The CISSP adaptive exam: what happens in the three hours

The most common CISSP myth is that a short exam means a failed one. The exam ends when it has seen enough, and that tells you nothing about which side of the line you are on.

The format in one table

ISC2 updated the exam on 15 April 2024. Before that date, German, Japanese and Spanish candidates sat a longer fixed-form exam. Now every language uses the adaptive format and the three-hour maximum.

What "adaptive" means

Each answer changes the difficulty of the next question. Answer well and the questions get harder. Miss a few and they ease off. The system is estimating your ability, and the exam ends once it is confident of the result, after at most 150 items.

Two consequences follow.

You cannot judge your own result from the questions. Hard questions do not mean you are failing, and easy ones do not mean you are passing. They mean the system is probing where your boundary lies.

Weak areas get found. If you study only your favourite technical domains in depth, you meet questions from the others until the system has what it needs. Security and Risk Management, at 16 per cent the heaviest domain, is the one people neglect most.

Item types

Most items are multiple choice with four options. Advanced innovative items, such as drag and drop and hotspot questions, appear too. Both usually describe a short scenario and ask for the best, first or most important action.

The skill here is reading carefully and choosing between answers that are all plausible.

Pacing without a visible target

The adaptive format removes the usual comfort of counting questions left. Instead, hold a steady pace. Three hours for 150 items is 72 seconds each, so that is your ceiling at the top of the range, and many candidates finish well inside it.

A workable routine:

1. Read the last sentence first, to find the key word: best, first, most or least.
2. Read the scenario, noting who is asking and what authority they have.
3. Remove two options you can rule out.
4. Choose between the remaining two by asking what a manager would do before acting.
5. Move on. On a computerised adaptive exam you generally cannot return to earlier items, so do not carry doubt forward.

What to do about a result you cannot see

Take the exam, then do something unrelated for the rest of the day. You get an unofficial result at the test centre and ISC2 emails the official result later. If you pass, start your endorsement at once. You have nine months to complete it.

If you do not pass, the wait before another attempt depends on ISC2's current retake policy. Read it on isc2.org when you book, because third-party sites quote different figures.

Practising for a format you cannot copy

You cannot reproduce adaptivity at home. What you can do is practise the habits it rewards: steady pace, calm after a hard run and knowledge spread across all eight domains. Take two or three full timed practice exams late in your plan, and check that no domain is far behind the others.

You will probably leave the room unsure how it went, and that is normal for this format. Rest the evening before instead of revising.