After I studied for what seemed like eternity, I passed the CISSP Yesterday.
Reason for taking the CISSP:
I took a security job last year. Now my role is entirely administrative. During my interview the folks let me know that being able to keep this job was contingent on taking/passing the CISSP. (No pressure there, right? )
My background: I have 20 years of experience with network/sysadmin/security/telecom in large enterprise IT organizations. I have been a Cisco Certified Security Professional and a HP-UX certified system administrator. I studied for Sec+ and passed it in August after around a month of study.
What I did to prepare:
I tried to force myself to read the Official CBK. I, honest to God, thought about looking for another job if meant having to read that book and speak that language. I had coworkers recommend the AIO to me so I bought it. I read that book cover to cover. Even though her writing style and attempts at humor were appreciated, this was still painful. It was hard to go through for two reasons:
a. Because of stuff I already knew very well being reduced through the lens of the exam.
b. Because of stuff I didn’t know very well seeming overly complicated and nuanced.
I read 50 pages a night until I was done. As others have said here the book is long, so it requires a lot of review and application to retain the material.
Even though I was feeling confident and doing well on the included Total Tester software, I read a lot of feedback here that said the AIO wasn’t enough for the new material, so I also ordered the CISSP® (ISC)2® Certified Information Systems Security Professional Official Study Guide, 7th Ed. It became my primary mode of study. I picked up links to Cybrary when I first started and powered through watching all the videos at once. I bought a subscription to CCCure and did several questions from the test bank. These questions seemed riddled with errors and ambiguous wording. Overall I thought the best test engine was the Total tester, but the best content was from Sybex. I studied, took practice exams and reviewed the info several times. In the end, I was finishing in the high 80s-100 on all my practice tests. This past weekend I discovered a link to the free Eric Conrad test at:
Elsevier: conrad: CISSP Study Guide Certification
I took that and scored in the mid 80s without ever seeing them before, so I took that as an indicator I was ready for the test.
My test experience:
My testing center is a good drive away so I stayed in a hotel the night before to get away from distractions. The test center was crowded with other folks taking exams, no other CISSPs, I don’t believe. I signed in, did my biometric enrollment, and got cleared through the room. The first hundred or so questions were killer. I took a break for about 5 minutes to drink some water and come to grips with why that the questions I was being asked did not seem to relate to what I’d been studying. I then realized that I could not worry about the outcome, I just had to focus on what I was doing and finish so I could see where I stood. The next 150 questions were much easier, some were even just plain dumb. There were a few sneaky questions that did seem like deliberate attempts to trick you. At the end, a little over two hours had passed. I reviewed the 10 questions I had flagged, changed 2, and hit submit. I notified the proctor that I was done and we went to go pick up my test score. From a distance there appeared to be only one sheet on the printer, but when she picked it up it spread apart into the dreaded two sheets of failure. She handed it to me face down. I worked up the courage to flip it over and discover that I had indeed passed, but the printer had bled over slightly to second page. Many of the questions I had to rely on my experience in an outsourced enterprise ITIL environment.
My recommendations to other historically technical test takers:
1. Set a test date with a study plan in mind.
2. Study the entirety of the 8 domains. I feel that ISC2 varies the test so that a single exam can seem to focus heavily on “ANY” single area. Mine did not focus on any of my strong areas at all.
3. Use the Sybex book for content. Take each concept it teaches and put it in a scenario where it would be used. I feel that will help you recall them for the test.
4. Use the Cybrary videos and MP3s to listen to on your commute or your time on the treadmill. I personally learn a lot through discussion, and it felt like a conversation I was having with a coworker when I would listen on the treadmill or in the car.
The short answer is, this is very much doable, but the further you are away from a managerial or security background, the more effort it requires. I wish you all success going forward and thank you to those who took time to answer my questions on this forum.
