CISSP Syllabus: Sections and Question Counts

Last verified: 11 November 2026. This is an independent guide; it is not affiliated with ISC2 or any government body. Exam details can change, so check the exam page at ISC2 before relying on any figure.

How the questions are split

The full mock exam on this site (150 questions in 180 minutes) is split across the sections according to the exam specification from ISC2.

The two largest sections are Security and Risk Management and Security Architecture and Engineering: together 44 of the 150 questions (29.3%). Start with them, then take the rest in order of size.

Notes on this split

• The real exam uses CAT, lasts three hours and does not allow review after an answer is submitted. Site practice does not reproduce CAT or generate an ISC2 score.
• Arabic here supports study. ISC2 lists English, Chinese, German, Japanese and Spanish as exam languages.
• Content follows the 15 April 2024 outline. The next outline takes effect on 15 April 2027.

Topics in each section

Security and Risk Management (24 questions)

• Professional ethics
• Security concepts
• Security governance
• Legal, regulatory and compliance issues
• Investigation requirements
• Policies, standards, procedures and guidelines
• Business continuity requirements
• Personnel security
• Risk management
• Threat modeling
• Supply chain risk management
• Security awareness, education and training

Asset Security (15 questions)

• Identify and classify information and assets
• Asset handling requirements
• Secure asset provisioning
• Data lifecycle
• Asset retention and end of life
• Data security controls and compliance

Security Architecture and Engineering (20 questions)

• Secure design principles and engineering
• Security models
• Controls based on security requirements
• System security capabilities
• Architecture and design vulnerabilities
• Cryptographic solutions
• Cryptanalytic attacks
• Secure site and facility design
• Facility security controls
• Information system lifecycle

Communication and Network Security (19 questions)

• Secure network architecture design
• Secure network components
• Secure communication channels

Identity and Access Management (19 questions)

• Physical and logical access
• Identification and authentication strategy
• Federated identity with a third party
• Authorization mechanisms
• Identity and access provisioning lifecycle
• Implement authentication systems

Security Assessment and Testing (18 questions)

• Assessment, test and audit strategies
• Security control testing
• Collect security process data
• Analyze test output and report
• Conduct or facilitate security audits

Security Operations (20 questions)

• Investigations and evidence
• Logging and monitoring
• Configuration management
• Foundational security operations concepts
• Resource protection
• Incident management
• Detection and preventative measures
• Patch and vulnerability management
• Change management
• Recovery strategies
• Disaster recovery processes
• Disaster recovery plan testing
• Business continuity planning and exercises
• Physical security
• Personnel safety and security

Software Development Security (15 questions)

• Security in the software development lifecycle
• Software development ecosystem controls
• Assess software security effectiveness
• Security of acquired software
• Secure coding guidelines and standards

How to use this split

Start with the 10 free questions, no sign-up: your score comes back split by section, so you see the weakest one. Then spread your study days according to the table above, as laid out in the study plan.