CISSP question types: drag-and-drop, hotspot and multiple choice

The question types at a glance

ISC2 does not publish how many advanced items you will see or how they are scored, so treat every part of every item as needing to be right.

Multiple choice: finding the best answer

Often two or three options are technically correct. The exam wants the one that fits the role, the goal and the moment described.

1. Read the final sentence first. Notice the keyword: FIRST, BEST, MOST, LEAST.
2. Identify your role in the scenario. A security manager and a system administrator have different first moves.
3. Eliminate options that are true but answer a different question.
4. Between the last two, prefer the one that addresses the root cause, protects people, or follows policy and management direction.

The think like a manager guide covers this reasoning in depth.

Multiple select

Read the instruction for how many to choose, if one is given. Judge each option on its own as true or false for the question asked. Do not let a strong option pull a weak neighbour in with it.

Drag-and-drop

Sequence items

You place steps in order. These reward processes you have rehearsed, not ones you can recognise on sight.

• Learn each process as a numbered list you can write from memory.
• Anchor the first and last steps, then fill the middle.
• Watch for steps that sound alike, such as mitigation and remediation, or response and recovery.

Example from our own practice set (not an exam item): order the steps for handling a suspected breach, from detection through to lessons learned. If you can write the sequence on a blank page, the item takes seconds; if you cannot, no amount of staring helps.

Pairs items

You match one list to another, such as attacks to their primary control. Make your surest matches first, then work the rest by elimination. If the lists are uneven in length, some options will be spare.

Hotspot

You click on part of a diagram, often a network or facility layout. Before clicking, describe to yourself what the control does and where it must sit to do it. A sensor that must see all traffic entering a segment belongs at that segment's boundary, not inside it. Practise by sketching common architectures and marking where the main controls go.

Scenario questions

A scenario gives you a short case: an organisation, a problem and constraints such as budget, law or time. Some practice banks, ours included, attach several questions to one scenario. Read the case once for the facts that change the answer, then answer each question against those facts, not against what you would do at your own workplace.

Habits that work for every type

• Practise under exam conditions: no going back, a clock, a variable length. The CAT exam explainer covers why.
• Review every wrong answer until you can say why each other option was wrong.
• Do not use braindumps: they breach the ISC2 NDA and train recall of items rather than judgement.

Pacing across item types

Advanced items take longer to read and answer than a single multiple-choice question, and the clock does not care which type you are on. Do not let one diagram eat five minutes. Make your best call, confirm it and move on; the passing score rests on all your scored answers, not on any single item.

Next steps

Try a short set of our own questions, including drag-and-drop and hotspot items, in the practice set on this page. Then see how the item types fit into the exam format and a wider bank of practice questions.