Hello. I'm a former long-time mainframe systems developer now working as a general IT consultant. As mainframes are becoming increasingly rare and elusive, I've been working to gain experience and credentials in IT security.
I've been studying for the CISSP exam for the past 3 months, at about 10-15 hours per week. During that time I lurked assiduously (say that fast 5 times) on the TE.net CISSP threads, and learned a great deal of information that I incorporated into my study plan and made use of during the test. I'd like to thank you all for that.
As for my study plan: I used Eric Conrad's CISSP Study Guide as a primary resource, with the associated online audio overviews and sample exams (with 500 questions). I also picked up Conrad's 11th Hour CISSP book to review highlights during the final week. I started to watch the videos provided by ISC2, but lost interest after a couple. Instead, I went through a series of online lectures provided by
www.vte.cert.org that cover the 10 domains in 20+ hours. These are geared primarily towards DoD employees, but are quite well done and are available to anyone with a .gov or .mil email. I also signed up for the test question database at ccure.org. These have some wording issues, but do force you to think more deeply about the topic areas. I agree with Clement Dupuis that taking sample tests is the best way to study - when you miss a question on a test, you tend to remember it. For that reason, I picked up an older copy of Shon Harris's book for $5 or so to get the CD with 1,000+ sample questions - another fine suggestion someone made here. I was also fortunate enough to find a copy of the ISC2 Student Handbook on eBay, which has some bits of information ISC2 presumably teaches in their classes that I hadn't seen in other sources.
I had read that the questions on the actual test are unlike any sample questions, but I didn't find them to be all that different from the Conrad or Harris samples. Of course I have no way to know which questions I got right or wrong, but my impression is that the exam does emphasize human safety, general rather than specific answers, and a management rather than a technical perspective.
During the first pass I answered about 80% of the questions, which took a little over four hours. Some of those answers were shaky, but I didn't think they would improve if I kept thinking about them. Then I went back for a second pass, trying first to reduce the number of possibilities from 4 to 2. The 25 unscored questions and the unequal weighting of questions makes it impossible to do precise calculations, but I thought I was probably hitting around 80-85% of the first 80% (if you see what I mean), and something over 60 percent of the rest. There were only about a dozen questions I wasn't comfortable narrowing down to two options. Overall, I used just under 5 hours and 50 minutes. The proctor handed me a folded-up sheet, which I took down to the parking lot, bumping into a few walls along the way. Once in my car, I sloooowly opened the sheet and found the word "Congratulations!" I celebrated with a fist-pump and the traditional shouts of "Woot!"
Thanks again. You guys helped.
