CISSP · FULL STUDY PROGRAMME

28 Days.
17 April.
Certified.

Cybrary ✔ · Dest Cert active · Domains 3 & 4 priority focus

⏱ 28 DAYS TO EXAM · 20 MAR → 17 APR 2026
Domains 3 & 4 — priority weakness
~280 hrs available study time
Full mock exams every weekend from W3
Rest day Wed 16 Apr — mandatory
DOMAINS:
D1 · Risk
D2 · Asset
D3 · Architecture ⚠
D4 · Networks ⚠
D5 · IAM
D6 · Assessment
D7 · Operations
D8 · Software Dev

4-WEEK OVERVIEW

WK 1 · MAR 21–27
Foundation & Weak Domains
D3 ⚠
D4 ⚠
D1
D2
D5
~12 hrs · 250 Qs
WK 2 · MAR 28–APR 3
All Domains + D3/D4 Consolidate
D3 ⚠
D4 ⚠
D5
D6
D7
D8
~14 hrs · 300 Qs
WK 3 · APR 4–10
Mock Exams + Targeted Fixes
D3 ⚠
D4 ⚠
All 8
~16 hrs · 400 Qs + 2 mocks
WK 4 · APR 11–17
Final Push + Exam Day
Last full study Sat
Rest Wed
EXAM Thu
~8 hrs · taper down
WEEK 1 · 21–27 MARCH · FOUNDATION & WEAK DOMAINS
WEEK 1

Foundation & Weak Domain Blitz

Heavy D3 + D4 · reactivate D1/D2/D5 · ~12 hrs total

PRIORITY: D3 Architecture D4 Networks D1 Risk Mgmt D2 Asset Security D5 IAM (light)
📋 Sat 21 + Sun 22 March — Full Weekend Plan
Brighton day trip Saturday · Full study Sunday · See dedicated weekend plan file
→ cissp_weekend_plan.html
  • →Sat: Train to Brighton → Dest Cert D1/D2/D5 (40-50 Qs) · Return → Cybrary D3 audio prime · Eve → D3 deep dive (crypto + models) + 50 Qs
  • →Sun: All-day session → D3 Part B (secure design + physical) + D4 full deep dive + 125Q mixed mock
    • MON
    23 Mar
    60 min
    🔁 CONSOLIDATION
    Weekend Wrong Answers + D3 Gap Fill
    D3
    • Read through every wrong answer from the weekend Dest Cert sessions — write 1 line per concept you missed
    • If D3 score was under 70%: spend 30 min re-reading the specific subtopic that tripped you up (use Cybrary D3 transcript/notes)
    • Do 20 targeted D3 questions to close the session and confirm the gaps are closing
    TUE
    24 Mar
    60 min
    ✅ PRACTICE
    D4 Targeted Practice — 50 Questions
    D4
    • Dest Cert filtered to Domain 4 only — 50 questions, timed
    • Focus areas: OSI layer attacks, firewall types, VPN protocols, wireless security
    • Note your score — this is your Week 1 D4 baseline for comparison next week
    WED
    25 Mar
    60 min
    🔴 DEEP DIVE
    D1 — Risk Management Refresh
    D1
    • Key concepts (30 min): Risk = Threat × Vulnerability × Asset Value · Risk treatment options (accept/transfer/avoid/mitigate) · Quantitative vs qualitative analysis · ALE = ARO × SLE
    • Business alignment (15 min): NIST RMF, ISO 27001, due diligence vs due care, governance frameworks
    • Dest Cert D1 (15 min): 20 targeted questions — confirm your D1 is still solid
    THU
    26 Mar
    60 min
    🔴 DEEP DIVE
    D2 & D5 — Asset Security + IAM
    D2
    D5
    • D2 (25 min): Data classification levels · Data states (at rest/in transit/in use) · Data lifecycle · Data retention, remanence, and destruction methods (degaussing, shredding, purging)
    • D5 (25 min): AAA framework · Identity proofing · Access control models (DAC/MAC/RBAC/ABAC) · MFA types · Federated identity (SAML, OAuth, OpenID Connect)
    • 10 Qs each: 20 questions split D2/D5 to confirm retention
    FRI
    27 Mar
    30 min
    💤 LIGHT
    Mixed 30 Questions + Weekend Prep
    Mixed
    • 30 mixed Dest Cert questions — all domains, no filtering. Note which domains are still dropping
    • Quick scan of this week's wrong-answer notes — any pattern emerging?
    • Friday is a short session by design — give your brain space before the W2 weekend push
    WEEK 2 · 28 MARCH – 3 APRIL · ALL DOMAINS + D3/D4 CONSOLIDATION
    WEEK 2

    Complete the Map

    All 8 domains covered · D3/D4 consolidation · D6/7/8 first deep dives · ~14 hrs

    PRIORITY: D3 Consolidate D4 Consolidate D6 Assessment D7 Operations D8 Software Dev
    SAT
    28 Mar
    4–5 hrs
    🗓 WEEKEND DAY
    D5 IAM + D6 Assessment — Deep Dives
    D5
    D6
    • D5 Deep Dive (2 hrs): Kerberos authentication flow · LDAP vs Active Directory · Single Sign-On architecture · Privileged Access Management · Account lifecycle management · Password policies and credential attacks (pass-the-hash, golden ticket)
    • D6 Deep Dive (2 hrs): Penetration testing phases (recon, scanning, exploitation, reporting) · Vulnerability assessment vs pentest · CVSS scoring · Security audit types · SOC 1/2/3 report differences · Security metrics and KPIs
    • 30 Qs on each domain to close each block
    SUN
    29 Mar
    5–6 hrs
    🗓 WEEKEND DAY
    D7 Operations + D8 Software Dev + D3/D4 Recheck
    D7
    D8
    D3
    D4
    • D7 (90 min): Incident response PICERL model · Digital forensics (order of volatility, chain of custody, legal holds) · BCP vs DRP · RTO/RPO/MTD · Backup types and rotation schemes · Patch management · Change management process
    • D8 (90 min): SDLC with security gates · OWASP Top 10 · Static (SAST) vs Dynamic (DAST) analysis · Threat modelling with STRIDE · Software composition analysis · DevSecOps pipeline · Code review techniques
    • D3/D4 30-min recheck: 40 questions mixed D3/D4 — are scores improving vs Week 1?
    💡 WEEK 2 MILESTONE By end of Sunday you should have done at least one focused study session on all 8 domains. From Week 3 onwards it's refinement, not first exposure.
    MON
    30 Mar
    60 min
    ✅ PRACTICE
    D5 + D6 Targeted Practice — 50 Questions
    D5
    D6
    • 25 questions each on D5 and D6 — anything under 70% signals a subtopic to revisit
    • Pay special attention to D6 pentest phases — commonly confused in CISSP questions
    TUE
    31 Mar
    75 min
    🔴 DEEP DIVE
    D3 Crypto Deep-Drill — Common Exam Traps
    D3
    • High-yield crypto traps (45 min): Symmetric key distribution problem → why asymmetric exists · Digital signature process (sign with private, verify with public) · Certificate pinning · Key escrow · Forward secrecy · Diffie-Hellman purpose
    • 30 D3 questions (30 min): Crypto-heavy question set. If you score >75% — D3 crypto is solid. Move attention to secure design concepts next.
    WED
    1 Apr
    75 min
    🔴 DEEP DIVE
    D4 Network Protocols Drill — OSI Attack Map
    D4
    • OSI attack mapping (45 min): Write all 7 layers + the primary attack at each. L1: Physical tap · L2: ARP spoofing, MAC flooding · L3: IP spoofing, routing attacks · L4: SYN flood, session hijacking · L5-6: SSL stripping · L7: SQLi, XSS, application DDoS
    • 30 D4 questions (30 min): Protocol and attack-identification questions. Note anything below 70%.
    THU
    2 Apr
    60 min
    ✅ PRACTICE
    D7 + D8 Practice Questions
    D7
    D8
    • 25 questions each D7 and D8 on Dest Cert
    • BCP/DRP scenario questions are commonly tested — pay attention to RTO vs RPO distinctions
    • D8: Watch for questions that mix up SAST/DAST/IAST — know the difference cold
    FRI
    3 Apr
    30 min
    💤 LIGHT
    Mixed 30Q Sprint + W2 Score Review
    • 30 mixed questions all domains. Compare per-domain scores to Week 1 — is D3/D4 trending up?
    • Write down the 3 concepts you're still least confident about going into Week 3
    WEEK 3 · 4–10 APRIL · MOCK EXAMS + TARGETED FIXES
    WEEK 3

    Exam Simulation Mode

    Two full mock exams · data-driven weak area targeting · ~16 hrs

    PRIORITY: Full Mock Exams ×2 Data-driven targeting D3/D4 final consolidation All domains review
    SAT
    4 Apr
    5–6 hrs
    🗓 WEEKEND DAY
    Mock Exam #1 (125Q) + Full Debrief
    • Morning (2.5 hrs): Full 125-question timed mock on Dest Cert — all domains, exam conditions. No phone, no looking things up.
    • Lunch break (1 hr): Step away completely. Do not review results until after the break.
    • Afternoon debrief (2 hrs): Go through every wrong answer. Create a domain score table — which domains are above 75%? Which are below? This data drives the rest of Week 3.
    🎯 TARGET BENCHMARKS Week 3 Mock #1: aim for ≥68% overall, ≥65% on D3 and D4. If you hit these, you're on track. Under 65% on any domain = that domain gets an extra deep-dive slot this week.
    SUN
    5 Apr
    4–5 hrs
    🗓 WEEKEND DAY
    Targeted Weak-Domain Deep Dives (Based on Mock #1)
    • Take your two lowest-scoring domains from Mock #1 and run a 90-min deep-dive on each
    • Use Cybrary to re-watch any specific sections that scored poorly — targeted rewatch, not full rewatch
    • Close with 30 questions per targeted domain to confirm improvement
    • If D3/D4 are still lowest: structure is — D3 security models + D4 protocol attacks. If other domains have dropped: address those instead.
    MON
    6 Apr
    75 min
    🔴 TARGET
    Weakest Domain from Mock #1 — Extra Hour
    • Dedicated 45 min of focused review on the domain that scored worst in Mock #1
    • Then 30 questions on that domain only — aim to beat your mock score by 10%+
    TUE
    7 Apr
    75 min
    🔴 TARGET
    Second Weakest Domain + D3/D4 Spot Questions
    D3
    D4
    • 45 min on second weakest domain from Mock #1
    • 20 spot questions on D3 and D4 — quick pulse check, not a full session
    • Review your cumulative wrong-answer notes — look for repeating patterns
    WED
    8 Apr
    2.5 hrs
    🎯 MOCK #2
    Full Mock Exam #2 — 125 Questions Timed
    • Second full 125-question timed mock — exam conditions, 3-hour window
    • Target: ≥72% overall · ≥70% D3 · ≥70% D4
    • After the exam, only record your per-domain scores tonight — full debrief Thursday
    THU
    9 Apr
    75 min
    🔁 DEBRIEF
    Mock #2 Full Debrief + Final Weak List
    • Go through every wrong answer from Mock #2 with full rationale
    • Create your final weak concept list — the specific topics (not whole domains) you're still dropping points on
    • This list becomes your Week 4 daily focus cards
    FRI
    10 Apr
    45 min
    💤 LIGHT
    Flashcard Review + Light Mixed Questions
    • Review your flashcard pack (or this plan's flashcard resource) — key mnemonics and concept definitions
    • 25 mixed Dest Cert questions — no pressure, just maintenance
    • Friday of Week 3 should feel like you have a clear picture of where you stand
    WEEK 4 · 11–16 APRIL · FINAL PUSH → REST → EXAM
    WEEK 4

    Final Polish. Then Rest.

    Last full study days Sat/Sun · Taper to rest · Exam Thursday

    RULE: No new material after Sunday 12 Apr Taper sessions daily Full rest Wed 15 Apr
    SAT
    11 Apr
    3–4 hrs
    🗓 LAST FULL DAY
    Final Domain Sweep + 75Q Mixed Practice
    • Morning (2 hrs): Go through your final weak concept list from Week 3. For each item: read the concept, explain it aloud to yourself, do 5-10 questions on it.
    • Afternoon (1.5 hrs): 75 mixed questions — exam-condition pace. This is your last big practice set.
    • Record your score. If ≥72% you are in a strong position. Bank that confidence.
    SUN
    12 Apr
    2 hrs
    🗓 WIND-DOWN DAY
    Mnemonics, Flashcards + Key Concept Revision
    • 2 hours max — no new material, no timed exams
    • Review your mnemonics pack: security models, OSI layers, attack types, crypto algorithms
    • Do 25 questions in a relaxed, untimed mode — confidence maintenance not pressure
    • Write out the top 10 concepts you want to remember — stick them somewhere visible
    MON
    13 Apr
    45 min
    💤 LIGHT
    Weakest Domain Only — 20 Questions Max
    • Single domain focus only — your one weakest from Week 3 mocks
    • 20 questions max. Stop when done.
    • No new reading, no new concepts. Consolidation only.
    TUE
    14 Apr
    30 min
    💤 VERY LIGHT
    Flashcard Skim + Key Mnemonics Review
    • Read through flashcards and mnemonic notes only — no active questions
    • 30 minutes hard cap. Brain needs space now, not more input.
    WED
    15 Apr
    REST
    ⭐ REST DAY
    No Study. Full Rest. This Is Mandatory.
    • Do not open Dest Cert. Do not review notes. Do not watch Cybrary.
    • Sleep well. Eat well. Do something enjoyable. Go for a walk.
    • Cognitive rest before a high-stakes exam improves performance — this is not wasted time, it is part of the strategy.
    • Lay out your documents, confirm your exam centre location and time, and pack your bag tonight.
    EXAM DAY · THURSDAY 17 APRIL 2026

    🎯 Thursday 17 April — CISSP Exam

    The exam uses Computerised Adaptive Testing (CAT) — minimum 125 questions, maximum 175. It gets harder as you get questions right. That is a good sign. Don't be rattled by hard questions — they mean you're performing well. Pace yourself at roughly 1.5 minutes per question. If stuck, use the manager mindset: risk-first, policy-over-technology, conservative over reactive.

    THU
    17 Apr
    EXAM
    🏆 EXAM DAY
    CISSP Certification Exam
    • Morning: Light breakfast. No heavy cramming — 15 min max of mnemonic review if you need to settle nerves, then stop.
    • In the exam: Manager mindset throughout. Risk-first answers. When two options look right, pick the one that addresses the root cause, not the symptom.
    • CAT pacing: 125–175 Qs in 4 hrs = ~90 sec per question. Flag and return on hard ones rather than freezing.
    • Remember: You've put in 4 weeks of structured preparation. You're ready.
    STUDY RESOURCES

    📊 Week-by-Week Score Tracker — Fill In As You Go

    D1 · Risk Mgmt
    —
    D2 · Asset Sec
    —
    D3 · Arch ⚠
    —
    D4 · Networks ⚠
    —
    D5 · IAM
    —
    D6 · Assessment
    —
    D7 · Operations
    —
    D8 · Software Dev
    —
    Update these manually after each Dest Cert session. Pass threshold = 70% per domain, 72% overall.
    🃏
    D3 & D4 Practice Question Pack
    INCLUDED IN THIS BUNDLE NEW
    • 40 CISSP-style scenario questions
    • D3: Crypto, security models, secure design
    • D4: OSI attacks, VPNs, wireless, protocols
    • Full rationale for every answer
    • Score tracking + domain breakdown
    📖
    Key Concepts Flashcard Deck
    INCLUDED IN THIS BUNDLE NEW
    • 60+ flashcards across all 8 domains
    • Security models, crypto algorithms
    • OSI layers + attack mapping
    • BCP/DRP terminology
    • CISSP mnemonics reference
    📱
    Dest Cert App Strategy
    HOW TO USE IT OPTIMALLY
    • Use domain-filter for targeted practice
    • Always read rationale on wrong answers
    • Track per-domain scores weekly
    • Timed mode from Week 3 onwards
    • Aim for 75%+ before exam week
    🎥
    Cybrary Video Rewatch Guide
    TARGETED RE-VIEWS ONLY
    • D3: Cryptography section — rewatch if <70%
    • D3: Security models — rewatch if still confusing Bell-LaPadula/Biba
    • D4: Network protocols — rewatch if OSI attack mapping unclear
    • D7: BCP/DRP — rewatch if RTO/RPO/MTD confused
    • Don't rewatch everything — targeted only

    CISSP · 8 DOMAINS · 28 DAYS · ~950 PRACTICE QUESTIONS · EXAM 17 APR 2026