Final Readiness Review

Readiness is a verdict, not a feeling

By now the study work is done, the domain tests are scored, and the two sittings of the full practice exam have run. The only question left is whether you should sit the real exam, and the honest answer does not live in your chest. It lives on paper. Readiness is a verdict you compute from evidence: the numbers on the combined score sheet, the pattern of your misses, and the way your last long session actually ended. Feelings of confidence track the material you reviewed most recently, which is not the same as the material you will need most, so this chapter gives you a procedure instead of a pep talk.

The procedure has four parts. First, read the combined score sheet the way a diagnostic instrument should be read, as three separate numbers that mean three different things. Second, triage: turn the gaps into a written plan with hours attached, priced by the outline’s domain weights the same way the exam prices them. Third, compress: the memory set in this chapter is the whole book in a carry-on, built to be reviewed cold in the final week. Fourth, execute the finish: a day-by-day plan for the last seven days, the exam-day protocol, and a straight-eyed look at both possible results, because the day after the exam has its own to-do list and it is part of this review.

The drill at the end is the last ten questions in this book, and they test this chapter’s material rather than the domains, because the final skill is not knowing a control, it is knowing what to do with the evidence in front of you.

Reading the combined score sheet

Chapter 34 set the terms: the combined 125-question run from Chapters 33 and 34, not either sitting alone, is the deliverable. The counts you scored against were 19 items for Domain 1, 12 for Domain 2, 16 each for Domains 3 through 7, and 14 for Domain 8. Three numbers come out of that sheet, and each answers a different question.

The total percentage answers one question only: how close is your overall level to the passing mentality of the real exam? The real exam reports pass or fail, no numerical score, against the published standard of 700 out of 1000 on ISC2’s scaled score. Your practice total is a proxy for that one number, so it is worth knowing, and it is worth nothing more than that. Do not let it decide anything by itself, because the total is exactly the number the real exam hides from you. The two numbers that matter for planning are the per-domain percentages and the miss-type split.

Per-domain percentages answer the planning question: where do the hours go? Apply the rules from Chapter 1 to every domain. Below 60 percent means the concepts have not landed: the domain goes through the re-read, redo, retest loop, which is re-reading the part’s chapters, redoing all of its questions, and retaking that domain’s practice test three to five days later, not immediately, because an immediate retake measures memory of the answer key, not command of the material. Between 60 and 80 percent means the concepts are mostly there: review the rationales you missed, redo those specific questions until you can explain each rationale aloud without looking, and hold the domain in weekly spaced review. Above 80 percent means the domain is warm: one weekly pass keeps it that way, and further deep study there steals hours from a colder domain.

The miss-type split answers the diagnosis question: what kind of miss are you making, content or technique? Go through every question you got wrong in both sittings and classify the cause. A vocabulary miss is when the rationale names a standard you misquoted or could not have named, a definition you inverted, a protocol property you had wrong. That is content, and the fix is the standard itself: read the clause, the RFC section, or the control family you missed, and rebuild the fact. A technique miss is when the rationale shows you knew the material but answered the wrong question: you chose a true statement about a different actor, you missed the NOT in the question line, you picked the dramatic action over the process answer, you over-read an absolute word. That is craft, and the fix is Chapter 32, the elimination method, the question-line-first habit. The two failures look identical on the score sheet, and they respond to different study.

A worked example makes the reading concrete. A candidate’s combined sheet shows 55 percent in Domain 1, 68 percent in Domain 2, 82 percent in Domain 3, 77 percent in Domain 4, 63 percent in Domain 5, 58 percent in Domain 6, 71 percent in Domain 7, and 66 percent in Domain 8. The total is around 67 percent, which feels mid-table and tells you almost nothing. The per-domain numbers tell the story: Domains 1 and 6 fall below the 60 percent line, so they own the re-read, redo, retest loop. Domains 2, 4, 5, 7, and 8 sit in the 60 to 80 band and get targeted rationale review plus weekly spaced review. Domain 3 is above 80 and gets one weekly pass. Then the miss-type split says the Domain 1 misses were mostly standards misses (the GDPR’s 72-hour rule, the ISO 31000:2018 risk-owner definition, the policy hierarchy order), while the Domain 6 misses were mostly scope kills missed at speed. That splits the plan further: Domain 1 work is a reading and vocabulary rebuild; Domain 6 work is a technique pass, timed elimination drills, and the question-line-first habit, not another pass through the scanner chapter. Same two scores, two different treatments.

Triage: pricing the hours

The triage turns the diagnosis into a calendar. The rule of thumb, set in Chapter 1, is that hours should be priced like the exam prices items: the outline’s weights are 15 percent for Domain 1, 10 percent for Domain 2, 13 percent each for Domains 3, 4, 5, and 7, 12 percent for Domain 6, and 11 percent for Domain 8. A point recovered in Domain 1 is worth more expected points on exam day than a point recovered in Domain 8, so when two domains sit in the same band, the heavier domain gets the extra hour. This is not favoritism, it is arithmetic, and it is the same arithmetic the adaptive engine uses to draw items.

Write the plan down with hours attached, because an unwritten plan is a resolution. A workable template has three lines per weak domain. The first line is the treatment, re-read, redo, or retest, with the specific chapters named. The second line is the schedule: the retest day, three to five days after the redo, marked on a calendar. The third line is the technique treatment if the miss-type split calls for one, the exact drill and how many timed repetitions. Two domains below 60 percent means roughly two study cycles before the exam, and the cycle has a minimum viable length, because re-read, redo, retest cannot be compressed into an evening. If the calendar will not fit a full cycle before your exam date, the honest move is to move the exam date, not to shorten the cycle. ISC2’s retake arithmetic, 30 test-free days after a first failed attempt, gives you room to schedule conservatively the first time, and a later first attempt beats an earlier failed one.

Two more triage signals deserve a read. The fatigue signal: look at where the misses clustered in the last sitting. If the misses rise sharply in the final stretch of items, the diagnosis is endurance, not knowledge. The fix is clocked practice: full 90-minute sittings, the two-minute cap enforced, the hour-mark reset performed, and at least one more full-length run before exam day. The comfort-stop rule matters here, because a break during the real session counts against the 180 minutes, so the practice that transfers is the practice that reproduces the constraint, no phone, no water break, no pause. The confidence signal: if a domain is above 80 percent but you feel it is weak, the feeling is usually recency bias, the domain you studied last feels freshest, and the score sheet is the better instrument. Trust the sheet, keep the domain on the weekly pass, and spend the feeling on a colder domain.

The compressed memory set

Mnemonics are not a shortcut, they are a packing problem: the exam rewards recall under time pressure, and recall is faster when the fact is anchored to a hook. The set below is the book compressed into portable devices, one line each, organized by domain, every fact grounded in the standard or framework named beside it. Review this set cold in the final week, and when a device feels automatic, the fact behind it usually is.

That is the carry-on. The test of the set is not reading it, it is closing the file and writing the hook for a fact from memory, then expanding the hook back into the fact. Do that pass twice in the final week, once forward from hook to fact and once backward from fact to hook, and the recall the real exam pays for is in place.

The final seven days

The plan below is the finishing plan for a candidate who has already done the triage. It is deliberately light on new content, because new content in the final week does not land, it leaks. The week’s job is consolidation, endurance, and logistics.

Seven days out: run the triage plan for the last time. Finish the re-read, redo, retest loops that are still open, and record the final per-domain percentages on the score sheet. From here, no domain changes band; the plan is set.

Six days out: one full 90-minute practice sitting, the first half of whichever domain test or practice-exam section your plan still needs, under clocked rules, two-minute cap, no review, no blank. Score it and write the result.

Five days out: the memory set, forward pass. Close the book and write out the hooks from memory, then check. Spend the rest of the session on the technique work from Chapter 32, the kill questions and the hierarchy, on the questions you missed in the last full sitting.

Four days out: the other 90-minute sitting under the same rules. Score it, and this time resist every instinct to change the study plan based on it; the plan is set, a single bad afternoon is a data point, not a verdict.

Three days out: the memory set, backward pass. Write the facts for each hook from memory, then check. Do one pass over the decision hierarchy and the exam arithmetic, the two-minute cap, the clock marks, the no-review rules.

Two days out: stop new material entirely. Review only what you already know well, the memory set, the score sheet’s strongest domains, the logistics checklist below. Pack the IDs, the confirmation, the clothes, the route. Sleep on a normal schedule.

The day before: do not study more than an hour, and only warm material. Eat a normal dinner, set the alarm with slack, and stop at a reasonable hour. The single highest-leverage act of the day before is sleep, not another chapter, because recall under the adaptive engine is a working-memory task and working memory is the first casualty of sleep debt.

The logistics checklist, once, then forget it: the appointment confirmation with the exact test center address; two forms of identification, one of them a current government-issued photo ID with your name exactly as it appears on the registration, the second with your signature; nothing you are unwilling to leave in a locker, because the center controls what enters the room, and phones, watches, notes, and outer layers stay out; a route with arrival margin, because check-in runs slower than people expect; and a plan for food and water before you enter, because the 180 minutes are continuous and any break inside them counts against the clock.

Exam day: run the loop

The session itself is the loop you have trained. Read the question line first, every item, including the ones you are tired of. Name the shape and the qualifier before the stem: BEST, MOST, LEAST, NOT, EXCEPT, FIRST, PRIMARY. Kill what you can kill, standard-wrong, out of scope, overclaiming. Choose among survivors with the decision hierarchy, people before property, name the risk, prevention over detection, least privilege, defense in depth, business alignment, escalation and accountability, and the tie-breaker, the answer a responsible manager would defend in front of the board. Confirm and release the item, because the engine offers no review and release is the whole skill.

Hold the arithmetic: the session is 100 to 150 items in 180 minutes, so budget about a minute and a quarter per item, with a hard two-minute cap per item. Check the clock at the 25-item and 50-item marks, near the 30-minute and 60-minute lines. A hard stretch is calibration, the engine testing you at your level, not a verdict; take the reset at the hour mark, close your eyes, breathe, and start the next item as if the exam had just begun. Answer everything, including the items you hate, because a blank is the only answer guaranteed wrong, and the pretest items inside the run must be answered to reach the graded minimum even though they do not score.

Use the 15-minute preview tutorial before the clock starts for exactly what it is for: click through the interface, confirm how an answer finalizes, find the clock display, get your hands comfortable. None of that time touches the 180 minutes.

When the session ends, the center prints a provisional pass or fail, and the official result follows later through ISC2. Take the provisional result at face value and leave. Do not spend the evening re-litigating items from memory; the only signal that matters printed itself on the screen.

If it says pass

A provisional pass is not the certification yet, and the gap between the two has its own steps, all of them on ISC2’s published path. The pass does not expire, but the endorsement window does: ISC2 requires that the endorsement application be completed within nine months of passing the exam. Put the date on a calendar the day you pass.

Endorsement is the attestation step. ISC2 requires that the application be endorsed by an ISC2 certified professional in good standing, someone holding an active ISC2 credential who can attest to your professional experience, or by ISC2 itself if no endorser is available to you. The application is filed through the ISC2 candidate portal, and it asks you to attest to the same eligibility facts the exam presumed: five years of cumulative paid work experience in two or more of the eight domains, with a four-year degree or an approved credential waiving one year, and a candidate holding both qualifying with three. If you were sitting on less experience than the requirement, the truthful move is to wait until you qualify before applying, because the attestation is the point where the experience requirement is verified rather than assumed.

The certification then has a maintenance side, and it is worth knowing before you take the credential, because the credential is a standing obligation, not a trophy. ISC2 collects an annual maintenance fee (AMF), roughly $135 a year at the time of writing and subject to ISC2’s revisions, and it requires continuing professional education: 40 CPE credits per year, 120 per three-year cycle, in learning that keeps the eight domains current. The exam tested whether you can start; the maintenance obligation is the part that keeps you current enough to deserve the credential in year five.

Two pieces of counsel for the pass case. First, the official pass is worth a real moment of acknowledgment; the provisional print at the center is the end of a long arc, and the endorsement application later is the end of another. Second, plan the CPE habit now, while the momentum exists, because the candidates who drift out of maintenance rarely leave on purpose, they leave by forgetting the annual fee and the quarterly learning that the calendar quietly demands.

If it says fail

A failed attempt is data, not identity, and the data is better than a practice bank can give you, because it is the real engine’s verdict. ISC2 reports pass or fail only, no numerical score, but failing candidates receive per-domain proficiency feedback labeled below, near, or above proficiency, and that feedback is the diagnostic. The below-proficiency domains are your re-read, redo, retest list; the near-proficiency domains get the targeted rationale treatment; the above-proficiency domains hold their weekly pass. Map the feedback onto this book’s chapters and rebuild from there.

The retake arithmetic is public and fixed: after a first failed attempt, 30 test-free days; after a second, 60; after a third or later, 90, with a maximum of four attempts in any 12-month period. Budget the calendar accordingly, and resist the two most common second-attempt mistakes. The first is scrapping the method because it did not produce a pass the first time; if the score sheet said the content was close and the technique review found scope kills missed at speed, the method is fine and the discipline was not, so rerun the loop, do not redesign it. The second is booking the retake at the earliest possible date and cramming the waiting weeks; the test-free days are the re-read, redo, retest cycle’s minimum spacing, and ISC2’s own arithmetic is telling you the interval exists for a reason.

One more reading of the fail case. The exam is criterion-referenced at 700 out of 1000 and compensatory across domains, and a fail report that puts most domains near or above proficiency is a much closer miss than the single word suggests. Treat it as what it is, a margin measured in a handful of items, and spend the retake window on the specific domains and the specific miss types the feedback names, not on a general rebuild.

The last ten

Ten questions, the final ones in this book, and they test the material of this chapter: reading scores, triaging, memorizing, executing, and the after-exam path. Take them the way you take every item now, question line first, kill, choose, commit, and do not open the key until all ten are answered.

1. (Scoring bands.) A candidate’s combined practice-exam percentages are 55 in Domain 1, 68 in Domain 2, 82 in Domain 3, 77 in Domain 4, 63 in Domain 5, 58 in Domain 6, 71 in Domain 7, and 66 in Domain 8. Which triage BEST fits this book’s scoring rules?

A. Re-read, redo, retest Domains 1 and 6; targeted rationale review for Domains 2, 4, 5, 7, and 8; one weekly pass for Domain 3. B. Re-read all eight domains because any score under 70 means the whole plan failed. C. Re-study only Domain 3 because the highest score has the most room to grow. D. Drop Domain 1 because governance is administrative and focus every hour on Domain 6.

2. (Fatigue pattern.) In the second practice sitting, a candidate misses 8 of the final 15 items but only 5 of the first 47. What does this pattern MOST strongly suggest?

A. The domains tested in the last stretch are permanently weak and need a full re-read. B. An endurance and pacing problem, a rising miss rate as the session runs long, best fixed with clocked sittings, the two-minute cap, and the hour-mark reset. C. The pretest items always cluster at the end of an adaptive exam. D. The candidate should stop practicing and reschedule the exam.

3. (Miss-type diagnosis.) Reviewing missed items, a candidate sees the same pattern: the rationale shows the right standard was known, but the chosen option was a true statement about a different actor or a different phase. What does this diagnose?

A. A vocabulary gap that another chapter re-read will close. B. A technique gap in reading the question line and applying the scope kill, best fixed with the elimination method and timed technique drills. C. A permanent limitation that no amount of study can change. D. Random variance with no corrective action needed.

4. (Weight-priced hours.) Two domains sit below 60 percent: Domain 1 at 15 percent outline weight and Domain 8 at 11 percent. All else equal, how should the remaining study hours be divided?

A. Equally, because both are below the same line. B. More to Domain 1, because the outline prices its items higher, so each recovered point buys more expected exam points. C. Entirely to Domain 8, because software content is quicker to memorize. D. None to content; all remaining hours go to technique drills regardless of domain.

5. (Final week.) Which behavior BEST fits the book’s plan for the final days before the exam?

A. Start a brand-new framework the night before to close any perceived gap. B. Stop introducing new material by about two days out, review the compressed memory set, protect sleep, and rehearse the logistics checklist. C. Retake both full practice sittings in the last 24 hours to warm up. D. Study only Domain 8 because it was the most recently covered material.

6. (Exam-day rules.) Which statement about the test-center session is accurate?

A. The 15-minute preview tutorial counts against the 180-minute clock. B. Any break taken during the session counts against the 180-minute clock. C. You may review and change earlier answers at the end of the session. D. Personal notes may be brought in if they are sealed in a clear folder.

7. (Retake arithmetic.) A candidate fails the first attempt. Per ISC2’s published retake policy, what applies?

A. The exam may be retaken the next day. B. Thirty test-free days after the first attempt, 60 after the second, and 90 after the third, with a maximum of four attempts in any 12-month period. C. Ninety days after every failed attempt regardless of how many attempts. D. One full year must pass before any retake.

8. (Endorsement.) After passing the CISSP exam, which statement is accurate?

A. The endorsement application must be completed within nine months of passing, endorsed by an ISC2 certified professional in good standing or by ISC2 itself. B. The pass expires if endorsement is not completed within 24 hours. C. Only the testing center can endorse the application. D. Endorsement is optional for candidates who hold a four-year degree.

9. (Eligibility.) Which statement about CISSP eligibility is accurate?

A. Five years of cumulative paid work in two or more of the eight domains; a four-year degree or an approved credential waives one year, and a candidate holding both can qualify with three. B. Ten years of experience in a single domain. C. Three years of total experience regardless of domain coverage. D. A four-year degree alone qualifies, with no work experience.

10. (Maintenance.) After the credential is awarded, which statement is accurate?

A. The credential requires 40 CPE credits per year and 120 per three-year cycle, plus an annual maintenance fee set by ISC2. B. No continuing education is required; only a one-time fee at endorsement. C. 120 CPE credits are due every single year. D. The credential is permanent with no further obligations.

Answers and rationales

1. A. The bands are the rules from Chapter 1: below 60 percent is the re-read, redo, retest loop (Domains 1 and 6 here, at 55 and 58), 60 to 80 percent is targeted rationale review plus weekly spaced review (Domains 2, 4, 5, 7, and 8), and above 80 percent is one weekly pass (Domain 3, at 82). Option B invents a 70 percent line that is not in the rules, option C misreads the highest score as the problem, and option D ignores a 15 percent-weight domain on a judgment about its subject matter.

2. B. The miss rate climbing as the session runs long is the classic endurance signature: the knowledge did not change, the condition did. The fix is clocked practice that reproduces the real constraint, the two-minute cap, the hour-mark reset, and a full-length sitting, not a re-read of chapters whose content was already available in the first 47 items. The other options treat the symptom as a content problem, invent a pretest rule that does not exist, or abandon the plan on one pattern.

3. B. When the rationale shows the standard was known and the error was picking a true statement about a different actor or phase, the diagnosis is the question-line discipline, Chapter 32’s method: read the question line first, name the actor, and apply the scope kill before the choose phase. A vocabulary re-read would treat the wrong disease, and the other options either deny the evidence or give up on it.

4. B. The outline weights price the exam’s item draw, so a recovered point in a 15 percent domain is worth more expected points than one in an 11 percent domain. Equal splitting ignores the pricing, option C inverts it on a preference, and option D abandons content at exactly the moment the below-60 percent scores say content is the gap.

5. B. The final week’s job is consolidation, not expansion: new material stops roughly two days out, the memory set is reviewed cold, sleep is protected, and logistics are rehearsed, because recall is a working-memory task and the highest-leverage act is rest. A brand-new framework the night before will be a thin topic under the clock, two full sittings in 24 hours trains exhaustion, and single-domain focus abandons the triage plan.

6. B. The book’s exam model is explicit: the session is 180 minutes, breaks count against the clock, and the 15-minute preview tutorial before the clock starts does not. The engine offers no review, which makes option C wrong, and no personal materials enter the room, which makes option D wrong.

7. B. The published retake arithmetic is 30 test-free days after the first attempt, 60 after the second, 90 after the third, with a maximum of four attempts in any 12-month period. The other options invent intervals the policy does not state.

8. A. ISC2 requires the endorsement application within nine months of passing, and the application must be endorsed by an ISC2 certified professional in good standing or by ISC2 itself when no endorser is available. The 24-hour claim, the test-center endorser claim, and the degree-based exemption all contradict the published path.

9. A. The published requirement is five years of cumulative paid work in two or more of the eight domains, with a four-year degree or an approved credential waiving one year, and both waiving two. A single domain never satisfies the two-domain test, and a degree alone never replaces experience.

10. A. The credential is maintained with 40 CPE credits per year, 120 per three-year cycle, and the annual maintenance fee set by ISC2. The other options claim exemptions the maintenance program does not grant.

Carry the finish in

The book is done, and so is the work it asked of you. What remains is execution, and execution is now a set of concrete, written steps: read the score sheet as three separate instruments, triage by the bands and price the hours by the weights, compress the memory set into recall, run the final seven days without new material, walk into the center with the loop in your hands, and handle the printed result with a plan either way. The endorsement window, the retake arithmetic, the maintenance calendar, all of it is on paper above, and none of it is a surprise anymore.

The exam is one instrument measuring whether you can think like the accountable security professional the eight domains describe. You have studied the domains, worked the practice bank to its last question, read your own score sheet honestly, and priced your last hours by the same weights the exam uses to draw its items. Walk in and run the loop. The rest is execution, and execution is what you have been practicing.