CISSP
CISSP Complete Review Guide 2026–2027
Every exam topic in a 30-page Arabic PDF, ordered from the heaviest unit to the lightest. The first three chapters alone cover about 42% of the exam questions.
- 30Pages
- 32Key points
- 16Common mistakes
- 16Flashcards
Guide map
Each chapter is one exam unit, ordered by its weight in the real exam.
| Chapter | Unit | Weight | Exam questions | Key points |
|---|---|---|---|---|
| 1 | Security and Risk Management | 16% | 24 | 4 |
| 2 | Security Architecture and Engineering | 13% | 20 | 4 |
| 3 | Communication and Network Security | 13% | 19 | 4 |
| 4 | Identity and Access Management | 13% | 19 | 4 |
| 5 | Security Operations | 13% | 20 | 4 |
| 6 | Security Assessment and Testing | 12% | 18 | 4 |
| 7 | Asset Security | 10% | 15 | 4 |
| 8 | Software Development Security | 10% | 15 | 4 |
Chapter 1 in full: Security and Risk Management
16% of the exam, about 24 questions. These are its key points, as in the guide.
- Define purpose, scope, assumptions and information sources before selecting an assessment approach. [800-30r1, 3.1]
- A threat can cause harm; a vulnerability is a weakness. Determine how they combine in a loss scenario. [800-30r1, 3.2]
- Estimate likelihood and impact, making uncertainty explicit rather than presenting false numerical precision. [800-30r1, 2.3 and 3.2]
The rest of chapter 1, on this page
- Communicate results to decision makers and maintain the assessment as conditions change. [800-30r1, 3.3–3.4]
Common mistakes in this chapter
- A written policy alone does not establish that a control operates effectively.
- Low likelihood does not make a severe impact irrelevant.
The other chapters are in the full guide
One purchase · lifetime access · review guide included
7-day review plan
The chapters are spread over 6 days by weight so each day carries a similar load. Day 7 is a full exam.
Day 1 · 16% of the exam
Chapter 1: Security and Risk Management
Day 2 · 23% of the exam
Chapter 2: Security Architecture and Engineering
Chapter 8: Software Development SecurityDay 3 · 13% of the exam
Chapter 3: Communication and Network Security
Day 4 · 13% of the exam
Chapter 4: Identity and Access Management
Day 5 · 13% of the exam
Chapter 5: Security Operations
Day 6 · 22% of the exam
Chapter 6: Security Assessment and Testing
Chapter 7: Asset SecurityDay 7
Full mock exam: 150 questions in 180 minutes, then review the common mistakes in the units where you lost marks.
Before you read: see your score today
10 free questions from the main units, no sign-up. Then you know which chapter to start with.
Try 10 free questions and see your levelA look at each chapter
The first three key points of each chapter, as they appear in the guide (in Arabic in the PDF).
Chapter 1: Security and Risk Management
- Define purpose, scope, assumptions and information sources before selecting an assessment approach. [800-30r1, 3.1]
- A threat can cause harm; a vulnerability is a weakness. Determine how they combine…
- Estimate likelihood and impact, making uncertainty explicit rather than presenting false numerical precision. [800-30r1…
Chapter 2: Security Architecture and Engineering
- Give each element only the privileges its function requires, whether human, software or hardware…
- Defense in depth uses multiple coordinated and diverse mechanisms rather than relying on one…
- Limit resource sharing to what is necessary, because shared state can spread failures between…
Chapter 3: Communication and Network Security
- Protect communications regardless of network location; internal location alone does not grant trust. [800-207…
- Grant policy-based access to a resource for a session, rather than blanket authorization to…
- Access decisions and enforcement are distinct functions; distinguish the policy engine from the enforcement…
Chapter 4: Identity and Access Management
- AAL2 requires two distinct factors, provided by a suitable multi-factor authenticator or combination of…
- AAL2 applications must offer a phishing-resistant option; AAL3 requires a phishing-resistant authenticator and a…
- Binding a new authenticator is a security event requiring controls, not merely a preference…
Chapter 5: Security Operations
- The Rev 3 incident response guide integrates preparation and response with CSF2.0 risk management…
- RTO concerns restoration time; RPO is the point to which data must be recovered…
- Select backup and recovery strategies according to disruption impact and recovery objectives, then exercise…
Chapter 6: Security Assessment and Testing
- Document authorization, scope, constraints and rules of engagement before testing systems. [800-115, 6 and…
- Configuration and log reviews provide one kind of evidence; exploitation testing examines another. [800-115…
- Analyze findings instead of treating every alert as a confirmed vulnerability; identify impact and…
Chapter 7: Asset Security
- Classification informs handling and protection requirements across the data lifecycle. [CISSP outline, 2.1–2.6]
- Sanitization guidance distinguishes Clear, Purge and Destroy; do not choose one technique for every…
- Record the media, method, tool and version, and verification result before transfer or reuse…
Chapter 8: Software Development Security
- SSDF groups practices into PO for preparation, PS for software protection, PW for secure…
- Document and maintain security requirements throughout development, including organizational and external requirements. [800-218, PO.1]
- Choose executable-code tests for the stage and risk; record findings, triage and remediation in…
The full guide comes with lifetime access
The full guide (30 pages) is included with lifetime access to this exam, together with every question and full mock exam. Chapter 1 is free for everyone.
Questions about the guide
Is the guide free?
Chapter 1 is free to read on the guide page. The full guide comes with lifetime access to this exam; 7-day access does not include it.
Is it up to date for 2026–2027?
Yes. Unit weights and exam facts follow what the exam body last published, and the last check date is printed in the guide. If the standards change we update the file and buyers download the new version.
Does the guide have questions?
No. The guide covers key points and common mistakes; scoring, weak-area practice and full mock exams are on the site.
Can I read it on my phone?
Yes. A5 pages in a single column, with chapters linked from the contents.
- Pages
- 30
- Edition
- 1448 AH · 2026–2027
- Language
- Arabic
- Last updated
Buy this exam
Pick the access that lasts until your test date.
Included
- Timed supplementary practice sessions: 150 questions in 180 minutes
- 767 questions, every option explained with its source
- Practice that starts with your weakest units, plus a review of your mistakes
- Complete Review Guide 2026–2027 (PDF), with lifetime access only
Continue with your Google account and you go straight to the payment page.
You pay on the Waffo Pancake checkout page (in English). The amount is in US dollars and your bank converts it to riyals. One payment with no automatic renewal, by Visa, Mastercard (a mada card with either logo works too), Apple Pay or Google Pay. Your statement shows "WAFFO". Purchases are not refundable.