Hey peeps.
Failed the CCSP yesterday on my second attempt with a 681 (700 required to pass).
My first attempt scored a ~618.
I took the exam the first time after completing my Master's Degree in Information Assurance with a focus on cloud security and using the ISC2 Official CCSP Study Guide by Ben Malisow. The official study guide is worse than useless. If I had completely memorized every single page of the study guide, I would only know about 20% of the material presented on the test.
After the first failure, I began a hardcore study program that included the following:
Altogether, I drilled on the practice questions in these resources (about 700 questions in all) and scored 90%.
Maybe 5% of the test questions I used appeared on the actual exam in some form. So, the practice questions will create a very false sense of confidence.
THE EXAM:
As others have noted, it is a poor quality test. Many questions are constructed with poor grammar (obviously from someone for whom english is not a first language). There are probably 10 questions or so written specifically to confuse or deceive you with the wording. There were MANY questions on REST and SOAP APIs that were more detailed than ANY of the information about REST and SOAP in the study materials. You will either need to be an application developer and intimately know how to use these APIs or use a separate programming resource to study how they work and why. There are matchy-match questions about what security standards/laws go with what country (easy if you memorize - but be sure to memorize ALL of them). There were two sets of questions (about 4-5 each) based on a detailed real-world scenario and how to accomplish a specific goal in the MOST secure manor. I have no idea how I did on these because either every option seemed right or none of them did. The study material spend a LOT of time on which storage types go with which platform, but the questions on the test on these topics are all asked in ways the material doesn't prepare you for (i.e. don't expect to be able to match volume and object storage with IAAS). If you are security professional active in the field, I would say you are at the greatest disadvantage for this exam - because you may know a right way to do something but the test question is looking for the answer based on the CCSP CBK, not the "real world."
I have $1500 in test and materials now and I will NOT be attempting it a third time. There would be no satisfaction for me to pass the test on a third attempt, and if I failed it a third time I would probably drive into oncoming traffic.
I have a number of colleagues who have passed the exam after taking the ISC week-long bootcamp class with the exam at the end. I assume the ISC instructor basically gives you the info for the test questions they know will be on the test since it's their exam. If your goal is to get the cert to check a box or get the credential, I would recommend doing the bootcamp. These forums are full of stories of very competent security pros who didn't pass this exam the first time around, so you're likely looking at $1200 to take it twice anyway. Might as well go all the way on the bootcamp cost and feed the ISC money machine.
