The CISSP CAT exam explained: how the adaptive test works
The CISSP is a computerized adaptive test in every language. It chooses each item based on your previous answers, stops between 100 and 150 items, and never lets you go back. Here is how it works, from ISC2's own descriptions, and what it means for the way you practice.
The short version
A linear exam gives every candidate the same fixed set of questions. An adaptive exam builds the test as you go. The CISSP starts you on an item well below the passing standard, re-estimates your ability after every answer, and picks the next item so that you have roughly a 50% chance of getting it right. When it is 95% confident that you are above or below the passing standard, it stops.
ISC2 has used this format for every CISSP exam, in every language, since April 15, 2024. The older linear version, which had 250 items in six hours, is no longer offered. The exam content outline and the passing standard are the same; only the delivery changed.
The numbers
| What | CISSP CAT | What it means for you |
|---|---|---|
| Items | Minimum 100, maximum 150 | Your exam length depends on your answers, not on luck |
| Unscored pretest items | 25, inside the minimum length | Treat every item as if it counts; you cannot spot them |
| Time | Maximum 3 hours, no minimum | About 72 seconds per item if you reach 150 |
| Breaks | No limit on number or length | They count within the three hours |
| Item review | Not permitted | Each answer is final once you confirm it |
| Sections | None; items come in no set order | Domains are mixed throughout the exam |
| Passing score | 700 out of 1,000 (scaled) | Not a percentage of correct answers |
| Languages | Chinese, English, German, Japanese, Spanish | All CAT; ISC2 lists Chinese only in March, June, September and December |
| Where | Pearson Professional Centers and ISC2-authorized Pearson Select centers | Book through Pearson VUE |
How the adaptive engine chooses items
According to ISC2's CAT FAQ, each candidate starts with an item that is well below the passing standard. After each response, the scoring algorithm re-estimates your ability using the difficulty of every item you have seen and every answer you gave. The item selection algorithm then picks the next item, aiming for about a 50% chance that you answer it correctly. With each answer, the estimate becomes more precise.
Two consequences surprise many candidates. First, the exam feels hard from start to finish, for everyone, because it keeps matching items to your level. Second, you cannot reliably tell which items are easy or hard, so trying to read your result from the last few questions is pointless. ISC2 says directly that both high and low ability candidates find the items at the end challenging.
The content still follows the outline. Items are not grouped into sections or ordered by domain, but every exam is built to the domain weights in the outline, whatever its length: 16% Security and Risk Management, 10% Asset Security, 13% each for Architecture and Engineering, Network Security, Identity and Access Management and Security Operations, 12% Assessment and Testing, and 10% Software Development Security.
How the exam decides to stop
ISC2 applies three rules, in this order.
- 1
Confidence interval rule
Once you have answered the minimum 100 items, the exam ends as soon as your ability estimate is above or below the pass point with 95% statistical confidence. Above means a pass; below means a fail.
- 2
Maximum-length rule
If the confidence rule has not ended the exam by item 150, your final ability estimate is compared with the passing standard. At or above it, you pass; below it, you fail.
- 3
Run-out-of-time rule
If time runs out first, the same comparison is made with your estimate at that point. If you have not answered at least 75 scored and 25 pretest items within the three hours, you fail automatically.
Scoring: why 700 is not 70%
The CISSP pass mark is 700 on a scale of 1,000. It is a scaled score on an adaptive test, so it does not convert to a percentage of correct answers. ISC2's FAQ is explicit that everyone gets about 50% of their items correct; what matters is the difficulty of the items you answer correctly.
The exam is also compensatory. You need to be above the passing standard overall, not in every domain, so strong performance in a heavily weighted domain can offset a weaker lighter one. ISC2 adds that this is possible but not guaranteed.
You receive your result at the test center when you finish. The report is pass or fail with no numerical score. Only candidates who fail, having answered at least the minimum number of items, get feedback by domain, rated as below, near or above proficiency.
If you need to retake
ISC2 requires 30 test-free days after a first attempt, 60 days after a second, and 90 days after the third and any later attempt. You can attempt the exam up to four times in a 12-month period.
What CAT means for how you practice
ISC2's own advice is that preparation should not change because of the format: the outline and the passing standard are the same as they were for the linear exam. The only real change is in habits: pace, commitment to each answer and staying calm when every item feels difficult.
How the course mirrors the real exam
Udemy practice tests cannot adapt to you, so the course uses fixed 125-question tests, the middle of the real 100 to 150 range, timed at 150 minutes, the same 72-second pace. Each test is weighted like the April 2024 outline. The course uses 75% on tests you have not seen before as its practice target; that is our benchmark, not an ISC2 conversion.
To get the most from the tests, schedule them with the 8-week CISSP study plan, answer each question once without going back, and review every option. The guide to the CISSP manager mindset explains how to handle the BEST and FIRST questions that make up most of the exam.
Practice at the real pace
Six 125-question CISSP practice tests timed at 150 minutes, weighted like the April 2024 outline, with every option explained.
CISSP CAT exam FAQ
How many questions are on the CISSP CAT exam?
Between 100 and 150 items. Every exam includes 25 unscored pretest items within the minimum length, and you cannot tell them apart from scored items.
How long is the CISSP exam?
A maximum of three hours. There is no minimum time. ISC2 does not limit the number or length of breaks, but breaks count within the three hours.
Can I go back and change answers on the CISSP?
No. ISC2 states that item review is not permitted: once you finalize an answer, it cannot be reviewed or changed.
Does stopping at 100 questions mean I passed?
Not necessarily. The exam can end at 100 items for a pass or a fail, once the scoring algorithm is 95% confident your ability is above or below the passing standard.
Is 700 out of 1,000 the same as 70%?
No. 700 is a scaled score. Because the test adapts, every candidate answers about half of the items correctly; what matters is the difficulty of the items you answer correctly.
Is the CISSP still offered as a linear exam in some languages?
No. Since April 15, 2024, all CISSP exams worldwide use CAT, in Chinese, English, German, Japanese and Spanish.
More guides: CISSP study plan · CISSP manager mindset · Free CISSP practice questions · all guides