Capstone — Full-Domain Practice Exam
Every domain in one sitting: a 24-question scenario quiz (3 per domain), a cross-domain MCQ set, and a multi-domain case study — the roadmap's final checkpoint before booking the real CAT exam.
Learning Objectives
- → Answer scenario-level questions across all 8 CBK domains without a domain label telling you which lesson to recall from
- → Recognize when a single scenario draws on more than one domain at once, the way real CAT questions often do
- → Apply the manager-vs-technician reflex under exam-like time pressure, not just when a lesson has just told you to
- → Use this attempt's score, not a calendar date, to decide whether you're ready to book the real exam
Every lesson so far has told you which domain you were in before you read the first sentence. The real CAT exam doesn't do that — a question just arrives, and part of what it's testing is whether you can recognize which domain's reasoning applies, sometimes more than one at once, without a heading to prompt you. This capstone is built to remove that scaffolding.
How to use this lesson
Don't treat this as one more lesson to skim. Set aside a real block of time, close your notes, and take the 24-question quiz below in one sitting, the way you'd sit the actual exam — no pausing to look anything up mid-question. Then, and only then, review what you missed. The MCQ set and case study that follow are for after that first honest attempt, not before it.
Reading a mixed-domain scenario
A single CISSP scenario can legitimately draw on two domains at once. Consider: "A company's incident response team, while investigating a breach, discovers the attacker gained access via a service account that was never de-provisioned after a contractor's engagement ended 14 months earlier." This scenario is simultaneously D7 (the IR process handling the discovery) and D5 (the de-provisioning failure that caused it) — a question built on it might ask about the immediate containment step (D7 reasoning) or about the structural fix that would have prevented it (D5 reasoning, specifically Lesson 5's authoritative-trigger argument). Recognizing which reasoning a specific question is actually asking for, when the scenario itself spans domains, is a skill this capstone deliberately exercises — it's also exactly how the real exam is built, not an artificial complication added here.
The one rule that hasn't changed since Lesson 1
Every distractor across every domain in this roadmap has failed for one of a small number of reasons: it optimizes a technical fix without addressing the organizational cause, it violates a specific named principle (least privilege, separation of duties, evidence-based approach), it costs more than the risk it removes, or it answers a question that wasn't actually asked. When you're unsure between two plausible answers under real time pressure, that checklist — not a guess — is the tool. This is the single idea the entire roadmap has been building toward one domain at a time, and this capstone is where you find out if it's actually reflexive yet, or still something you have to consciously remember.
After you finish
A score at or above 80% on this capstone, consistently across a couple of attempts (retake it after a few days — the questions are the same, but so is the point: consistency matters more than a single good run), is a reasonable signal you're ready to move toward booking the real exam. Below that, the quiz results tell you exactly which domain to revisit — go back to that domain's lessons, not to this capstone again immediately.
Reread the service-account scenario from this lesson's content: an incident response team discovers a breach traced to a service account never de-provisioned after a contractor's engagement ended 14 months earlier. Name the TWO domains this scenario draws on, and state specifically what each domain's reasoning contributes to fully understanding what went wrong and what should happen next.
What two domains does this scenario draw on, and what does each contribute?
You're presented with a scenario question where two answer choices both technically address the described problem. One choice is faster and cheaper to implement; the other is slower but addresses why the problem occurred in the first place. Using the pattern from every lesson in this roadmap, which choice is more likely correct on the real exam, and why does 'faster and cheaper' not settle the question by itself?
Which choice is more likely correct, and why doesn't 'faster and cheaper' settle it?