Some thoughts on the CISSP exam taken Dec. 10

mikeyoung

First I will discuss my preparation, then talk a little about the exam and then what I would/will do next time. Also, let me say that I have been working in IT (in some form or another) since 1976 and currently I am the Director of Technology for a medium-sized community bank in Florida.

I began preparing by taking an excellent online course from Intense School back in September. I then read Shon Harris’s 3rd. Ed, portions of Kurtz and Vines book, and began taking test questions until Early November when I really ramped up my efforts by studying two hours a day , with three to four hours each day on the weekend. I used the CCCure.org test questions, Shon’s CD test engine and a book called Examwise for the CISSP. I also continued reviewing Shon’s book on my weak areas which were numerous and I used Mike Overly’s excellent review and study guide on the CCCure.org site. I took the Thursday before my test off from work to study and take practice tests and on Friday, drove the six hours to St. Pete on Friday, got there in the afternoon, went and found the test facility, had a good dinner, reviewed some test questions and got about seven hours of sleep.

I took the test at the EpiCenter at a satellite of St. Petersburg College. It was an outstanding facility and a great and comfortable place to take the exam. It was a little cool in the room, but that was fine with me. There were 15 test takers and four proctors.
Every one was spaced out well and there was plenty of room in the room and on each table. I showed up around 8:10, we went to the room and were briefed by the proctors at 8:30 and our test began at 8:55. It was all very orderly and well-handled.

The test was far and away the hardest exam I have ever taken and it took me five and a half hours. It took me 2 and half hours to go through it the first time. That was when I answered all of the questions that I felt comfortable with and circled the ones I felt I might not know the answer too. The first hour was very depressing because I was circling a lot more than I was answering. But I then I settled down some and got into a rhythm and seemed to do much better. After that first run, I had answered 167 and that left 84 that I needed to work on.

Let me say right here, that I wrote in the test book a lot. I underlined negative parts of questions, I “x’ed” out answers that I knew were wrong, I wrote notes to myself and I think all of that really helped me with the rhythm and feel.

When I went back through the second time, I wondered why I circled some of the questions, because THEN I felt like I knew more answers. I attribute that to my initial nervous and subsequently getting into that rhythm. Of course there were still some that I didn’t know for sure and others that I KNEW I just simply did NOT know. Many questions had at least two answers that I thought were VERY good answers, a few even had three. I tried to use the exam as a study guide, hoping that some answers would be revealed in other questions, but this was not a useful tactic. I got to the point where I just had to pick what I thought was the best answer and move on.

I took lots and lots of tests from several sources and I would have to say that there were only 20 or 25 questions that I had ever seen before ANY where. So I have to tip my hat to ISC2 for keeping this Exam unique and challenging. There were questions that I knew I should know the answer to, or that I knew I remembered reading, but those questions were just asked in a different way than I had been thinking about on that particular topic. Those were killers for me, because I started doubting myself and my other answers. I was “up” and “down” so many times, going from confidence to panic and back within minutes.

Any way, it took, me another two hours to go back through again and after that I still had five questions to which I just could not find any answers for in my experience or my readings. I filled in my answer sheet (which I hadn’t touched since the initial briefing) and that took an hour. I do not like detail work with my hands and filling in all of those little circles was tedious and stressful trying to make sure I got them all in the right order but I did it. That took an hour so I was at 5 and half. I went back, briefly to those last five questions one more time and just picked what I thought would be right. Then I wished myself one last little bit of luck and turned in my stuff.

Later, when I was waiting outside for my ride, one of the proctors walked by and asked me if I was relaxing and I said, “No, I am just trying to remember my name.” I was pretty much brain dead at that point.

And now comes the hardest part of all. Waiting for the results. I think that if I pass, it will be by a slim margin. I will say this about my personal preparation: I studied as hard as I could for the last month, but I should have done that for the last two months, because like I said, there were some questions that I knew I had seen before in material I had just skimmed over, or really didn’t study in the necessary detail, because I felt comfortable with it. There were some things I studied in great detail that I did not even see on the test. There is just so much material they can chose from.

So if I had it to over again, I think I would have read more and put less emphasize on practice tests AS A LEARNING AID. I would still use practice tests, but only for measuring where I stand.

Right now, I have to assume that I failed and I am going to keep studying and reading Shon Harris and Kurtz and working on my weak areas and try to re-test as soon as possible. I just feel like I can’t let my brain dismiss all I HAVE learned.

If anyone feels like I have had said too much about the actual exam, please let me know and I will edit the post accordingly.

Any way that is a very long-winded post, but I hope it will help some one else prepare for, and/or understand the exam process. I am posting it to two different forums, CCCure.org and TechExams.net, that have been extraordinarily valuable to me. Rather I pass or not, I would not have had a the slightest chance without the support from these forums… So Finally, THANK YOU to all who post here. For your knowledge and wisdom, for your preparation techniques and mostly for your support. Thank you, Thank you, Thank you.


Mike

Webmaster

Thanks for the review Mike! I don't think many do, but after reading how challenging it has been for you after all your preparation it shows again this exam should not be underestimated.

I hope you'll get some relieving news soon, you definitely deserve it after the hard work.

JDMurray

What an excellent review! You've scared the Hell out of me, and I'm only looking at taking the SSCP in two years!

So what about food and bathroom breaks? I can't go three hours without eating and drinking let alone six. Does a proctor follow you into the bathroom like a parole officer does?

Webmaster

I read on a ISC2 page that you are allowed to go to the back of the room to a 'snack area', but still 6 hours is a loooong time reading and marking questions.

2lazybutsmart

Webmaster wrote:

I read on a ISC2 page that you are allowed to go to the back of the room to a 'snack area'

to go pee?

Webmaster

2lazybutsmart wrote:

Webmaster wrote:

I read on a ISC2 page that you are allowed to go to the back of the room to a 'snack area'

to go pee?

Maybe if it's way way in the back of the room.

jdmurray wrote:

So what about food and bathroom breaks?

mikeyoung

Yes, you can take food and drink and take breaks in the back of the room, but you don't get a "time out," and once the clock starts, it doesn't stop. I should have noted in my original post, that I took two breaks, one for 5 minutes and one for 10. I brought a couple of power bars and a bottle of water. so on the first break, I just stood up and drank some water (that was about 1. 5 hours) and on my second break, I went to the bathroom, ate one of my power bars and drank some water (that was about 4 hours). Both breaks were very refreshing and just enough to clear my head. Every one else seemed to do the same. No one follows you to the bathroom, but they only let one "candadate" leave the room at a time.

TeKniques

Dang, so pretty much show up with a full stomach and well rested. This exam experience sounds like it is grueling and requires a lot of self discipline to stay focused.

Hope you passed! Good luck.

keatron

Yeah it was pretty rough. Not to mention, after 3 hours have passed, the proctor has to announce every hour that you have one less hour left. I was especially freaked out when he said "you have 3 hours left" and I was only on question 95!!! But I made it and I'm sure Mike will too.

HHHTheGame

I took it a few years ago and missed it by probably 20 questions. I had (at the time) three years of excellent hands-on experience and a few years of other experience in IT. I read three or four of the top books, watched all of the LearnKey CDROMs, and ran through a ton of practice tests. I hauled my butt down to Chicago the day before, had a good dinner, watched the NFL draft (to see the Packers take Ahmed Carroll in the first round... UGH!!!) ran through as many of the Boson test questions on my laptop as I could, and got to bed. Got up early to get a good breakfast and get the jitters out. I did the exam on one run through (which was my first mistake). Took about three hours.

Since then I've had another kid so my studying time has been limited. I am gearing up to take it again this June since they have a location in Milwaukee (10 miles away) this year.

Webmaster

Hi HHHTheGame and welcome,

HHHTheGame wrote:

I took it a few years ago and missed it by probably 20 questions.

Did you get score results a few years ago or are you guessing based on how many questions you didn't know?

I am gearing up to take it again this June since they have a location in Milwaukee (10 miles away) this year.

How are you preparing for the exam? And were the Bosons any good?

keatron

Johan, candidates now will get a score back if they don't pass. There is no break down by sections but you do get a score. The candidates who pass will not receive a score, just a congratulations email.

I'll add something that I find kind of funny. I've read in many places (including some well know trade magazines) that the pass percentage was up around 70%. I'm prohibited from giving the exact percentage, but I can tell everyone here for a fact, that it's not even close to that. ,So study well and you'll be fine my man.

Webmaster

Ok I see, sounds very fair.

As for the percentage, the ISC2 site mentions "the passing grade required is a scale score of 700 out of a possible 1000 points on the grading scale", so I can imagine why they say the pass percentage is up around 70%. It's a common mistake to assume all questions weight equally. Regardless, personally I don't focus on the score.

keatron

Webmaster wrote:

Ok I see, sounds very fair.

As for the percentage, the ISC2 site mentions "the passing grade required is a scale score of 700 out of a possible 1000 points on the grading scale", so I can imagine why they say the pass percentage is up around 70%. It's a common mistake to assume all questions weight equally. Regardless, personally I don't focus on the score.

Johan, sorry let me clarify. I was referring to people saying things like 70% of all people attempting the examination pass. My fault for not being clearer/

Webmaster

No problem, I automatically assumed you were talking about the score, but there's of course that other pass percentage. 70% does sound like a lot. Even for the CCNA exam the first time that would be a lot. Not an easy one either, but still.

garv221

I know this is an old post but good review...Makes me kind of nervous, I am actualy sitting down right now to study.

sprkymrk

keatron wrote:

Webmaster wrote:

Ok I see, sounds very fair.

As for the percentage, the ISC2 site mentions "the passing grade required is a scale score of 700 out of a possible 1000 points on the grading scale", so I can imagine why they say the pass percentage is up around 70%. It's a common mistake to assume all questions weight equally. Regardless, personally I don't focus on the score.

Johan, sorry let me clarify. I was referring to people saying things like 70% of all people attempting the examination pass. My fault for not being clearer/

A SANS email I got was proclaiming that this past year, of all the students that took the SANS course for CISSP and then took the exam, they have something like a 95% pass rate. Now, I am sure SANS teaches one of the best CISSP courses out there, and at a couple of grand for the class only the very serious will attend, but that still seems like a high number. I notice the wording is something like "of all the students that took our course AND afterwards took the exam". In other words, not everyone taking the SANS course goes on to try the exam.

JDMurray

There's also no telling how experienced the students already were in the ten domains of the (ISC)2 CBK before taking the SANS course. Novices don't usually get sent to SANS courses by their employers; it's likely these students were people with lots of prior InfoSec experience that simply had not yet taken the CISSP exam.

keatron

This was a hot topic of last month at the ISC2 Training Partner Summit. Here's the findings.

1. It was expected that with time the percentage would increase. The numbers were extremely low up until about this time last year (keep in mind it took months for this data to be compiled, mainly because ISC2 still does a lot of things the old way). Just because of the experience requirement alone, we're already for the most part, gonna get some pretty high quality testers to begin with (more so the case now, the new auditing procedures are absolutely insane). Look at the MCSE for example, where there's really no requirements other than passing the tests.

2. As has already been pointed out, you can call SANS a lot of things (like expensive), but it would be hard for anyone in the know to say they don't run good solid classes. And I can attest to JD's theory about who gets to go to SANS classes, I know only my most dedicated and top notch people get to go to SANS.

Garv, no need to be nervous man, if you meet the experience requirement and study hard (and post lots of questions for us to answer here , you'll be just fine. I proctored a CISSP exam a few months ago where one tester was testing for the 3rd time, however, 90% were testing the first time. I'd like to think most of them passed. I've seen your posts garv and it would seem you definitely have what it takes. Just don't take it lightly and hit the books hard, and I'm sure you'll be on here in no time soaking up congrats from me and the rest of TE.

Keatron

garv221

keatron wrote:

Garv, no need to be nervous man, if you meet the experience requirement and study hard (and post lots of questions for us to answer here , you'll be just fine. I proctored a CISSP exam a few months ago where one tester was testing for the 3rd time, however, 90% were testing the first time. I'd like to think most of them passed. I've seen your posts garv and it would seem you definitely have what it takes. Just don't take it lightly and hit the books hard, and I'm sure you'll be on here in no time soaking up congrats from me and the rest of TE.
Keatron

I really need to hit the books harder, I am currently studying off & on right now when I have time. Once it gets colder (mid Oct~Feb) I plan on having 2 hr study sessions each day. I plan on posting questions and taking full advantage of your wise advice. Thank you for the camaraderie!