Know the format. 90 multiple-choice questions in 150 minutes, about 100 seconds each. Passing is 450 on a scaled 200-800 score. There is no penalty for wrong answers, so never leave one blank.
Weight your time. Domain 3 is 38%, Domains 1 and 2 are 31% each.
Think like a security manager. The best answer links to business objectives, uses risk to decide, and assigns ownership. A purely technical fix is rarely the best answer to a program question.
Process before tools. Establish the policy, inventory and risk assessment before buying a control.
First, second, best. When several answers are good, pick the one that comes first in a sensible sequence (assess before treat, contain before eradicate).
AI is not magic. The control families are familiar (access, logging, change, supplier assurance). Ask what the AI-specific twist is: training data, model integrity, prompt input, autonomy.
Do not over-trust vendors. Embed requirements and verify; do not assume.