CISSP · WEEKEND STUDY PLAN

Two Days.
Pass the Exam.

Cybrary videos ✔ completed
Dest Cert practice questions active
Domains 3 & 4 — priority focus
Brighton day trip Saturday
DOMAINS:
D1 · Risk Mgmt
D2 · Asset Security
D3 · Architecture ⚠
D4 · Networks ⚠
D5 · IAM
D6 · Assessment
D7 · Operations
D8 · Software Dev
WEAK DOMAIN CHEAT SHEET
DOMAIN 3 · 13% EXAM WEIGHT

Security Architecture & Engineering

  • Security models — Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash
  • Cryptography — symmetric vs asymmetric, PKI, hashing, digital signatures
  • Secure design principles — least privilege, fail-safe, defence in depth
  • Common criteria & evaluation assurance levels (EAL)
  • Physical security & site design
  • Hardware vulnerabilities — TOCTOU, covert channels, emanations
DOMAIN 4 · 13% EXAM WEIGHT

Communication & Network Security

  • OSI & TCP/IP model — each layer's protocols & attacks
  • Network protocols — DNS, DHCP, HTTP/S, FTP, SMTP, BGP
  • Firewalls, IDS/IPS — types & placement
  • VPN types — IPSec, SSL/TLS, tunnelling modes
  • Wireless — WPA2/3, EAP types, rogue APs
  • Network attacks — MITM, ARP spoofing, replay, DDoS
SATURDAY
SAT · 22 MAR

Train + Evening

Travel study + focused domain review · ~5 hrs total

Train
to BN
~60 min
🚆 TRAVEL · ACTIVE RECALL
Dest Cert: Domains 1, 2 & 5 Blitz
D1 · Risk Mgmt
D2 · Asset Security
D5 · IAM
  • Open Dest Cert — do 40–50 mixed questions across D1, D2 and D5
  • For every wrong answer, voice-note the concept to yourself or jot 1 line on Notes app
  • No textbooks — phone only. Keep it high-pace, good for the commute format
💡 TRAIN TIP
Phone-based practice questions are perfect here. Dest Cert's timed mode will keep your brain warmed up and flag any easy wins you've forgotten in the lighter domains before you spend Sunday on the harder ones.
Train
back
~60 min
🚆 TRAVEL · PRIMING
Domain 3 Concept Primer (audio / notes)
D3 · Architecture
  • Re-watch or listen to the Cybrary D3 cryptography section at 1.25× speed
  • If you don't want screen: review your own notes or a single-page cram sheet on security models
  • Goal is to prime D3 concepts so your evening session starts with warm context, not cold recall
7:00–
8:30pm
90 min
🔴 DEEP DIVE
Domain 3 Part A — Cryptography & Security Models
D3 · Architecture
  • Cryptography (45 min): Symmetric (AES, 3DES), Asymmetric (RSA, ECC), hashing (SHA-2, MD5 weaknesses), digital signatures, PKI hierarchy, certificate lifecycle
  • Security Models (30 min): Draw out Bell-LaPadula (confidentiality — no read up, no write down), Biba (integrity — opposite), Clark-Wilson (transactions), Brewer-Nash (Chinese Wall)
  • 10 min brain dump: Close notes and write everything you remember on paper — forces encoding
8:30–
8:45pm
15 min
☕ BREAK
Step away from the screen
  • Drink water, get some air, no phone — let consolidation happen
8:45–
10:00pm
75 min
✅ PRACTICE
Dest Cert: Domain 3 Only — 50 Questions
D3 · Architecture
  • Filter Dest Cert to Domain 3 only — do at least 50 questions
  • Screenshot or note every question you get wrong with the correct answer rationale
  • Track your score — this is your Saturday baseline to beat on Sunday
  • Finish by 10pm — late cramming degrades memory consolidation during sleep
💡 CISSP TIP
CISSP questions test manager thinking, not technician thinking. When stuck between two answers, ask: "What would a risk-aware manager with budget responsibility choose?" Usually the most conservative, policy-first option wins.
SUNDAY
SUN · 23 MAR

Full Study Day

All 8 domains · heavy D3/D4 focus · mock exam · ~9 hrs

8:00–
8:30am
30 min
🔁 REVIEW
Saturday Wrong Answers Review
  • Read through the notes/screenshots of everything you got wrong on Saturday
  • Don't do new questions yet — solidify Saturday's weak spots first
  • Tea/coffee in hand, relaxed read-through is fine
8:30–
10:00am
90 min
🔴 DEEP DIVE
Domain 3 Part B — Secure Design & Physical Security
D3 · Architecture
  • Secure design principles (30 min): Least privilege, separation of duties, fail-safe defaults, economy of mechanism, complete mediation, open design, layering
  • Hardware & system vulnerabilities (30 min): TOCTOU, covert channels (timing/storage), maintenance hooks, state attacks, Common Criteria EAL levels 1–7
  • Physical security (30 min): Crime Prevention through Environmental Design (CPTED), mantraps, proximity cards, CCTV placement, environmental controls (Halon vs FM-200, VESDA)
10:00–
11:30am
90 min
🔴 DEEP DIVE
Domain 4 Part A — OSI Model, Protocols & Firewalls
D4 · Networks
  • OSI 7 layers cold recall (20 min): Write all 7 layers from memory with their associated protocols and attacks at each layer
  • Core protocols (40 min): TCP vs UDP handshake, DNS (types of records, DNS poisoning), DHCP (starvation, rogue DHCP), BGP hijacking, ARP & ARP spoofing
  • Firewall types (30 min): Packet filter, stateful inspection, application proxy, NGFW — know the differences and where each sits in the network
11:30–
12:30pm
60 min
🍽 BREAK
Proper Lunch — No Study
  • Step fully away. Eat well. A 60 min proper break mid-day sustains afternoon performance
  • If you want to be cheeky, listen to a CISSP podcast or YouTube video passively while eating — but no active study
12:30–
2:00pm
90 min
🔴 DEEP DIVE
Domain 4 Part B — VPNs, Wireless & Network Attacks
D4 · Networks
  • VPN deep dive (30 min): IPSec (AH vs ESP, tunnel vs transport mode), SSL VPN vs IPSec VPN, split tunnelling risks, L2TP, PPTP (why it's insecure)
  • Wireless (30 min): WEP/WPA/WPA2/WPA3 progression, EAP types (PEAP, EAP-TLS, EAP-TTLS), rogue AP & evil twin, KRACK attack, WPS vulnerabilities
  • Network attacks (30 min): MITM, replay attacks, session hijacking, DDoS types (volumetric, protocol, application-layer), smurf, fraggle, IP spoofing
2:00–
3:30pm
90 min
✅ PRACTICE
Dest Cert: Domains 3 & 4 — 75 Questions
D3 · Architecture
D4 · Networks
  • Do 75 questions split across D3 and D4 — compare your score to Saturday's D3 baseline
  • For every wrong answer: read the full explanation, then re-state the concept in your own words
  • Target: >70% on both domains before moving on. If under 65%, note the specific subtopic
3:30–
3:45pm
15 min
☕ BREAK
Short reset before final domains sprint
  • Walk around, fresh drink
3:45–
5:15pm
90 min
🔁 RAPID REVIEW
Domains 6, 7 & 8 — High-Yield Sweep
D6 · Assessment
D7 · Operations
D8 · Software Dev
  • D6 (30 min): Pentest phases, vulnerability scanning vs assessment vs pentest, CVSS scoring, audit types, SOC reports (SOC 1/2/3), code review methods
  • D7 (30 min): Incident response phases (PICERL), forensics (chain of custody, order of volatility), BCP vs DRP, RTO/RPO, backup types (full/incremental/differential)
  • D8 (30 min): SDLC phases & security at each, OWASP Top 10 memory peg, static vs dynamic analysis, fuzzing, threat modelling (STRIDE, DREAD), DevSecOps
💡 D6/7/8 TIP
For these domains you've already watched the videos — focus on how concepts connect, not re-learning from scratch. If something feels fuzzy, just do 10 targeted Dest Cert questions on that subtopic.
5:30–
7:30pm
2 hrs
🎯 MOCK EXAM
Full Mixed Practice Exam — 125 Questions
D3
D4
D1
D2
D5
D6
D7
D8
  • Set Dest Cert to mixed all-domain mode, timed, 125 questions — simulates actual exam conditions
  • No looking anything up mid-exam. Commit to answers and move on
  • After the exam: review by domain — which domains are you still losing points in?
  • Target overall: ≥72% — that's a strong signal you're tracking for a pass
💡 CISSP EXAM MINDSET
The real exam uses Computerised Adaptive Testing (CAT) — it gets harder as you get things right. A score of 72%+ on Dest Cert's hardest questions is a reliable pass predictor. Don't obsess over easy questions — CISSP rewards nuanced, managerial thinking.
7:30–
8:00pm
30 min
🔁 DEBRIEF
Mock Exam Debrief + Plan Next Week's Weaknesses
  • Note your per-domain scores from the mock exam
  • Write 3 bullet points per weak domain for next week's focus
  • Stop studying by 8pm — your brain needs consolidation time, not more input
GENERAL STUDY PRINCIPLES

Keep These in Mind All Weekend

Think like a manager, not an engineer — CISSP is a managerial qualification above all.
When two answers seem right, pick the one that addresses risk or policy first, technology second.
Use the brain dump trick: after any 90-min block, close everything and write what you remember.
Dest Cert wrong answers are gold — read the full rationale, don't just note the correct letter.
Sleep is non-negotiable — Saturday night's sleep is when D3 and D4 material consolidates.
Don't rearrange the plan mid-day — commit to the structure even if a session feels harder than expected.

CISSP · 8 DOMAINS · ~250 PRACTICE QUESTIONS THIS WEEKEND · YOU'VE GOT THIS