Hi everyone,
I had learnt a lot from you so I'd like to share my experience about the exam and the preparation.
Exam Date: 31 March 2012, Sydney
Result Date: 9 May, Passed
My Background
- Bachelor and Masters in IT
- 6 years of security experience in software development, system hardening, security assessment, security product implementation.
Exam Preparation
Material
- Shon Harris AIO v4, I bought it years ago, but still found it relevant
- Practice questions from cccure.com (only the free ones)
- A CISSP summay
- Wikipedia
Study Plan (3 months)
- Read AIO at the rate roughly 1 chapter per week, turning to wikipedia for anything I wanted to learn a bit more. Altogether spent about 2 hours a day.
- Then did the AIO practice exams chapter by chapter, scoring from 60% to 90%, and then went back to re-read the stuff I missed. This took about 2 weeks.
- Took a few days off work before the exam date and started cramming trivia facts like the distance between light poles (found this effort totally wasted). Did the AIO practice exams again, this time getting close to 95%. Also did the cccure.com questions and got about 80%.
Exam Day
The day before the exam I got so sick of studying I stopped all together. Went to have a great meal, played games and stuff. I made sure I went to bed early and slept well that night.
On the day I brought with me some water, lots of high sugar content snacks. A big shot of coffee right before the exam helped too.
Half an hour into the exam I was thinking "wtf...I was never prepared for this". That's because the questions were so different to the practice questions. All the practice questions focused on only one thing, like "what does class B fire extinguisher cover". But the exam questions had scenarios, covered multiple domains and were often right to the point that if you didn't know exactly how things work in a given topic, you simply won't get it. The good news was there were very few of the trivia/definition questions like "what is HSSI" or confusing questions like "Is availability addressed by encryption".
I went through the questions and filled in the answer sheet as I go, marking the ones I wasn't sure. So I went through all questions in 4 hours with about 40 questions I had to review. Spent the next 2 hours reviewing all of the questions (including the ones I did), and I was probably the last person to walk out. I strongly suggest reviewing your answers as that saved my at least 3 stupid mistakes - every bit counts.
I had a lot of the questions (15 - 20%) that I had never seen in any of the study material. I had to rely on my work experience on those, and that really saved my life. I don't believe these are something one can cram in in a couple of months though.
Something I thought might help with those studying. I was hugely frustrated by the tiny differences in definitions given by the textbooks, such as if the Parallel Test is a partial or a complete DR test, and if it involves taking some production environment down. In this case the AIO and the CISSP for Dummies have totally different definitions. Don't worry about these, but focus on understanding the big picture such as why it should be carried out and under what situations.
Good luck to you all!!
