Know the format. 100 multiple-choice questions in 2.75 hours (IAPP FAQ, checked 2026-11-07), about 99 seconds each. Passing is 300 on a 100-500 scale with no section minimums, so a weak domain can be offset.
Read the verb. The blueprint says the opening verb of each skill statement signals question difficulty. "Identify" and "define" are recall; "evaluate" and "implement" are judgment.
Find the role first. Provider, deployer, importer or distributor? The obligation follows the role.
Find the stage next. Is the scenario in design, training, release, deployment or monitoring? The right control differs at each stage.
Prefer documented and proportionate. The best answer assigns an owner, records the decision and fits the risk. Reject answers that are extreme (ban everything) or informal (trust the vendor).
Law versus guidance. A question that says "required" points to a law. "Voluntary" or "framework" points to NIST or OECD.
Use the ranges. Domains III and IV are about half the exam together (21-25 questions each).
No new facts. Answer from the stated scenario, not from what you think might also be true.