What the CISSP exam asks you to do
The CISSP is a computer-based exam covering eight CBK domains. It assesses breadth of security knowledge and your ability to apply it to scenarios. Questions are primarily multiple-choice and may include scenario-based items that test risk-based decision-making, governance and security engineering principles under constraints.
That calls for two kinds of preparation: learn the concepts across the domains, then practise choosing the best response for an enterprise security professional. A technically possible answer is not necessarily the best one. Look for the option that addresses risk, fits governance and policy, respects legal obligations and accounts for the organisation’s constraints. Avoid choosing a tool or control simply because it sounds sophisticated.
The MySummaries examiner strip for this exam looks like this:
Check the official certification body’s website for current exam arrangements, policies and the latest outline. Do not build your plan around assumed question counts, timings or domain weightings unless the official source confirms them.
Build one board from your source material
Start with the current official outline, then gather your own course notes, books, slides and other study material. Organise the material by the eight domains, but cross-link ideas that recur across them. Risk management, for example, affects architecture, operations, identity and security assessment; it should not live in a single isolated folder.
Keep each board section narrow enough to revise. For a concept, capture its purpose, when it applies, its trade-offs and one example. Keep distinctions that are easy to confuse side by side: preventive versus detective controls, authentication versus authorisation, or risk avoidance versus risk reduction. Mark uncertain areas so you can return to the relevant source rather than turning a guess into a flashcard.
The MySummaries board for a scenario about sensitive information and control selection looks like this:
- Risk combines the likelihood of a threat exploiting a vulnerability with its impact.
- Risk owners accept or treat risk; control owners implement assigned safeguards.
- Record assumptions, business impact, treatment decision and residual risk.
- Follow approved policy and the incident-response process.
- Preserve relevant evidence and involve legal or privacy specialists when required.
- Consider life safety, legality and business impact before operational convenience.
- Classify information under the organisation's policy and assign an owner.
- Apply handling, access, retention and disposal rules to the classification.
- Least privilege limits access to what a role needs for its work.
Select controls for the stated threat, assets and constraints. Explain effectiveness, feasibility and residual risk; do not assume a particular product is required.
| Type | Purpose | Example |
|---|---|---|
| Preventive | Reduce likelihood | Access control policy and enforcement |
| Detective | Identify events | Log review and alerting |
| Corrective | Restore or limit impact | Recovery from a tested backup |
Work across the eight domains, not just your favourite topics
Use the official domain outline as your checklist. For every heading, ask: Can I explain the concept? Can I distinguish it from a nearby concept? Can I apply it to a business scenario and justify a decision?
Security and Risk Management; Asset Security
For Security and Risk Management, practise connecting threats, vulnerabilities, likelihood, impact, treatment and residual risk. Revise governance, policy, roles, ethics and legal or regulatory considerations from your materials. For Asset Security, work through ownership, classification, handling, retention and disposal. In scenarios, establish what information or other asset matters before recommending a safeguard.
Security Architecture and Engineering; Communication and Network Security
For architecture, understand security principles and how controls address the stated threats. For network security, revise the purpose and limitations of relevant architectures and controls. Practise explaining why a control fits the trust boundaries, availability needs and constraints in the scenario. A network product name alone is not a justification.
Identity and Access Management; Security Assessment and Testing
For identity and access management, distinguish identification, authentication, authorisation and accountability. Apply least privilege and appropriate access decisions to the user’s role and context. For assessment and testing, understand why an organisation assesses controls, how findings inform risk decisions and why testing must be authorised and scoped.
Security Operations; Software Development Security
For operations, revise monitoring, incident response, recovery and evidence handling. Practise sequencing actions: protect people, contain risk, preserve evidence and follow the approved process as the situation requires. For software development security, learn how security activities fit throughout development and how testing and remediation address weaknesses. In both domains, explain the intended outcome rather than reciting a tool list.
The MySummaries Must not miss core for this board looks like this:
Practise selecting and explaining the best answer
For a multiple-choice scenario, read the final question first to identify the decision being asked for. Then extract the asset, threat, constraint and decision-maker. Note whether the question asks for the first action, the best control, or a governance decision; those are different tasks. Cross out options that ignore stated policy, assume facts not given, create avoidable legal exposure or jump straight to a technical fix without addressing ownership and risk.
When two options seem plausible, compare their fit to the scenario. Ask which reduces the relevant risk while respecting the organisation’s authority, duties and practical limits. Watch for absolute words such as “always” if the scenario gives no basis for them. A balanced answer can state an assumption, describe a trade-off and identify residual risk.
Practise writing short explanations even when the question is multiple-choice. A useful structure is: context and assets; threats and vulnerabilities; risk and impact; administrative, technical and physical controls; governance and compliance; residual risk and monitoring. Use only the headings that help with the particular scenario, and put the highest-priority reasoning first.
A MySummaries marked practice answer on this topic looks like this. Its score is a preparation marker, not an official CISSP result or marking scheme:
A department has started using a personal cloud service to share sensitive business records after its approved service became unavailable. What should the security professional recommend first?
4/5Stop staff using the personal service, tell the department to use the approved process, and review the records already shared. The security team should assess the risk and make sure the department has a working approved way to share the information.
You identified unauthorised handling and the need for a viable approved alternative. The answer is risk-aware, but the immediate response should also follow the organisation's incident process and establish the scope of exposure before concluding what action is sufficient.
Missed
−State that relevant evidence should be preserved and that legal or privacy specialists should be involved if the exposure or applicable obligations warrant it.
Model answerConfirm the information involved, affected users and business impact, stating any assumptions. Follow the organisation's incident-response and data-handling policies; contain further unauthorised sharing while maintaining a suitable approved business process. Preserve relevant evidence and assess the scope and risk of exposure. Involve legal, privacy or other responsible specialists as required by policy and applicable obligations. Document the decision, address the underlying service availability problem and monitor residual risk.
That is a MySummaries paper, filled with CISSP material. Yours is written from your own notes. Start free
After reviewing a response, identify the exact reasoning you omitted. If you missed governance, do not simply reread a whole domain: find the relevant policy and decision-making notes, then answer a new scenario that tests the same distinction. If you selected a control before identifying the asset or risk, practise starting with those facts.
Use an audio review to rehearse the reasoning
Audio is useful when you need to revisit a framework away from your desk, but it should reinforce source notes rather than replace them. Choose one board section at a time. Listen for the sequence of decisions, then pause and explain the scenario in your own words. If you cannot state why the control fits, return to the source and check the missing concept.
The MySummaries lecture for this board looks like this:
Transcript · tap any word to jump there
Start with the asset and the decision the scenario is asking you to make. Identify the owner, the information or service at stake, and any constraints the question gives you. If a fact is missing, say what you are assuming rather than silently inventing it.
Next, connect the threat and vulnerability to business impact. That is the point at which you compare choices: which one reduces the relevant risk, and can the organisation implement it under its policy and operational constraints? A preventive control may reduce the chance of an event; a detective control may reveal it; a corrective control may limit the damage or support recovery. They are not interchangeable just because all three are security controls.
Finally, check governance, legal and ethical considerations. Follow the approved decision and response processes, involve the responsible specialists where needed, and explain what risk remains. A strong scenario answer is not the newest technology or the longest list of safeguards. It is a justified, feasible decision that matches the stated risk and makes its assumptions clear.
A repeatable study routine
For each study session, work through the same cycle: review one source section, reduce it to a few decision-ready notes, retrieve the key distinctions without looking, then practise a scenario. End by recording the precise gap: a concept you confused, a fact you could not retrieve, or a decision you could not justify. Revisit those gaps before spending more time on material you already handle well.
Across the week, rotate through all eight domains rather than waiting until one feels complete. Give extra practice to weak areas, but keep returning to stronger ones with mixed scenarios so you learn to identify which domain concepts apply. Periodically use a timed practice set to check whether your reasoning remains clear under pressure; treat the result as diagnostic, not as a prediction of the official exam outcome.
Before the exam, check the official body’s current candidate guidance and confirm the arrangements that apply to you. In revision, prioritise accurate concepts, policy-first reasoning and clear explanations. Your aim is not to memorise a preferred product for every problem; it is to recognise the risk, choose a defensible response and explain why it fits.
How MySummaries helps
Build a revision board from your CISSP material, then use its flashcards, written practice and examiner-voice audio to revisit the concepts and scenario decisions you need to strengthen.