CISSP: questions on questions

grauwulf · July 2011

I sat the exam today and I am curious to hear what your thoughts about the questions are. The test took me right at 4 hours to complete. When I finished I went back and reviewed my marked questions making a few corrections. Then I spent a minute making sure the bubble sheet was properly marked, and that was that. If I had to take a guess I'd say I'm about 70% confident in my results. Taking into account a standard deviation I suspect that I will pass or fail by a fairly thin margin. For the most part I wasn't scratching my head or anything, but where I was it wasn't because of the material it was because of the terrible question construction.

I encountered incomplete sentences, double negatives, and just plain gibberish. I won't divulge the entire question but one of them started "The then the" ... huh? On the whole the test is good about making "MUST" and "BEST" distinctions very clear, but on several occasions I encountered questions that asked 'which of the following can X use?' and there were more than one 'correct' answer. If you really think about it only one of those answers is really practical, but the question seems to be intentionally misleading.

Did you run into anything like this? Has anybody written to ISC2? I asked for a comment form but they tell you right up front that you'll never hear back about your questions or comments, so I suspect those go directly into the circular file.

Questions? Comments? Plans for global domination? What was your testing experience?

instant000 · July 2011

Whenever I am in doubt on a security test, I just choose the most secure answer. If that won't be obvious, I just choose what was successful for me in the past.

Hope this helps, can't really say much more, due to NDA

JDMurray · July 2011

Every once in a while someone has a major complaint with wording, grammar, spelling mistakes, etc. on an (ISC)2 exam. It seems to be a rare, but persistent complaint. I can't say that my (ISC)2 exams were perfect in that regard, but nothing to complain about. Maybe part of the 2012 CISSP exam revision is to clean up that sort of thing.

As for exam items with multiple correct answer options, where one answer option is more correct than the others, this is a standard tactic in many different kinds of exams. It's only tricky if you don't know the subject matter referenced by the exam item.

grauwulf · July 2011

Thanks guys. I am familiar with the testing process, the joy of tricky questions, and the need for the most appropriate answer. I'm just curious what perspectives have been generated by other people's experiences. A few other people on here have commented that they the questions were overall good or bad.

The apparent next question for you two, as you have cissp in your certification brag block (did you hear that bus coming before I tossed you under it?

, is what did you think and why?

JDMurray · July 2011

What did I think of the entire CISSP experience? Have you read my blog articles on that very subject?

The CISSP Certification Experience | TechExams.net Blogs

The CISSP Certification Experience: My Study Plan | TechExams.net Blogs

instant000 · July 2011

grauwulf wrote: »

Thanks guys. I am familiar with the testing process, the joy of tricky questions, and the need for the most appropriate answer. I'm just curious what perspectives have been generated by other people's experiences. A few other people on here have commented that they the questions were overall good or bad.

The apparent next question for you two, as you have cissp in your certification brag block (did you hear that bus coming before I tossed you under it? , is what did you think and why?

1. Brag block? I don't see it as such. It would be bragging if I placed it on the signature block of every email I sent out at the office (that actually annoys me when I see that.). In this forum, it helps to get some context on who is dishing out what advice. (for example, if you're asking questions about vmware tests, and a VCP answers your post, then that lends it a little more credibility.) Of course, if you visit here for a while, you get a feel for a few posters who dish out really good information, and whether or not they had anything beside their name, they'd still be someone you paid attention to.

2. I'll just link to my CISSP test post, and you can read that one for yourself.
http://www.techexams.net/forums/isc-sscp-cissp/65041-my-cissp-journey.html

3. Make sure that you're up on the vendor requirements for attaining and keeping the certification: http://www.isc2.org

badrottie · July 2011

instant000 wrote: »

1. Brag block? I don't see it as such. It would be bragging if I placed it on the signature block of every email I sent out at the office (that actually annoys me when I see that.). In this forum, it helps to get some context on who is dishing out what advice. (for example, if you're asking questions about vmware tests, and a VCP answers your post, then that lends it a little more credibility.) Of course, if you visit here for a while, you get a feel for a few posters who dish out really good information, and whether or not they had anything beside their name, they'd still be someone you paid attention to.

Interesting comment. I do put my credentials on my work email signature block, along with every other credentialed professional in our company (It really is one of the few differentiators in a company of 20,000 employees). The very moment our MBA's, professional engineers, chartered accountants or legal counsel stop doing it, I will follow. I really do not view it as bragging, and in fact, believe that it helps promote the CISSP credential to an audience (internal or external) that otherwise may not be exposed to it. I do get frequently asked what it means and I do take the time to explain (A logical extension of the (ISC)2 Code of Ethics Canon "Advance and protect the profession"). Your milage may vary, of course.

In regards to the exam questions? I did not encounter anything like what you describe, but the laws of probability dictate that it could reasonably happen. The real question is how often does it occur, and that is hard to quantify, as we all sign a NDA which limits disclosure and therefore impacts subsequent data gathering to perform analysis on.