NISP L1 PT

It suits newcomers and non-specialists: students, helpdesk and IT support staff, junior administrators, and anyone whose job touches security awareness, compliance or basic controls. If you already design secure systems or run incident response daily, the content will feel elementary and a more advanced certification is a better use of your time.

Questions are multiple choice, and the paper spans all eight domains of the body of knowledge rather than concentrating on one. Each question is self-contained, so you answer from the scenario described rather than from a figure or exhibit. The official body publishes the current paper structure and any variant details on its site.

Those figures change between sessions and regions, so no fixed number is reliable. The official body publishes the current question count, duration and sitting arrangements on its website and in the candidate handbook. Check there before you plan your timing strategy or book a slot.

Passing scores and fees are set by the official body and are updated periodically, so treat any number you see in forums as unreliable. Confirm the current passing threshold and fee schedule directly with the official body before registering. Budget for a possible retake as well.

The individual questions are not deep, but the breadth is the real challenge: eight domains means many small topics, and candidates often underestimate the legal, compliance and cryptography sections. If you study all domains evenly and practise scenario questions, most motivated beginners pass comfortably. Skipping domains is the usual reason people fail.

Start with information security fundamentals and awareness, because the vocabulary carries into everything else. Then take network security and host/endpoint security together, followed by application and data security and identity and access control. Finish with cryptography, then operations and incident response, then laws and standards - the last two reward understanding built earlier.

Three recur: ignoring the law, standards and compliance domain because it seems boring; memorising definitions without being able to apply them to a scenario; and over-studying one favourite area such as networking. A fourth is misreading questions that ask what to do first - sequence matters, and the cheapest immediate containment usually beats the most thorough fix.

Retake rules, waiting periods and any additional fees are set by the official body and are not fixed across all sittings. Check the current retake policy on its website or in the candidate handbook before you register, and plan your study schedule so a retake does not collide with other commitments.

Stop reading new material. Work through practice questions under time pressure, review every wrong answer to find the underlying concept, and reread your notes on the domains you keep missing. Confirm your registration, identification requirements and venue or online setup in advance so exam-day logistics do not cost you marks.