CertStone is a CISSP practice bank built around one instrument: a statistically-grounded estimate of where you stand, weighted by the official exam blueprint, shown with its margin of error. It stays silent until it has real evidence.
The exam is $749 per attempt. The point is that you never book it on a feeling.
Free to sign up, no card needed. Try 25 real questions first.
original questions
subdomains covered
domains, officially weighted
scored answers before any estimate
free questions, no card
// The stakes
Booking it before you're ready doesn't just cost the fee. It also costs the weeks of momentum a failed attempt takes with it. Most candidates decide they're ready on a feeling. This app exists so you can decide on evidence.
// The readiness instrument
"You scored 78% on 200 questions" tells you almost nothing about a three-hour adaptive exam. CertStone estimates your ability instead. It turns that into a probability of passing, always shown with the range it could plausibly be.
Exam readiness
Example: not your dataLikely between 94% and 95% · a converged solution
Fill = estimated pass probability. Violet band = the range it could plausibly be.
Example only. Illustrative pass probability 95 percent, likely between 94 and 95 percent. Not a real score.
An estimate based on your answers in this app. It is not an ISC2 score and not a guarantee of any exam result.
Exam readiness
Example: early onYou've answered 22 scored questions across 2 domains. A readiness estimate needs at least 60 answers across at least 3 domains to be honest.
This is what the app shows instead of guessing. That is on purpose.
$ A confident number built on twelve answers is worse than no number.
CertStone estimates how hard a question you can reliably answer, weighted by how much each domain actually counts on the real exam.
Because every item is tagged to its specific subdomain, your weak spot comes back as "asset retention and destruction", not "somewhere in Domain 2." That is the difference between knowing you are weak and knowing what to open a book to.
// What a student sees
Overall readiness with its confidence range, per-domain ability measured against the 700 cut, and how much of each domain has actually been covered.
The estimate, the band it could plausibly sit in, and a plain-word confidence label.
Band always shownAbility in each of the domains, measured against the 700 cut, with a status word on every row.
Vs. the cutHow many subdomains have actually been answered. Unmeasured areas say so.
Subdomain coverageA weekly track against the cut, and the subdomains to open a book to next.
Next actionRead this bit. An estimate based on your answers in this app. It is not an ISC2 score and not a guarantee of any exam result. It is a study aid, not a verdict. The only thing that decides your result is the exam itself.
// The official blueprint
The exam does not weight every domain equally, and neither does the bank underneath it. This is the official ISC2 blueprint. Every question here is tagged against it, and your readiness estimate is weighted by it.
| ID | Domain | Exam weight |
|---|---|---|
| D1 | Security and Risk Management | 16% |
| D2 | Asset Security | 10% |
| D3 | Security Architecture and Engineering | 13% |
| D4 | Communication and Network Security | 13% |
| D5 | Identity and Access Management (IAM) | 13% |
| D6 | Security Assessment and Testing | 12% |
| D7 | Security Operations | 13% |
| D8 | Software Development Security | 10% |
1,600 original questions, all written for this app, covering 62 of the outline's 62 subdomains.
// Question realism
The exam rarely asks what something is. It asks which action is BEST, which comes FIRST, which is the PRIMARY concern. Then it hands you four options where more than one is defensible and only one is most defensible. 1,583 of the 1,600 questions here turn on exactly that kind of judgment call.
Written for this app, mapped to the official outline. No ISC2 text, no commercial guide text, nothing from a braindump. Memorising leaked items is precisely the study method that produces people who pass an exam and cannot do the job.
You learn which option was right, and also why the others were defensible and still wrong. That reasoning is the part the exam actually tests. Written from the manager's chair the exam expects you to sit in, not the technician's.
Each item starts with an authored difficulty, then gets recalibrated from how real students actually answer it. The label ends up reflecting reality, not the author's guess.
Missed items come back on a schedule instead of vanishing, and repeats are kept out of your ability estimate so re-grinding can't inflate it.
// Exam simulator
Most people meet three uninterrupted hours of CISSP questions for the first time on the day it counts. The simulator exists so that isn't true for you. It has the same length, the same duration, and the same silence.
| Check | Real CISSP exam | CertStone simulator |
|---|---|---|
| Length | 100–150 items | 100–150 items |
| Time | 3 hours, hard stop | 3 hours, hard stop, timed on the server |
| Feedback | Nothing until it ends | Nothing until you submit |
| Coverage | Weighted across the 8 domains | Built to the same official weights |
| Item selection | Adaptive (CAT), item by item | Optional: re-aims every 25 answers ! differs |
That last row is a real difference and worth stating plainly. You can switch adaptive selection on, and the exam will re-aim the questions you have not reached yet at how you are actually doing. However, it re-aims in blocks of 25, where ISC2's engine re-picks after every single item. It also always runs the full length: the real exam can stop as soon as it is confident, and this deliberately cannot, because an early-stop rule is only as trustworthy as the difficulty ratings behind it and ours are still mostly author estimates rather than measurements. We would rather run all 125 questions than end early on a verdict we have not earned.
No card, no trial timer. Create an account, confirm your email, and start studying. Answer 60 scored answers across enough domains and your readiness estimate unlocks.