Passed CISSP 7/27 on first try - my preparation and strategy
Hi all - long time lurker, first time poster. I recently passed the CISSP, so I wanted to give my feedback. Leading up to the exam I read through dozens, if not hundreds, of these threads, and they helped me a lot in preparing for the exam, so hopefully my experience will help others as well.
First, a little background on me. I started doing networking work in 2006, and moved into a security-focused role in 2008. I was working for a college dormitory at the time, and had to protect networked and physical resources from inquiring (and occasionally malicious) students, as well as the general population. In 2013 I got on the certification track, and so throughout 2013 and into 2014 I got my CCNA/CCNP R&S and my CCDA, and then in December 2014 I completed my CCIE in R&S (took three attempts for the lab, glad it's over). At that point I decided it would be good to pursue a security-centric, non-Cisco option. For several years colleagues had been recommending the CISSP, so I decided to give it a shot.
My most difficult part was getting back into my study routine. When going after the CCIE, I would study for 30-35 hours a week, in addition to working full-time. After ~9 months of that I was pretty burned out. I spent several months "studying" for the CISSP, in which I would flip a couple pages through a book every day or two and occasionally Google related concepts. I actually had this same issue with the CCIE: until my money was on the line with a hard date set, I didn't really take it seriously. So I scheduled my exam for about two months out, and got to work.
I used the following study resources:
- (ISC)2's Official Guide, Fourth Edition
- Shon Harris' Exam Guide, Second Edition
- James Stewart and Mike Chapple's Study Guide, Third Edition (old book, was a hand-me-down)
- Eric Conrad's Eleventh Hour Study Guide, Second Edition
- CCCure Quizzer subscription
- Pocket Prep's CISSP Exam Prep for Android
I read through maybe a third of Harris' book, then moved to the (ISC)2 copy, in particular because I waited long enough that I now had to take the new version of the exam. I read about 75% of the (ISC)2 book in depth, and flipped through the other 25%. Took all the practice questions.
For me, even though it was a very old copy, James Stewart and Mike Chapple's Study Guide was my favorite book. Easy read, clear and interesting. I read it cover to cover, and when continuing with the (ISC)2 copy, a lot of the content was now "review" rather than "learn". I also read through the Eleventh Hour Study Guide twice, once a few weeks before the exam and again the day before as a quick refresher.
I took practice tests via the CCCure Quizzer subscription. My default practice test was set to "pro" level in test mode with 100 questions. I took about 15 such practice tests, with my starting tests scored in the 60's to 70's. By the time I took the exam I was consistently scoring in the upper 80's, taking an average of 35 minutes to finish the 100 questions. In addition, I used Pocket Prep's Exam Prep quizzer on my phone for 25 questions at a time dozens of times - similar scores to CCCure.
A couple comments from my experience. First, use at least two different primary study sources, one of them being (ISC)2. None of the resources I used contained questions quite the same as the real exam, and in my opinion (ISC)2's practice questions weren't much closer, if any, than some of the other sources I studied from. In addition, different perspectives on the same material helps a lot. For me, the way (ISC)2 presented the material didn't stick much, but some of the other sources helped much more.
Next, take practice tests. Then take some more. Then find questions from a completely different source, and take those too. Watch your time.
In addition, utilize your available time well. This comes in two forms. First, when it's time to study, study. For me at least, one hour of dedicated study time is more productive than two hours of distracted studying. And second, use the small amounts of downtime throughout the day to your advantage. I have an hour lunch at work, so I'd take 20 minutes and then knock out 100 practice questions or read a study book. Anything security-related in my work I'd study in-depth to benefit my work and studies. Even when I was on the porcelain throne I would be taking practice tests on my phone. When I was studying for my CCIE I had an hour commute to work each way, so that meant I got two hours of audio lectures in every day. I managed to fit an extra hour and a half on average of study time for the CISSP per day doing this.
With all that, on to my exam experience. I won't go into much detail here for obvious reasons, but I will say that it seems like I ended up studying much more than the common "inch deep" mantra, and it showed on the exam. There were a few curve balls that I didn't recognize, otherwise everything seemed very high level, method and purpose focused rather than detail oriented.
I did three passes on the exam. On the first pass I answered everything that jumped out at me. Took about 2.5 hours, and I answered 245 of the 250 questions. The second pass I examined the five questions I skipped, and on the third pass I reviewed every question again. I changed about six answers on the third pass. That brought me to 3.5 hours, including two short breaks, at which point I ended early.
As has been said before and I'll repeat, the challenge is to choose the "best" answer among several "right" answers. My most common technique was eliminating answers that were not best, rather than trying to choose the best straight away. For many questions this led me to having to choose between two answers, at which point I had to ask which best fit the spirit or intention of the question being asked as well as the testing body asking the question. Hopefully that's clear enough to make sense - if not, I'll try to elaborate.
Other factors here: I'm single with no kids. For a portion of my study time I had a S.O., and it made life more difficult in terms of studying. I have a tremendous amount of respect for the people who do this type stuff while balancing a marriage and/or kids. However, if you do have a family, don't think that means you can't achieve this. You can, but you will need to be all the more structured in your studying, as well as how you use your time.
In addition, I don't have, nor have a ever owned, a TV or video game console. Granted, I'm only in my late 20's, so it's not saying too much yet, but it helped a lot for my studying, as well as my life as a whole I feel. For me, when I come home from work, kicking back on the couch and flipping on the TV isn't an option. If you're finding a challenge with distractions like that, I recommend some out-of-the-box thinking to increase your time utility.
However, do recognize what is a realistic study schedule. I tried doing the study non-stop thing, and it lasted maybe a week before I was ready to go crazy. While I did study pretty intensely, I also had fun too. I have two sailboats, a motorcycle, more camping gear than I care to admit, and am a board member for a non-profit that puts on contra (folk) dances. The trick is, my fun time is separate and distinct from my study time.
Hopefully this helps someone as they pursue their CISSP. Approach it for what it is: an effort by the test creators to validate that you have the knowledge and understanding they want you to have. Put your time in, and you can do it!
Best,
Reece
