failed casp, but this info might help others
Based on my failed attempt this morning, and yes painful, the only relief right now is writing it out here, and hope this might help others. This is probably going to ramble on too much...sorry in advance. (I hope i can edit this after i post it 
)
The CASP cert is meant to be an indication of one's ability to scope out solutions mainly within a large enterprise with architectural and project/tech-managerial planning skills/knowledge. It wants you to have enough knowledge of the available techniques (maybe not REAL hard technical stuff but it's the clever application of the techniques that matters in this cert) along with a knowing the potential impact of a VAST array of constraints (cost, risk, system performance, compliance rqmts, org restructuring, system/app layout, employee acceptance, attack environment...did i miss any?). So you may need a good dose of experience dealing with these types of scenarios, or if not, then a good ability to solve logic puzzles (that may trip you up with too much semi-related info), plus sharp reading skills. Maybe CISSP exam is the same way, not sure.
I only have sec+ cert and more than 10 years of IT experience, but too little, so far, in InfoSec (IAM/PKI/SSO app support/monitoring in this past year, but that's it). I'm more of an general system/app support guy (with some java-coding/dev). But, thought i could overcome lack of experience with studying my eyes out using MGH (good) and Sybex (not quite as good) books. Got fairly good at practice questions but no luck this time. MGH is a well written book and hits the topics well and it will suffice for many of you I'm sure. But it's style of questions seemed to reinforce my (lazy) style of reading (in a static knowledge way, if that makes sense) instead of focusing the applied (active knowledge) scenarios based on real problems with lots of distracting clutter for life-like corporate problem-solving confusion. Again the book is good and it's probably just my lack of experience in these areas. It has very good coverage of PKI and SSO/Fed Id topics like SAML/XACML etc. which are a great help with my new support job. So that in itself is a big plus.
Simply taking another few weeks and re-studying these same books in similar ways will probably not be enough to pass next time. I think i would have to either take a class or search for some sources that might provide techniques on how to provide security solutions. Or maybe just re-read but with a new enlightened way. And of course OJT (but that takes so long!)
Actually had i gotten a one or a few more Q's right and passed i still don't think I would be ready to become an applied solutions guy (not a tech manager or architect), but not that I'd expect a single cert would lead directly to a new line of business anyway. To some degree my main focus is staying off the unemp line and add to my employability (at 50+, yeah, I think you probably get it). Regardless, i hate failing any exam.
Some drag and drops were easy and based on generic CIA, risk or other other basic book knowledge. And sure, there were a few shorter and more book-like (like most sec+ questions) MC questions, but not many. The simulations seemed mostly router/fw acl configs. A networking guy could probably breeze through it but darn again, not me.
Had i passed it i think my momentum would have almost forced me to head in the CISSP direction, seems that sec+ and casp are at least 50% in that direction if not more. Just that it's recognized everywhere and useful for getting almost any sec job. Almost required even just to get Tier1 support job in some industries, DC area esp.
Someone in this forum mentioned a while back that it has a little project+ cert style to it, maybe i should have taken that a little more seriously. Don't know project+ scope but does seem appropriate and worth looking into.
Not sure what exactly is next, but i have all these thick books now...and yes, i do have more knowledge for sure...
)The CASP cert is meant to be an indication of one's ability to scope out solutions mainly within a large enterprise with architectural and project/tech-managerial planning skills/knowledge. It wants you to have enough knowledge of the available techniques (maybe not REAL hard technical stuff but it's the clever application of the techniques that matters in this cert) along with a knowing the potential impact of a VAST array of constraints (cost, risk, system performance, compliance rqmts, org restructuring, system/app layout, employee acceptance, attack environment...did i miss any?). So you may need a good dose of experience dealing with these types of scenarios, or if not, then a good ability to solve logic puzzles (that may trip you up with too much semi-related info), plus sharp reading skills. Maybe CISSP exam is the same way, not sure.
I only have sec+ cert and more than 10 years of IT experience, but too little, so far, in InfoSec (IAM/PKI/SSO app support/monitoring in this past year, but that's it). I'm more of an general system/app support guy (with some java-coding/dev). But, thought i could overcome lack of experience with studying my eyes out using MGH (good) and Sybex (not quite as good) books. Got fairly good at practice questions but no luck this time. MGH is a well written book and hits the topics well and it will suffice for many of you I'm sure. But it's style of questions seemed to reinforce my (lazy) style of reading (in a static knowledge way, if that makes sense) instead of focusing the applied (active knowledge) scenarios based on real problems with lots of distracting clutter for life-like corporate problem-solving confusion. Again the book is good and it's probably just my lack of experience in these areas. It has very good coverage of PKI and SSO/Fed Id topics like SAML/XACML etc. which are a great help with my new support job. So that in itself is a big plus.
Simply taking another few weeks and re-studying these same books in similar ways will probably not be enough to pass next time. I think i would have to either take a class or search for some sources that might provide techniques on how to provide security solutions. Or maybe just re-read but with a new enlightened way. And of course OJT (but that takes so long!)
Actually had i gotten a one or a few more Q's right and passed i still don't think I would be ready to become an applied solutions guy (not a tech manager or architect), but not that I'd expect a single cert would lead directly to a new line of business anyway. To some degree my main focus is staying off the unemp line and add to my employability (at 50+, yeah, I think you probably get it). Regardless, i hate failing any exam.
Some drag and drops were easy and based on generic CIA, risk or other other basic book knowledge. And sure, there were a few shorter and more book-like (like most sec+ questions) MC questions, but not many. The simulations seemed mostly router/fw acl configs. A networking guy could probably breeze through it but darn again, not me.
Had i passed it i think my momentum would have almost forced me to head in the CISSP direction, seems that sec+ and casp are at least 50% in that direction if not more. Just that it's recognized everywhere and useful for getting almost any sec job. Almost required even just to get Tier1 support job in some industries, DC area esp.
Someone in this forum mentioned a while back that it has a little project+ cert style to it, maybe i should have taken that a little more seriously. Don't know project+ scope but does seem appropriate and worth looking into.
Not sure what exactly is next, but i have all these thick books now...and yes, i do have more knowledge for sure...
Comments
-
da_vato
Member Posts: 445
It sucks to fail any exam, I've failed an exam or two but once I dusted off my pride I went back in there and knocked it out. I truly hope that you do too.
This is a managerial mindset exam, for me there were plenty of questions where it inferred that a CEO was doing something wrong.... How do you solve this? Well in the real world that is the guy/gal that you do not piss off so you have to apply tactics that still accomplish security but are still grounded to reality like not forcing/demanding the CEO do anything.
Thanks for posting your experience I'm sure it will help someone down the road. -
JDMurray
Admin Posts: 13,090 Admin
Very sorry about your temporary setback. If you are a Beltway worker looking to satisfy DoD 8570.01 then CASP is worth trying for again.
I was impressed by the network, security, and systems operations aspect of the CASP exam. The CASP exam taker should have hands-on experience diagnosing and solving problems in an enterprise-class IT environment at the operations level. It wouldn't surprise me if CompTIA threw in a little Project+ into CASP for the planning and administrative stuff too. I don't think the SSCP cert comes close on those levels, but it's been a while since I took the SSCP exam. -
JoeB99
Member Posts: 3 ■□□□□□□□□□
What really blows with prepping for this cert is that the first book i got, the Sybex book was way off. When i saw the list of tools in the Appendix I really got excited but NONE of the tools was covered in the exam...maybe there was one in MC question. This is where i thought the cert exam was headed but was totally thrown off. Someone tell me why such a divergence!
Should have gotten my money back and taken CEH I guess. Some QA has to be done on these texts, especially when it was probably the only one available for some time. I later got the MGH book which was more inline with the exam somewhat. -
JDMurray
Admin Posts: 13,090 Admin
MGH's CASP book did me well for the exam: Review: CASP CompTIA Advanced Security Practitioner Certification Study Guide [Book] - TechExams.net IT Certification Blogs
-
sigsoldier
Member Posts: 136 ■■■□□□□□□□
My sole study material for this test was the Sybex book. While it had good info in it, I would say roughly only half was covered on the test. I think maybe 2 or 3 of the labs were relavant. A lot of my answers really did come down to my experience, and that is something that can't be found in a text book.
Good luck should you decide to take it again!