The management-level security certification — adaptive practice across the eight domains, tuned to the risk-based, think-like-a-manager judgment that decides the CISSP.
The CISSP (from ISC2) is the senior security certification: a computerized-adaptive English exam of roughly 100–150 items in three hours, spanning eight domains from security and risk management through software development security. Its famous difficulty isn’t trivia — it’s ALTITUDE. The exam rewards thinking like a risk-owning manager: human safety first, business alignment over tool preference, risk treatment over absolute prevention, process over heroics. The classic advice “answer as the CISO, not the engineer” is real, and it is trainable.
Keentune’s security-governance-and-risk skill drills that layer — governance structures, risk quantification (ALE = SLE × ARO, and when qualitative beats it), control classification, the security models with their inversion traps (Bell-LaPadula confidentiality vs Biba integrity), access-control models, BC/DR metrics (RTO vs RPO vs MTD), legal and privacy concepts, and incident phases — while the existing security and networking skills carry the technical domains. Every explanation names the confusable pair the item was built on and the management principle that picks the answer. Original questions from the public ISC2 outline — never real exam items.
Or take a timed drill — 20 questions, 25 minutes
A focused drill on one section under a real clock — not a full practice exam, and never a predicted CISSP score.
Studying for a test date?
Tell us when your CISSP is — you’ll get a countdown and a daily pace. Create a free account and your date and progress follow you to any device.
Set your test date and we’ll pace your practice to it.
What’s on the CISSP exam
Format
Computerized adaptive (English), ~100–150 items
Time
3 hours
Passing
700 of 1000 (scaled)
Experience
5 years in 2+ domains (4 with waiver) + endorsement
Security & risk management
~15–16%
The governance/risk core — and the exam’s center of gravity.
Asset security · Architecture · Network · IAM
~13% · ~10% · ~13% · ~13%
Classification, models and design, communications security, and identity.
Original practice aligned to the public ISC2 CISSP exam outline — never actual exam questions or official ISC2 material. CISSP certification also requires five years of qualifying experience (or four with a waiver) and endorsement — isc2.org governs. Keentune is independent study practice, not affiliated with or endorsed by ISC2, and never guarantees a pass.
What does “think like a manager” actually mean on the CISSP?
Rank answers by this order: human safety above everything; then business mission and risk-based justification; then process and policy; then technology. When a question offers a great technical fix and a governance answer, the exam usually wants the governance answer — the CISSP certifies the person who OWNS the risk, not the one who patches the box.
How should I handle the adaptive format?
No skipping, no going back — so answer every item as final and protect your pace (roughly 100 seconds per question budget). The difficulty adapting upward when you’re doing well FEELS like failing; expect that and don’t let it rattle you.
Which memorized pairs pay off most?
The inversion traps: Bell-LaPadula (no read up / no write down — confidentiality) vs Biba (no read down / no write up — integrity); RTO (time to restore) vs RPO (data you can lose) vs MTD (the ceiling RTO must fit under); DAC vs MAC vs RBAC vs ABAC; due care (doing) vs due diligence (verifying); and the ALE arithmetic. A large share of missed questions are these pairs, inverted.
Am I eligible to sit the CISSP?
The exam is open to anyone, but the CERTIFICATION requires five years of paid work across two or more domains (one year waivable by degree/credential) plus endorsement; without it you become an Associate of ISC2 until the experience accrues. Check isc2.org for current terms.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.