topic Not too happy with CSSLP Exam in Member Support

Not too happy with CSSLP Exam

MDChris — Thu, 31 May 2018 01:35:35 GMT

Ok, I took the CSSLP exam. I got a 688 out of 700 today. I took the official online ISC2 course with a week's online webex training (which was different from the online work). I used the flash cards and all the resources. Out of the 175 questions there were quite a few questions not associated with the flash study cards or what appear to be from the office student guide. There were also questions about modeling (I will not name them due to not talking about what was on the test), but the models were never referenced in the official study guide. If I would have known I would have refreshed on the associated models. Not sure what is going on here, but I would expect the resources to review and understand to be successful in the exam would be in the Official Student Guide. It would hope someone from ISC2 would please comment on this concern.

Re: Not too happy with CSSLP Exam

amandavanceISC2 — Fri, 01 Jun 2018 19:01:22 GMT

@MDChris Thank you for reaching out to us and I'm sorry to hear about your exam. Let me congratulate you on deciding to pursue the CSSLP certification. The exam itself is designed to gauge the candidates real world professional experience across the 8 domains and by doing is considered one of the more difficult (yet rewarding) certifications to acquire.

The study materials are built from the CSSLP Exam Outline and your knowledge of the CSSLP Domains and professional experience together will prepare you for the exam.

Best Regards,

Amanda Vance

Re: Not too happy with CSSLP Exam

MDChris — Fri, 01 Jun 2018 19:40:28 GMT

Amanda,

Thank you for the kind words. To your point that is exact the concern of the exam I took. It did not appear that, "The study materials are built from the CSSLP Exam Outline and your knowledge of the CSSLP Domains and professional experience together will prepare you for the exam". The course work, study guide, and flash cards had no modeling (i.e. Bell Lapadula, Biba, etc.) information or questions whatsoever. I am of the understanding pervious versions of the CSSLP did have modeling and I could see from previous study material this information was included. The never version of the exam, from what the instructor said, were not supposed to have these questions and the current study material I got from ISC2 reflected that as well. This is where I am concerned.

Regards!

Re: Not too happy with CSSLP Exam

amandavanceISC2 — Fri, 01 Jun 2018 20:02:10 GMT

@MDChris I understand and have brought your concerns to our Education team. Please know, our Education team is consistently reviewing and evaluating course material for all (ISC)² certifications.

Best Regards,

Amanda Vance

Re: Not too happy with CSSLP Exam

MDChris — Fri, 01 Jun 2018 20:14:15 GMT

Thank you so much Amanda! Have a wonderful weekend!

Re: Not too happy with CSSLP Exam - Almost Giving Up

veejaydee40 — Tue, 10 Jul 2018 18:05:20 GMT

Hi Chris,

I feel your pain. I feel like ISC2 is misleading when it states project managers, business analysts and other non technical SMEs can study and pass this exams. Out of 10 of us currently studying for this cert, only the 2 technical SMEs have passed so far. 1 director failed, 2 out of 7 PMs have also failed and the rest of us PMs are thinking of throwing in the towel. There are very few resources to study, plus we are not technical nor do we have security background. So per ISC2 FAQ & the POC who responded to you, we definitely need life experience that we don't currently have and was hoping to study & pass this cert to help us obtain the life experience & become better PMs with regards to the security aspect of the systems we implement or upgrade. Most, if not all reviews I have seen so far re this cert states, we need life experience, a little bit of 'this' & a little bit of 'that' because the All in One book or the ISC2 book of knowledge (both of which I have) is not going to be sufficient. I don't understand how ISC2 could change the exams in June 2017 and not update their books or provide more effective resources/guidelines? I was so excited when I read the initial sales pitch on why PMs are great candidates that I gathered 6 of my co-workers & convinced them to take it. Now I'm so disappointed. We've spent months preparing for this & there doesn't seem to be a light at the end of the tunnel. I don't want me studying to go to waste so I'll have to look for another security cert from other organizations that are geared more to the managerial aspects as I don't want to be the SME/doer. I just want to understand & manage while ensuring applications are addressing the necessary security policies.

I also hope to hear back from the ISC2 team regarding my response.

Thanks.

Re: Not too happy with CSSLP Exam

jalbo79 — Wed, 11 Jul 2018 01:22:59 GMT

Another not happy tester here as well. I too took the same CSSLP clas as MDChris, completed all of the courseware, studied the flash cards, and re-read the official 3rd edition Student Guide.

I would like to say that the test is not a measure of how well you understand the concepts, practices, and fundementals of the Software Development Lifecycle (SDLC). You will not get rewarded for your hardwork after completing a test similar in grammatical wording and sentence structure to the samlpe questions.

It's unfortunate that the measurement is not whether you can demonstrate you knowledge and wisdom in an orderly fashion, but whether you can deal in chicanery and diabolical subterfuge. It's so poorly written I thought they downloaded the wrong exam.

I'm at the point of deciding whether this certification is a must-have.

Re: Not too happy with CSSLP Exam

veejaydee40 — Wed, 11 Jul 2018 02:12:36 GMT

Thanks for your response. I'm really curious to hear ISC2 response. I'm sure there are several other unhappy people out there. They really have to provide more realistic details re those who should really be taking this cert, better resources, guidelines and real practice questions. This would encourage others to take the cert but at this point it feels as if the goal is to get $599 & get blind sided with the type of questions in the exams when one realises the recommended books are not sufficient to pass.

Re: Not too happy with CSSLP Exam

MDChris — Wed, 11 Jul 2018 02:51:07 GMT

Agree totally. Don't think for a second they don't have an ISC2 monitor quietly watching this community forum. Problem is they're not going to do anything until it affects their bottom line. I e-mailed ISC2 after my issue in late May and got the, Sorry about your bad luck . . . wish you well when you take your test again. Then someone else I know got an e-mail from one of the ISC2 reps that said . . . . If you take our official ISC2 and fail . . . we'll pay for your exam within one year of when you took the class. I got three problems here. 1. I did not think the exam was reflective of the course materials in my instruction . . . . 2. If I re-take the exam what's going to prevent the same thing from happening again? . . . . and 3. Where's the consistency from ISC2? You get different answers from different people in the same organization. Come on! Where's the consistency?

Re: Not too happy with CSSLP Exam

denbesten — Wed, 11 Jul 2018 05:13:35 GMT

If you read through these boards, you will find that there is no single source of material that will prepare you for an (ISC)² exam. The recommendations that you will consistently get are to use many references, to take lots of practice tests and to earn (much of) the required experience prior to sitting for the exam. (ISC)² exams are all about ability to apply your knowledge and experience in real-world situations. Although important, "book knowledge" is not enough to pass (ISC)² exams.

I have never heard of (ISC)² itself offering free retakes, although some of their partners do include the costs of the exam as part of the class tuition. Could you please post a copy of your friend's letter with the free retakes offer? There are many people on this board that would like to cash in.

Re: Not too happy with CSSLP Exam

MDChris — Wed, 11 Jul 2018 12:57:15 GMT

I stand corrected on the exam being covered by ISC2. I re-read the e-mail and my wishful thinking saw one thing, but in fact it is another. ISC2 will allow anyone who has taken their course and failed the test to re-attend I believe the class free of charge. It's not the actual test. We'd still be out the money for taking a 2nd exam.

Re: Not too happy with CSSLP Exam

SalPortaro — Sun, 12 Aug 2018 20:41:20 GMT

All of my study material had the models.

Re: Not too happy with CSSLP Exam

veejaydee40 — Mon, 13 Aug 2018 01:59:21 GMT

Hi
Thanks for your response. So did you pass the exams? Can you provide the names of the study materials you used & the models being referred to please? Are you already in the security, developer, DBA, or hardcore IT field?

Re: Not too happy with CSSLP Exam

SalPortaro — Mon, 13 Aug 2018 22:59:58 GMT

I did pass the test on the first pass. It was brutal. I studied the infamous CSSLP CBK ans the All-in-One. The CBK had the models. I also read the CISSP book by Shon Harris.

I have been a developer for about 30 years. Most of it as a developer or a manager of developer. I have a fair amount of security experience from a management prospective,

I found the test to be about 25% book knowledge and 75% experience and common sense.

The security experience was the key for my passing. There were definitely were not covered in the books.

Sal

Re: Not too happy with CSSLP Exam

SalPortaro — Mon, 13 Aug 2018 23:10:05 GMT

That should have read:

There definitely were questions that were not covered by the book.

The CBK was the 2nd edition.

I totally went the self-trained route.

Re: Not too happy with CSSLP Exam

nancy_perez — Tue, 09 Oct 2018 07:09:28 GMT

That should have read:

Official (ISC)2 Guide to the CSSLP CBK

CSSLP Certification All-in-One Exam Guide

Re: Not too happy with CSSLP Exam

atraxi — Sat, 01 Sep 2018 00:08:30 GMT

I passed the exam, but only by the skin of my teeth, (I had to answer all 175 questions.) I am a software engineer, but have been more on the analysis side rather than the actual coding for the last five years. I studied by just reading the official CSSLP CBK, but there was certainly information on the test which was not thoroughly covered in the study guide. I also have my CISSP, and I feel that test was exponentially easier than the CSSLP. The CSSLP test is certainly designed for someone who has actual hands-on software development experience.

Re: Not too happy with CSSLP Exam

veejaydee40 — Sat, 01 Sep 2018 16:03:21 GMT

Congratulations! Thanks for taking the time to respond. My point exactly.
It's very misleading when you state Project Managers, Quality Assurance
Analysts & even Business Analysts can take the exams and pass it. It's also
implied that this exams is geared for folks with software development life
cycle knowledge but in my opinion, it's really not. It's more for folks
with hard-core IT background for example, coders, developers, programmer's
etc. What baffles me is how can the governing board give classes that does
not fully equip the students with everything needed to pass the exams nor
does it's book of knowledge have ALL necessary info for the exams. Doesn't
anyone else see something wrong with this picture or is it just me? I'm
baffled!

Thanks,

Valerie Thomas
The quality, not the longevity of one's life is what is important!
-Rev. Dr. Martin Luther King, Jr.

Re: Not too happy with CSSLP Exam

CraginS — Thu, 06 Sep 2018 10:25:50 GMT

@veejaydee40 wrote:
It's very misleading when you state Project Managers, Quality Assurance Analysts & even Business Analysts can take the exams and pass it.
It's also implied that this exams is geared for folks with software development life cycle knowledge but in my opinion, it's really not. It's more for folks with hard-core IT background for example, coders, developers, programmer's etc.

Valerie,

It appears that you may have misread or misinterpreted the information on the CSSLP exam.

Here is what the CSSLP information page says:

=-=-=-=-=

The CSSLP is ideal for software development and security professionals responsible for applying best practices to each phase of the SDLC – from software design and implementation to testing and deployment – including those in the following positions:

Software Architect   Penetration Tester
Software Engineer Software Procurement Analyst
Software Developer Project Manager
Application Security Specialist   Security Manager
Software Program Manager   Quality Assurance Tester

IT Director/Manager

=-=-=-=

There is no claim that individuals in any of those specialties can (or should) take the exam expecting to pass without preparation. The certification is one that covers knowledge that "security professionals responsible for applying best practices to each phase of the SDLC" should have. One reason that we have so much software without decent security built in is that a huge proportion of workers with SDCL responsibility, including oversight jobs like PM and QA, simply do not.

Similar to the basic philosophy of the CISSP CBK content, the CSSLP content CBK is based on knowledge that SDLC-involved workers should have, both to do their own jobs and also to understand what others in the SDLC environment should be doing. This broader knowledge is especially important for management level workers like project managers and software quality assurance workers, to be sure the architects, programmers, and covers are including the correct aspects.

Also, with regard to the expectation that the cram course will cover every question on the exam, I repeat the statement above by William @denbesten:

"f you read through these boards, you will find that there is no single source of material that will prepare you for an (ISC)² exam. The recommendations that you will consistently get are to use many references, to take lots of practice tests and to earn (much of) the required experience prior to sitting for the exam. (ISC)² exams are all about ability to apply your knowledge and experience in real-world situations. Although important, "book knowledge" is not enough to pass (ISC)² exams."

Re: Not too happy with CSSLP Exam

Andy69 — Thu, 13 Sep 2018 14:08:52 GMT

I had handos-on software development for all my carrer...and I can tell you that the exam was difficult even for me. It is more difficult than CISSP, I agree.