CISSP cheat sheet · start here
CISSP Exam Strategy, Brain Dump & Mnemonics
How to read and answer CISSP questions, the sequences worth writing down in the first two minutes, and the disguised words the exam uses for each step.
The exam pattern (current outline, effective 15 April 2024)
| Format | CAT (Computerized Adaptive Testing): difficulty adjusts to your answers. |
|---|---|
| Questions | 100 to 150, including 25 unscored pretest items you cannot identify — treat every question as real. |
| Time | Up to 3 hours — about 1.2 minutes per question at 150. |
| Passing | 700 / 1000 scaled score. |
| Go back? | No. You cannot skip, flag or return. Confirm each answer once and move on. |
| Stops when | The engine is statistically confident you are above or below the standard (can be at 100), or at 150 / time-out. Stopping at 100 means nothing either way. |
| Domain weights | D1 16% · D2 10% · D3 13% · D4 13% · D5 13% · D6 12% · D7 13% · D8 10%. |
The answer method — use it on every question
| Step | Ask yourself |
|---|---|
| 1. Role | Who am I? CISO/manager → strategic answer (assess, policy, programme). Engineer asked for a specific control → technical answer. |
| 2. Keyword type | FIRST = order · NEXT = step after · JUST FINISHED = step before · BEST = most complete / root cause · PRIMARY = main purpose · MOST = degree · LEAST / NOT = flip it, find the odd one out. |
| 3. Goal word | Secret → confidentiality · not altered → integrity · up/running → availability · deny/prove → non-repudiation. |
| 4. Constraints | The stem has 2–3 conditions (secure + low effort + no new hardware)? The answer must satisfy ALL of them. |
| 5. Eliminate | Absolutes (guaranteed, ensure all, never, tamper-proof) · factual errors (“AES is asymmetric”) · combo options · “strongest” when the stem asks for “appropriate”. |
| 6. Pick | The option whose key word matches the GOAL, not the background (ignore “Top Secret”, “payment card”, job titles). |
Think like a manager — 5 rules
- Human life first, always, in any disaster, fire or incident question.
- Assess before you act: risk assessment, gap analysis and due diligence come before buying tools or changing configurations.
- Management decides risk: security advises; the owner / senior management accepts risk, approves notification and approves launches.
- Follow the process: IR plan, change management, HR policy, exception process. Never act personally or secretly.
- Cost-effective: a control should never cost more than the loss it prevents.
- Balance rule: a named attack + “BEST control” → a direct technical control (account lockout, MFA, IDS). A behaviour problem with no rule yet → policy first → training → enforcement.
One scenario, four keywords (staff keep falling for phishing)
| Keyword | Answer |
|---|---|
| FIRST step? | Assess why (find the awareness gap) |
| BEST long-term fix? | An ongoing awareness programme with phishing simulations |
| PRIMARY purpose of training? | Change user behaviour / reduce human risk |
| LEAST effective? | A one-time poster |
Brain dump — write these on the noteboard in the first 2 minutes
| Flow | Order | Mnemonic |
|---|---|---|
| NIST RMF (800-37) | Prepare → Categorize → Select → Implement → Assess → Authorize → Monitor | Pyaar Ki Sabse Important Aadat: Aankh Milana |
| Risk assessment (800-30) | Threats → Vulnerabilities → Likelihood (ARO) → Impact (SLE) → Risk (ALE) → Communicate | Tiger Virat Laaya, Impact hua, Risk bana |
| BCP (800-34) | Policy → BIA → Preventive controls → Strategies → Plan → Test → Maintain | Pappu Bhai Pakode Seekh Pe Tal Maare |
| Incident response | Detect → Respond → Mitigate (contain) → Report → Recover → Remediate → Lessons | Dr. M teen R leta hai, phir Lesson |
| Forensics | Identify → Preserve → Collect → Examine → Analyze → Present → Decide | I Prefer Coffee Every Afternoon, Please Don’t |
| EDRM (e-discovery) | Governance → Identify → Preserve → Collect → Process → Review → Analyze → Produce → Present | Good Indians Prefer Chai, Pakode, Rasgulla, Aloo, Paneer, Puri |
| Change management | Request → Impact assessment → Approve → Test → Notify → Implement → Validate → Document | Raju Isko Aaj Test Na Karke Implement Validate Document |
| Threat modelling | Objectives → Survey → Decompose → Threats → Vulnerabilities | Office Se Daftar Tak Vapas |
| Data lifecycle | Create → Store → Use → Share → Archive → Destroy | Can Some Users Share A Disk? |
| Physical layers | Deter → Deny → Detect → Delay | Darr, Darwaza, Dekho, Der |
| Keys | Confidentiality → receiver’s PUBLIC · Signature → sender’s PRIVATE | Lock for THEM, Sign as ME |
Disguised words the exam uses for steps
| If the stem says… | It means |
|---|---|
| designation / time values / impact values / BIA | RMF Categorize |
| choose the category/type of safeguard | RMF Select |
| enactment / place into practice | RMF Implement |
| review / quantitatively explore behaviour | RMF Assess |
| credence / approval / ATO | RMF Authorize |
| metrics / ongoing watch | RMF Monitor |
| implications / consequences | NIST 800-30 Impact |
| well organised | EDRM Governance |
| locate / find | EDRM Identify |
| legal hold | Preserve |
| aggregated / gathered / central repository | Collect |
| filter / cull duplicates | EDRM Process |
| deep inspection | Analyze |
| disseminate / distribute | EDRM Produce |
| elucidation / explain to parties | Present |
| adjudicate / verdict | Decide |
| briefed management / received report | IR Report done → NEXT is Recover |
| received management approval (just finished?) | Impact assessment was the step before |
Sequence golden rules
- Always-on duties (chain of custody, documentation, monitoring) are never the “NEXT” step.
- Never jump ahead — you cannot test a plan that has not been written.
- Never step back — if the stem says a step is done, it is behind you.
- “Just finished” means look BACKWARD to the previous step.