Non-Vendor specific?

dorawe

I know that the CISSP exam is not supposed to be vendor-specific, but I'm finding that in alot of the study questions , that Linux/Unix, Windows, etc. are used. Is this just to broaden the knowledge of the candidate, and will not be used in the actual exam? An example would be "What TCSEC level is a specific version of Windows considered?".
Any help is always appreciated.

JDMurray

There are occasionally exam items that have technology-specific references, such as Microsoft, Macintosh, Netware, Linux, UNIX, Bluetooth, 802.11, etc. In many of those cases, the reference is not useful in determining the correct answer. This is also true of that TCSEC question. Replace "Windows" with "UNIX," "Linux," or "OS X" and the answer is the same. You need to really know your TCSEC (or Orange Book) to understand why.

dorawe

Thanks JD.
In one of the many quiz questions from CCCURE.org, I remember seeing a comment from Clement that test-takers should not focus on the Orange Book, and put more of our time into other areas. Would you agree to this?

JDMurray

You need to know both Orange Book and TCSEC. Orange Book is histori ally significant to InfoSec and will therefore always appear on the CISSP exam.

laidbackfreak

I'd agree with JD while the Orange Book is being phased out and replaced with TCSEC, there will always be a place for it and some questions will come from it.

I found the questions on specific platforms didnt really matter as such as long as you understand the process involved you should be able to answer the questions. There are as always exceptions to this rule

dorawe

Agreed. I did not plan on disregarding Orange Book, as it is so prevalent in my studies. I just want to focus on the right topics, and not get distracted by items that won't be covered. It's true that this thing is a mile wide............I've scheduled to take the exam (for the first and last time, hopefully) mid-May, so keeping my focus is critical.