CISSP: Free Study Guides by Domain, and an Honest Look at the Prep Tools
The CISSP is unusual among certifications: the hard part is rarely the facts. It is learning to answer as a security manager rather than a hands-on engineer, and getting comfortable with a scoring format that deliberately refuses to tell you how you are doing. The guides below are written for that - concept first, then the exam's way of asking about it.
Find out where you actually stand
A complete CISSP practice exam in the manager-perspective style, with a full explanation on every item and a personalized Exam Coach at the end that names the domains costing you marks. Create an account on the next screen and the code applies itself.
CISSP-EXAM-FULL
Take the free exam
Already have an account? Log in to start · Or read the guides below first.
The eight domains, and where the marks are
ISC2 weights the domains unevenly, and the weighting is worth studying to. Security and Risk Management alone is 16% of your score - more than Asset Security and Software Development Security combined.
| Domain | Weight | Guides here |
|---|---|---|
| 1. Security and Risk Management | 16% | Risk math: SLE, ALE, ARO |
| 2. Asset Security | 10% | Coming soon |
| 3. Security Architecture and Engineering | 13% | Bell-LaPadula, Biba, Clark-Wilson |
| 4. Communication and Network Security | 13% | Coming soon |
| 5. Identity and Access Management | 13% | Coming soon |
| 6. Security Assessment and Testing | 12% | Coming soon |
| 7. Security Operations | 13% | Coming soon |
| 8. Software Development Security | 10% | Coming soon |
Weights are the ISC2 exam outline in force since the April 2024 refresh.
Study guides
SLE, ALE, ARO: the risk math, worked through
Asset value, exposure factor, single and annualised loss, and the safeguard cost-benefit decision the exam actually asks you to make. With worked numbers and 5 free practice questions.
Bell-LaPadula vs Biba vs Clark-Wilson
No read up, no write down - and why Biba is the mirror image. A comparison table, the mnemonics that survive exam pressure, and 5 free practice questions.
The CAT exam: why finishing at 100 tells you nothing
How adaptive testing decides your result, what the question count does and does not mean, and how to keep composure when the exam refuses to give feedback.
Free CISSP flashcards
An interactive flip board covering every domain, with keyboard and swipe controls and a "still learning" pile that brings weak cards back round.
The free CISSP ebook
The whole study guide readable in the browser - no PDF, no download, no email wall.
Testing yourself, and choosing a prep tool
CISSP practice exam
A full-length exam in the manager-perspective style, with an explanation on every item and a coach that names the domains costing you marks.
Am I ready for the CISSP?
A readiness rubric and a free test to run before you commit $749 to a sitting.
Best CISSP practice exams, ranked honestly
Boson, LearnZapp, Pocket Prep, Thor and the rest - what each is genuinely best for, real prices, and which to actually buy. Includes where we are not the right answer.
Boson ExSim-Max for CISSP: the alternative
ExSim-Max is a one-year licence at around $99. Side-by-side on question style, explanations and what renewing actually costs you.
Reading is not the same as being ready
Every guide above tells you how a concept works. Only a full exam tells you whether you would pick the manager's answer under time pressure. This code unlocks a complete CISSP exam - all eight domains, an explanation on every item, and a coach that names your weak domains. It applies itself when you create the account.
CISSP-EXAM-FULL
Redeem the code
Free, no credit card. Already have an account? Log in and it applies there too.
Three things that catch people out
The score tells you nothing while you are in it
CAT re-estimates your ability after every answer and stops the moment it is confident you are clearly above or clearly below the standard. That confidence can arrive in either direction, so finishing at 100 items does not mean you passed - only that the result was decisive. Reaching 150 usually means you were sitting close to the line. Neither is a signal you can act on mid-exam, and trying to read one is a reliable way to lose composure.
The most defensible answer beats the most technical one
Most questions have an option that is technically excellent and an option a security manager would choose. The exam wants the second. In practice that means: address risk before implementing a control, get management support before spending, protect people before assets, and prefer the answer that covers the widest scope of the organisation rather than the neatest fix.
You can sit the exam before you have the experience
Five years across two or more domains is required for the certification, not for the exam. Pass without it and you become an Associate of ISC2, with six years to accumulate the experience. Plenty of people do it that way round.
Ready to test yourself against a full exam?
The guides cover concepts one at a time. A full-length exam is what tells you whether the manager perspective has actually landed.
- Questions spanning all eight CISSP domains
- An explanation on every item, not just the ones you miss
- A personalized Exam Coach that names your weak domains
- The first full exam is free - no credit card
One-time purchase, lifetime access · no subscription · free full exam first