CISSP flashcards: how to use spaced repetition

Why flashcards, and why spaced

The CISSP syllabus is wide. By the time you reach Software Development Security, much of what you read in Security and Risk Management has started to fade. Re-reading is slow and gives a false sense of knowing. Retrieval, trying to recall an answer before you see it, is what actually strengthens memory.

Flashcards are the simplest form of retrieval practice. Spacing makes them efficient: instead of reviewing every card every day, you review each card at the moment it is about to slip. Cards you know well come back after weeks; cards you struggle with come back tomorrow.

How spaced repetition works

Every time you review a card, you rate how well you recalled it. The scheduler uses that rating to decide when you should see the card again.

The idea behind the schedule

Memory decays over time, and each successful recall makes the next decay slower. A good scheduler tries to bring a card back when your chance of recalling it has dropped to a chosen target, often around 90%. Too early wastes time; too late means relearning.

FSRS in plain words

FSRS (Free Spaced Repetition Scheduler) is a modern, open-source scheduling algorithm. For each card it tracks three things:

After each review you choose Again, Hard, Good or Easy. A correct recall increases stability, so the next interval grows; a lapse cuts it back. Compared with older fixed-multiplier schedules, FSRS fits intervals to how your memory actually behaves, which usually means fewer reviews for the same retention.

In CISSP Buddy, flashcards use FSRS with a 90% retention target, so a card comes back when we estimate you have about a nine in ten chance of still knowing it.

Rate honestly

The scheduler is only as good as your ratings. If you hesitated and half-guessed, that is Hard, not Good. If you got it wrong, press Again without guilt. Inflated ratings push cards too far out and you will meet them again on exam day, forgotten.

What to put on a card

A good card asks one question with one short answer. Three kinds of content work especially well for the CISSP.

Definitions

Short, precise meanings, especially where two terms are easy to confuse.

• Due diligence vs due care → Due diligence is investigating and planning what is needed; due care is acting on it as a reasonable person would.
• Recovery point objective → The maximum acceptable amount of data loss, measured as time since the last good copy.
• Recovery time objective → The maximum acceptable time to restore a process after a disruption.

Processes and sequences

Steps in order, one card per step or per transition, rather than the whole list on one card.

• In a risk assessment, what comes after identifying assets? → Identifying the threats and vulnerabilities that affect them.
• What does a business impact analysis produce that recovery planning depends on? → Priorities and tolerable downtime for each critical process.

Comparisons

Pairs or small sets the exam likes to contrast.

• Bell–LaPadula protects → ? Confidentiality: no read up, no write down.
• Biba protects → ? Integrity: no read down, no write up.
• Symmetric vs asymmetric encryption: which is faster for bulk data? → Symmetric.

Manager's view cards

A line that captures a mindset rule, tested with a scenario prompt.

• A fire alarm sounds during a server migration. First priority? → Get people out safely; systems wait.

What not to put on a card

• Long paragraphs. If the answer takes more than two lines to say, split it or leave it for reading.
• Long lists on one card. "Name all the phases of X" turns into a card you always half-fail. Use one card per item or per transition.
• Things you do not understand yet. Learn the concept first, then make the card. Memorising words without the idea does not help with scenario questions.
• Obscure trivia. Rare port numbers, version histories and vendor product names cost time and rarely decide a question.
• Copied text. Cards written in your own words stick better, and copying from books or courses raises copyright problems if you share the deck.
• Exam content. Never make cards from anything claiming to be exam material. Braindumps breach the ISC2 non-disclosure agreement, and using them can cost you the credential, so do not use them.

A worked example: turning one topic into cards

Say you have just studied access-control models. Instead of one card that asks "explain the access-control models", write several small ones:

• Discretionary access control (DAC): who decides access? → The owner of the resource.
• Mandatory access control (MAC): who decides access? → The system, by comparing labels on subjects and objects; owners cannot override it.
• Role-based access control (RBAC) grants access by → ? Job role.
• Attribute-based access control (ABAC) grants access by → ? Policies that evaluate attributes of the user, resource and context.
• Which model fits a military classification scheme best? → MAC.
• A hospital wants access to follow job function as staff change wards. Which model? → RBAC.

Six short cards, each answerable in a few seconds, cover the definitions, the key distinction and two applications. The application cards are the ones that help most on scenario questions.

Flashcards versus practice questions

They do different jobs, and you need both.

A ready-made deck or your own?

Both work, and most people end up with a mix.

A ready-made deck saves hours of writing and covers topics you have not reached yet, so you can review a domain the day you finish reading it. The risk is cards you do not fully understand: if a card's answer means nothing to you, go back to the topic before you keep reviewing it.

Your own cards stick better, because writing them is itself a form of learning, and they target exactly the gaps your practice questions reveal. The cost is time; writing good cards for a whole domain can take as long as studying it.

A sensible split is to start from a well-written deck for coverage, then add your own cards only for the questions you get wrong and the distinctions you keep confusing. Keep your own cards in the same scheduler, so one daily review covers everything. Whichever you use, retire a card that keeps failing for the wrong reason, such as an ambiguous prompt, rather than forcing it.

Common mistakes

• Adding too many new cards in week one. The reviews pile up two weeks later and the habit breaks. Start small.
• Skipping days, then binging. A long session after a gap feels productive but works less well than short daily ones.
• Rating generously. Half-remembered is Hard, not Good.
• Never deleting. If a card is ambiguous or you keep failing it for the wrong reason, rewrite it or remove it.
• Using flashcards instead of drilling. Cards hold facts; questions teach judgement. Keep both in your week.

A daily routine

Flashcards should be the most reliable ten minutes of your day, not the longest hour.

1. Same slot every day. The commute, the first cup of chai or coffee, or the wait before a meeting.
2. Due cards first. Clear what the scheduler says is due before adding anything new.
3. Cap new cards. Ten to twenty new cards a day is plenty. Each new card brings several reviews in the following week.
4. Ten to fifteen minutes. Stop when the time is up, even if cards remain. Missing a day is fine; the scheduler adapts.
5. Tie new cards to what you studied. Add cards for the subdomain you read or drilled that day, so learning and review reinforce each other.
6. Feed mistakes in. When a practice question shows a gap, add or bring forward the card that covers it.

Flashcards across a study plan

How flashcards work in CISSP Buddy

Our deck has 1,600+ cards we wrote ourselves, one deck per domain, organised by subdomain and scheduled with FSRS. When a practice session shows a gap, adding that subdomain to your reading list makes its cards due straight away. Flashcards also work offline, for the commute with no signal. The daily planner fits flashcard reviews into the hours you set, alongside drills and reading.

Next steps

• Fit flashcards into your week with the study plan guide.
• Test what you remember with our free practice questions.
• See the full method in how to pass the CISSP.