The CAT format of the CISSP exam, explained question by question

The CISSP exam is a computerized adaptive test — CAT. In practice: you are not given a list of questions fixed in advance, but a sequence of questions selected as you go, based on your previous answers. Since 15 April 2024, that sequence runs to 100 to 150 questions, to be answered in 3 hours maximum. Before that date, the format was 125 to 175 questions in 4 hours, which means a large share of the reports available online describes an exam that no longer exists.

These reference points come from candidate reports published between August 2023 and July 2026 (our method); the official rule is on isc2.org.

What is the CAT format of the CISSP exam?

A CAT is not designed to make you answer as many questions as possible: it aims to estimate your level with enough certainty to reach a verdict. Each answer sharpens that estimate, and the next question is chosen to reduce the remaining uncertainty.

The basic principle

One candidate summed up the mechanism in October 2024, in the most widely quoted account on the subject:

"At the beginning of the test, the CAT presents a question of medium difficulty. [...] If they answer correctly, the next question will be more challenging; if they answer incorrectly, the next question will be easier."

The direct consequence: a candidate who is doing well sees the exam get harder and harder. Perceived difficulty is therefore not a bad sign, but the normal behaviour of the system.

What a CAT is not

It is not a linear questionnaire you work through at your own pace. No candidate mentions being able to return to a submitted question, and the most common piece of advice is to move on: "forgot about every question everytime I pressed next". This inability to go back changes the way you handle each item, as detailed in the method for answering a CISSP question.

How many questions and how much time since April 2024?

Period	Number of questions	Duration
Until 14 April 2024	125 to 175	4 hours
Since 15 April 2024	100 to 150	3 hours

The 100-150 questions in 3 hours range of the current format is confirmed by many accounts — one failure report mentions "the entire 150 questions for 3hours".

One point of confusion dates from the very day of the change: a commenter wrote at the time "Think it shifted from 125-175 to 100-125". The upper bound is wrong — several later reports describe exams that ran to exactly 150 questions.

How does the algorithm choose the next question?

Beyond "right answer, harder question", one commenter spells out the item selection criterion:

"So the CAT uses something called discriminative efficiency. [...] the point biserial correlation coefficient, which correlates the score on a specific item with the overall test score."

In other words, the algorithm favours the questions that best separate candidates at your estimated level.

"Easy" and "hard" are subjective

The difficulty of a question is a statistical property of the item, not your impression of it. The same commenter puts it this way: "Maybe you are an expert in incident response, so those questions are easier. Where maybe you hate databases (we all do it's ok)." A question calibrated as hard may strike you as trivial.

The algorithm looks for your limits

Several candidates describe an exam that keeps hammering the same theme: "The adaptive test will zero in on your every weakness like a crazy ex!!" But that reading is a trap: one candidate who was very strong in cryptography was bombarded with crypto questions and passed. His conclusion: "Don't stress the CAT too much, it's going to do what it wants and you're just along for the ride."

What is a beta question, and does it count towards the score?

Some of the questions you are asked are unscored: they are being calibrated, inserted to trial future content.

"Beta questions on the CISSP exam serve as unscored questions that help test developers evaluate new content. These questions are mixed into the exam without affecting the test-taker's score."

The item bank is large: "The pool of questions is tens of thousands questions".

A candidate writing in July 2024 estimates their perceived share at "10% that were probably questions they were testing out" — an impression, not an official figure. Nothing lets you spot them during the exam, which is enough to rule out the "this question is easy, so I must be failing" interpretation.

When and why does the exam stop?

The exam stops as soon as the algorithm has enough information — or when one of the limits (150 questions, 3 hours) is reached. Across the 48 exam reports available, stopping at 100 questions is by far the dominant case, ahead of a second group that ran to 150. The full count of these outcomes and what can be concluded from it is in exam stopped at 100 questions: pass or fail?.

These proportions are not a pass rate: "Passed!" posts are massively overrepresented online. Stopping at 100 questions only means that the algorithm has reached a verdict — in either direction, as one comment reporting "Failed at 100, proficient on 3 domains and below on the other 5" makes clear.

What information do you get at the end of the exam?

The screen cuts out without warning — "out of nowhere the screen goes black" — and a satisfaction survey follows, itself timed. The result is then handed to you on paper by the proctor, often without a word; the full sequence on the way out of the test room is described in exam day at the Pearson VUE test centre. If you pass, it states a provisional status:

"Congratulations! We are pleased to inform you that you have provisionally passed..."

No numerical score is given to candidates who pass. If you fail, the report gives a per-domain standing, along the lines of "150 Questions — Result: 3 Above, 2 Near, 3 Below — Time Left: 5 minutes". Scoring and the 700/1000 threshold are covered in CISSP score of 700/1000: why it is not 70%.

What does the format change for a non-native English speaker?

Every available account describes an exam taken in English, and the language load comes up regularly:

"I have to say, as a non-native English speaker, some questions were really more of a language test than cybersecurity"

An ISC2 item writer who took part in these discussions states that this is something they work against: "we have been trying very hard to make the questions as 'linguistically agnostic' as possible".

The language barrier is in fact one of the self-diagnosed causes of failure listed in why candidates fail the CISSP. Available languages and time extensions are official rules, to be checked with ISC2. One documented case describes time extended to 6 hours, obtained through a medical exemption submitted to ISC2.

Practising under conditions close to the real format therefore matters twice as much when English is not your first language: the Cybridia app offers an adaptive mode modelled on the CAT and 8 timed practice exams for that purpose.

Why are older reports out of date?

An August 2023 report says "I answered 175 questions in total". That format no longer exists. The switch is documented in real time on 15 April 2024, when a candidate expressed surprise at finishing at 100 questions:

"Congratulations and as to why you managed to pass at 100. It is because the exam format changed today requiring fewer overall questions."

That same candidate nearly came unstuck: working from outdated information, he was pacing himself against the old format and "sped run through the questions". That is the concrete risk of outdated sources — it is covered in time management on the CISSP exam.

A reading rule for any report you find online: check its date. For anything written before April 2024, the number of questions, the duration and the pacing benchmarks no longer apply — the other blog articles are based on the current format.