It's based on the candidate's total overall score. You can be strong in some domains, and weak in others, just as long as your scaled score adds up to 700 then you're good to go. We all have our strengths and weaknesses...just be competent (devote more study time in your weak areas) in all areas and you should be fine.
Having said the aforementioned, I'd advise knowing as much material as possible for the exam, and being competent in all the domains. So many of the questions involve multiple domains concepts, and it's up to the candidate to decompose the problem(s) they're being asked to solve, and often provide the BEST answer. Don't expect to completely suck at Applications Security and Data Security, for example, and have enough wiggle room to pass. Again, be competent in all domains...even your weak ones.
I passed the ISSAP and CCSP exams back in January and February, and I felt comfortable with all the materials on the test - no surprises! I have six ICS2 certifications and, while we all enjoy passing, I've never liked not being provided with a scored exam report. This is different than ISACA who provides ALL exam takers (whether you pass or fail) with a scored report: overall weighted score (which is used for pass/fail) and by domain.
For example, some years ago I passed the CISA exam with a scaled score of 569 (needed a 450). It was invaluable to look at how I scored in each of the five domains for myriad reasons. First, when I was doing auditing and security assessments, someone else led the overall IT Auditing team, while I handled everything related to security (architecture, engineering, operations, controls, etc.). Sure, I'd help out with unique systems (e.g., mainframe, IoT, cloud) and other stuff from time-to-time, but mainly stayed in my lane.
So imagine my surprise when I saw that--while I passed-- I scored only 442 (below the 450 overall minimum) in the Information Systems Operations and Business Resilience domain. WTF?, I KNOW security operations and business continuity and disaster recovery...so this had me perplexed, especially when I scored 681 in Asset Protection and 659 in IT Governance.
It later occurred to me that I was answering these "Best" and "Next" type domain questions from the perspective of a Security Operations guy supporting BC/DR and not a Business Owner's perspective supporting BC/DR. It was nice to know how well I performed on the exam, and a nice lesson-learned.
Finally, I approached the CCSP as being an Enterprise/Cloud Security Architect type being asked to solve problems and make business recommendations. Good luck!
