Reading questions and eliminating options

Many wrong answers on the CISSP come not from missing knowledge but from answering a slightly different question from the one asked. The stem says FIRST and the candidate picks the most important step; the stem says BEST and the candidate picks a correct but weaker option; the scenario names the data owner and the candidate answers as if they were the system administrator. This lesson builds a reading routine that catches those slips, shows how distractors are usually built, and practises eliminating options in a consistent order.

Hannah and Tomás each lose several marks to misreading in their diagnostic. Hannah reads quickly because she knows the governance material well and assumes she knows what is being asked. Tomás reads the scenario carefully but skims the final question. By the end of this lesson they have one routine they both use for every item.

The anatomy of an item

Most CISSP items have three parts. The scenario, sometimes only one sentence and sometimes a short paragraph, sets the situation: who you are, what has happened and what constraints apply. The stem is the actual question, usually the last sentence. The options are four possible answers, of which one is best. Advanced items replace the four options with a different response format, such as dragging items into order or clicking an area of a diagram, but the same reading discipline applies.

Reading the stem before the scenario is a useful habit for long items. If you know the stem asks who is accountable for classification, you can read the scenario looking for roles rather than technical details. For short items the order matters less, but the stem should always be read twice: once before looking at the options and once just before confirming an answer.

Task words and qualifiers

A handful of words carry most of the meaning in a stem. Capital letters are often used for them, but not always, so train yourself to notice them in any case. Each word asks for a different kind of judgement.

FIRST questions deserve special care. Many describe an incident or a discovery and offer four sensible steps, all of which would eventually happen. The answer is the one that logically comes first. In incident response, that is usually to confirm and contain within the plan, or to notify the incident response team, before eradicating or recovering. In a new project, it is often to identify the asset owner or define requirements before choosing controls. In a policy question, it is often to gain senior management support before writing the policy.

Qualifiers in the scenario matter too. Words such as 'regulated', 'public company', 'cloud provider', 'already approved', 'without budget' or 'legal hold' change which answer is best. A scenario that says the data is subject to a legal hold makes any option that deletes or alters it wrong, even if deletion is normally good practice. Underline these in your head as you read.

A five-step routine

The routine below takes about ten seconds longer than a quick read and saves far more than that in avoided errors. Hannah and Tomás practise it on every item until it becomes automatic.

Step 2 is where many marks are won. If the item says 'As the data owner', the answer will involve decisions about classification, access approval or risk acceptance for that data. If it says 'As the auditor', the answer will involve evaluating and reporting, not fixing. If it says 'As a consultant hired to advise', the answer will often be to recommend rather than to implement. CISSP-111 and CISSP-110 described these roles; the exam uses them constantly.

How distractors are built

Item writers build wrong options deliberately, and most fall into a few families. Recognizing the family helps you eliminate them quickly and with confidence.

The hardest items usually end with two options left that are both 'right' in some sense. At that point, compare them directly against the stem. Which one addresses the root cause rather than a symptom? Which one is broader and includes the other? Which one is earlier in the process? Which one serves a higher priority on the manager's ladder from lesson 2? One of these tests nearly always separates them.

Worked example: a FIRST question

Tomás chose D on his first attempt. He reasoned, correctly, that blocking the address would stop the exfiltration. The item, however, names the role (analyst) and the constraint (an approved plan). Lesson 2's process priority and this lesson's reading routine both point to B. When he rereads the stem in step 5, the word FIRST and the phrase 'approved incident response plan' make the choice clear.

Worked example: a BEST question with two good answers

Worked example: a NOT question

Hannah, reading quickly, picked A on her first try. She saw the phrase 'responsibility of a data owner', recognized classification as an owner duty and clicked. The word NOT was in the middle of the stem, not capitalized. Step 1 of the routine, reading the stem slowly and naming the task word, would have caught it.

Advanced item types

A small share of items use other formats. In drag-and-drop items, you place options into categories or put steps into order. In hotspot items, you click the part of a diagram that answers the question, such as the network zone where a control belongs. These items test the same knowledge but give less room for elimination, because there are more possible arrangements. Published guidance from training providers suggests they are scored on the whole response, so a partly correct order earns no credit.

The routine adapts easily. For an ordering item, identify the first and last steps with confidence and then fill the middle. For a categorizing item, sort the items you are sure of first, then use elimination for the remainder. For a hotspot, read the diagram's labels carefully before clicking, because a misplaced click is as wrong as a wrong option. Tomás practises ordering items on the incident response and software development life cycles, which are the most common subjects for them.

# Score a practice ordering item: whole-response scoring vs partial credit (for study only)
correct = ["Preparation", "Detection and analysis", "Containment", "Eradication", "Recovery", "Post-incident activity"]
attempts = {
    "Tomas":  ["Preparation", "Detection and analysis", "Containment", "Eradication", "Recovery", "Post-incident activity"],
    "Hannah": ["Preparation", "Detection and analysis", "Eradication", "Containment", "Recovery", "Post-incident activity"],
}
for name, order in attempts.items():
    matches = sum(a == b for a, b in zip(order, correct))
    whole = "correct" if order == correct else "incorrect"
    print(f"{name:<7} positions right {matches}/{len(correct)}  whole-response result: {whole}")

Tomas   positions right 6/6  whole-response result: correct
Hannah  positions right 4/6  whole-response result: incorrect

Hannah has four of six positions right but swapped containment and eradication, so under whole-response scoring she earns nothing. The program is a reminder that an ordering item rewards a precise model of the process, not a rough sense of it. Her fix is to remember why containment comes first: you limit the damage before removing the cause, so that eradication does not trigger further harm.