I registered here just to send out a thank you to this community for giving me advice and study tools to help me pass. It made a huge difference. To pay back, I'll try to give you my experience and study tools I used to pass (making sure I don't violate NDA, of course).
My experience: I'm a Network Engineer for a technology company and have been working in IT for over 12 years. Jobs held in the past: Field IT Technician, a Systems Admin for Windows/AD/Netware networks, Virtualization (VMware) Admin and Engineer, and as a Network Admin and Engineer. I now mostly deal with Cisco firewalls, routers, and switches with heavy focus on firewall security, VPN management for users and office tunnels, and wireless deployments.
Time taken to study: 6 weeks - Typically I averaged between 4 and 5 hours a day on days I did study (5 days/week typically). Took 3 days off work before test to really focus and solidify my knowledge and those days I put in a min of 12 hours with a couple 1 hour breaks here and there.
Tools used and notes:
- CBT Nuggets CISSP Course - Good start to get the groundwork for the CISSP but NOT to use as a sole source of information. There's a lot not covered in the course that is heavily relevant to the test. During the course, I made notes on a separate text file per video so I could go back and look and focus on specific domains without having to search through a wall of text. Also found it really helped to use a fixed width font and indent as I'm a very visual person and it helped me to find and organize the concepts much better.
- Syngress CISSP Study Guide - 2nd Edition (Eric Conrad, Seth Misenar, Joshua Feldman) - Read it cover to cover. If I didn't understand a specific concept, I'd go online and search until I found a good page to fully explain it to me in a way that I could understand better than the book was explaining. I took notes per domain as I read through the book. Again, organizing with indents so I could visualize and find info faster. Some notes I never went back to but that was not the main reason I took notes. It was to solidify it in my head by repeating it. I made sure to type it out in my own words and not use verbatim from the book as I took notes.
- CCCure.org Practice Tests - These helped identify areas I really need to study more but that was far less valuable than specific explanations of why I got an answer wrong or right. I didn't just read explanations for the questions I got wrong, I did it for all questions. I'd typically take 100 and 150 tests and did a couple 250s. It'll take you forever but taking a 250 and then going through and reading all explanations of all questions (especially WHY specific answers are incorrect) really helps.
- Transcender Practice Tests (given to you with subscription to CBT Nuggets) - These had much more in-depth technical questions. Sometimes, WAY too in-depth. Technical questions should only go as deep as is needed to give you the understanding of how secure the control/solution is and why or simply how it works. I think Transcender test writers lost sight of that. It's more important to know that DES is less secure than AES than it is to know that how many rounds each algorithm performs. I would recommend using both CCCure and Transcender as it is good to get explanations from multiple sources to really help you conceptualize properly (which is ABSOLUTELY the most important thing you need to do to pass the test).
- 11th Hour - Eric Conrad - Incredible crunch time book I went through the day before the test. Do not use this book for your main resource. It's there to help you recall and solidify what you've already learned from your other materials.
Tips:- Because I work in networking, Domain 2 was very easy for me. Without having this background, I would have had a VERY hard time packing this knowledge in with all the others here. You truly do need to have experience in 2+ domains to pass this test due to incredible amount of knowledge in this test. Either that or study for a very long time (or have photographic memory!). From just my personal experience of learning networking fundamentals in the past, I'd say focus on understanding how the OSI model works. Memorizing the layers does not do much for you. You need to understand how these layers apply to specific technologies and protocols and WHY they do. I'd even go as far (if you have no experience in networking) to recommend downloading and installing Wireshark on your laptop. Do some packet captures and start looking at them. See how they are organized. How they encapsulate. Where certain data is located in the layers. Wireshark does a great job of visualizing how packets are organized.
- My weak points were Domain 4 (Software Development Security), and Domain 8 (BCP/DRP). Domain 4 really got me good. I'd go back to the big book and reread that chapter and grill myself until I got it. I didn't do practice tests on specific areas. I used tests to grill me and flag CONCEPTS I was having a hard time with, not entire domains. Then I'd read the explanations in the questions and go back to chapters and focus on those specific concepts I was lacking in rather than wasting time with stuff I already had down.
- Memorizing definitions and steps shouldn't be a focus. The definitions only give you the ability to speak the language. You cannot pass this test through memorization alone. You can only pass through conceptualizing. The goal is to understand the logical reasons behind WHY. The most important thing to understand is what is the best and most secure solution/practice/procedure and why one might be better than another in different situations. I can't stress that enough.
- Just as most of the books say, legal requirements and human life are at the top of the heap in terms of priority.
- Understand the ISC2 CISSP Code of Ethics agreement. Understand the canons and apply them in top-to-bottom order when confronted with a dilemma.
- If you smoke, put a patch on, you can't chew gum, snus or go outside to smoke once you've started the test. The patch kept me from letting a craving distract me.
- Eat something heavy that will burn off slow before going in (I ate a big bowl of oatmeal with bananas and didn't start getting hungry until I was done with the test).
- Many on here said they thought the actual test was easier than the practice exams. I could not disagree more. I thought the test was WAY harder than the practice exams and I have a lot more respect for this cert now that I've witnessed how hard it is and how it really does a good job of evaluating your understanding of the knowledge. I've done Novell Engineer certs back in the day, Microsoft certs, Cisco certs... nothing has been as challenging as this test. UNDERSTAND... don't memorize.
- By the time I finished the test, I was pretty sure I wouldn't pass. The test really makes you doubt yourself a lot. Don't let it get to you. Focus on one question at a time, get through it, go to the next. Don't read into questions, only base your answers off the info presented to you. Nothing can be inferred. This test is a feat of super-natural stamina.
So, hopefully, this helps repay my debt to this awesome community for their tips and tools they gave me. If you're taking the test soon, I wish you the best of luck.
