Exam strategy
Knowing the material is half the battle. The other half is exam technique: the mindset and tactics that turn what you know into a passing score. These work across CISSP, CISM, Security+, CCNA, and beyond.
Especially for CISSP, CISM, CISA, and CRISC: answer from the chair of the risk owner, not the keyboard of the technician.
Answer as a manager, not a technician
Management exams (CISSP, CISM, CISA, CRISC) reward the executive view. The 'right' technical fix is often the wrong exam answer if a policy, risk decision, or management action comes first.
People safety always wins
If human life or safety is in play, that is the answer. Nothing outranks protecting people, not data, not uptime, not cost.
Risk-based, not fear-based
Choose the option that addresses risk proportionally. Avoid extremes that eliminate all risk at any cost; the business accepts, transfers, mitigates, or avoids risk deliberately.
Policy and process before technology
When options mix governance and tooling, the foundational step usually comes first: identify the asset, assess risk, set policy, get management buy-in, then implement controls.
Pick the BEST answer, not a correct one
Often several options are technically true. The exam wants the FIRST, MOST effective, or MOST complete action. Re-read the qualifier in the stem.
Eliminate to two, then decide
Cross out the clearly wrong options first. With two left, find the word or scope that makes one better than the other.
Beware absolutes
'Always', 'never', 'all', 'none', and 'only' are usually traps in security, where context rules. Distractors that promise to eliminate every risk are rarely correct.
Mind the keyword in the stem
FIRST, NEXT, BEST, LEAST, MOST, EXCEPT change the whole answer. Underline them mentally before scanning options.
Performance-based questions (PBQs) last
On CompTIA-style exams, flag and skip PBQs first, bank the quick multiple-choice points, then return with your remaining time. Partial credit is usually awarded, so attempt every part.
Budget time per question
Divide your minutes by questions and check the clock at the 25%, 50%, and 75% marks. Never sink five minutes into one item; flag it and move on.
First instinct, with a reason
Change an answer only when you can articulate WHY the new one is better. Second-guessing without a reason costs more points than it saves.
Read the scenario for role and goal
Who are you in the scenario (analyst, manager, auditor)? What is the objective? Your role changes which action is 'best'.
Run timed exam simulations and weak-area drills to build these instincts before exam day.