The keys, kept. Certified Information Systems Security Professional · 2026
A monograph on preparing for the senior security practitioner's examination — eight domains, deliberate practice, and the discipline of an evening hour.
Begin reading
I.
The opening
An editor's note · CISSP 2026
The CISSP is the rare professional examination that punishes both the under-prepared and the over-prepared. The first kind walks in without scaffolding and is destroyed by the breadth of the eight domains. The second kind has memorised twelve different study guides and, faced with a scenario question that demands judgement, freezes. We built this app for a third sort of candidate — the one who treats it as a long, deliberate craft.
One purchase. Lifetime access. A refund if you fail your first attempt. No subscription, no e-mail funnel, no monthly nag.
01 Domain · Identity & Access
Identity is the new perimeter, and the perimeter is everywhere.
Federation, single sign-on, IDaaS, OAuth flows, RBAC versus ABAC, just-in-time elevation, certificate lifecycles, biometrics. The exam will not test your ability to recite definitions — it will hand you a scenario about a multi-cloud workforce and ask which control you choose first.
- Federation · SAML · OIDC
- RBAC · ABAC · PBAC
- JIT & PAM
- MFA & passkeys
- Identity governance
Domain weight · 13% · approx. 16 of 125 questions
02 Domain · Asset & Data Security
What you own, and what you owe it.
Classification schemes, data-state encryption, retention & destruction, asset inventory, residency. The senior practitioner reasons about data the way a museum curator reasons about an exhibit — provenance, custody, controlled access.
- Classification
- Encryption at rest & in transit
- DLP & CASB
- Retention policy
- Data residency
Domain weight · 10% · approx. 12 of 125 questions
03 Domain · Software & Systems
Security written, not bolted on, after the fact.
SSDLC, threat modelling, code review, supply-chain provenance, container hardening. The questions here separate the auditors from the engineers; the app makes you reason as both.
- SSDLC & SDL
- STRIDE · DREAD
- SAST · DAST · IAST
- Software composition analysis
- Container security
Domain weight · 11% · approx. 14 of 125 questions
04 Domain · Risk & Governance
The pen test does not start with packets.
Frameworks, risk treatment, third-party governance, business continuity, incident response. This is the heaviest scored domain and where most failed candidates lose; the senior practitioner thinks about probability before payload.
- NIST CSF & ISO 27001/2
- Risk treatment
- Third-party / vendor
- BCP & DRP
- IR lifecycle
Domain weight · 15% · approx. 19 of 125 questions
II.
The instrument
Practice mocks
6CAT-style
Adaptive item delivery, real exam timing, full domain mix.
Guarantee
100%
Refund of the premium upgrade if you do not pass your first sitting.
Refund window
48hours
From submission of failing score to processed refund. No interview.
Reader · Premium since 2024
A recurring premium-user story: the third mock surfaces hidden weaknesses before the real exam does, and the app reallocates question difficulty toward those domains until readiness improves. Composite premium-user pattern Drawn from CISSP holder feedback Illustrative editorial example · App Store reviews show real ratings
III.
The terms
A simple proposition
Two plans. One purchase, ever.
Starter
Sample
$0
For seeing whether the questions and the prose meet your standard.
- Three full question sets · 75 items
- Domain blueprint & reading list
- Basic readiness tracking
Lifetime · Recommended
Practitioner
$9.99 · one-time
Full bank, six adaptive mocks, weak-domain focus engine, lifetime access. Refund if you fail your first sitting.
- 2,400 calibrated items, weekly updates
- Six full-length CAT-style mocks
- Per-domain readiness analysis
- Refund-backed pass guarantee
Quick facts · at a glance
What the CISSP actually costs you.
Duration
4hrs
CAT delivery — adaptive item difficulty.
Items
125max
Engine ends early if it has enough signal.
Pass score
700/1000
Scaled across item difficulty, not raw count.
Cost
$749USD
+ $135 annual ISC² membership once certified.
IV.
The web companion
Appendix II · The web companion
Meet ExamCertAI.
A web simulator for the practitioner who lives in a browser tab between meetings. Identical question bank, identical CAT delivery — with a layer of AI-generated reasoning drawn over every answer.
Open ExamCertAIYou may also like
If CISSP is on your shelf, these belong beside it.
ISC² · Senior
CCSP — Cloud Security Professional
The cloud-native counterpart to CISSP. Many CISSPs stack both within 18 months.
ISACA · Manager
CISM — Information Security Manager
Management-tier sibling. Less technical, more governance. Strong for CISO-track careers.
ISACA · Auditor
CISA — Information Systems Auditor
Audit-tier credential. Strong for GRC and Big-4 consulting careers.
Microsoft · Architect Expert
SC-100 — Cybersecurity Architect
Microsoft's senior security cert. Zero Trust focus. Vendor-specific complement to CISSP.
Related study guides
Read before you sit.
Complete guide · 24 min
The CISSP Study Guide That Actually Works (2026 Edition)
Eight domains broken down, weighted question allocation, the canonical Sybex + AIO reading list.
Read article → Comparison · 11 minCCSP vs CISSP: Which Should You Get First in 2026?
For cloud-native security engineers, CCSP can be the better entry point. Here's how to choose.
Read article → Maintenance · 8 minHow to Maintain Your CISSP: CPE Credits Guide 2026
120 credits over 3 years. How to earn them without leaving your desk, and which conferences count.
Read article →Marginalia · Asked & answered
Honest questions, honest answers.
How long should I study for the CISSP exam?+
Most working professionals pass within 6–10 weeks of evening study (1 hour per day, 5 days per week). Plan an extra two weeks if you don't have hands-on security experience. Deliberate practice beats cramming.
What is the CISSP exam format and pass score?+
Computerised Adaptive Testing (CAT) — up to 125 questions over 4 hours. Pass score is 700/1000 on a scaled metric. Item difficulty adapts as you go; the engine may end early if it has enough signal.
Do I need 5 years of work experience before sitting?+
No. You can sit and pass the exam without the 5-year requirement and become an "Associate of ISC²" while you accrue experience (you have 6 years). A relevant 4-year degree waives one year.
How much does CISSP cost?+
$749 USD for the exam, plus $135 annual ISC² membership once certified. Maintain status with 120 CPE credits over each 3-year cycle.
Can I take CISSP online from home?+
Yes — Pearson VUE online proctoring is supported with strict environment requirements (clean room, no other monitors, continuous camera). Most senior practitioners report the test centre feels less stressful for a 4-hour exam.
What if I don't pass on the first sitting?+
We refund 100% of your premium upgrade within 48 hours of receiving your failing score report. No interview, no condition that you re-sit through our app.
How long does CISSP stay valid?+
3 years per cycle. Earn 120 Continuing Professional Education (CPE) credits across the cycle and pay annual membership. Most practitioners maintain indefinitely with conferences, blog writing, and ISC² volunteer work.
In closing
The vault opens, once you've earned the key.
Six weeks of evenings. The right questions, asked at the right time. A standard you can carry into every job interview after this one.
Other senior security practitioners
If CISSP is on your shelf, these belong beside it.
- ISC² CCSP Certified Cloud Security ProfessionalRead →
- ISACA CISM Information Security ManagerRead →
- ISACA CISA Information Systems AuditorRead →
- Microsoft SC-100 Cybersecurity Architect ExpertRead →
Testimonials, stats and pass rates shown above are illustrative editorial examples. Verified user reviews and live data are published in the App Store / Google Play listings.
Set in Fraunces & Inter Tight · Edited and printed in May 2026 by ExamCert · Monograph No. 03 · CISSP