Hi everybody,
Some months ago I came here for the first time to post my experience with the CISSP exam, that I had just passed. See this long post and this one a little (not much shorter). After the process of endorsement, I am currently a CISSP. One week a half after CISSP exam, I passed CISM, what was a little trickier than I expected but not specially hard with the CISSP study I had gone thru. But we're not on ISACA forums, so let's move on.
This wednesday June 5th I sat for the CCSP exam, which I passed. So here are my thoughts.
First of all, with regard to the hardness of the exam, there is something relevant to consider. While I spent a couple of months quite focused in the CISSP study, in this case I barely spent a couple of weeks studying, probably about 40 hours total. When I sat for the CISSP, what frightened me was that I didn't know what to expect in the exam (i.e. questions type, language, subjects, etc.). In this case, in general terms I knew what to expect (as both exams are from ISC2), but I felt much more insecure with regard to my knowledge. At the end, studying for the CISSP proved to be very valuable, because many terms that the CCSP material uses were already familiar to me. In other words, I don't think I wouldn't have passed CCSP without studying for CISSP, but that's probably up to one's experience (for example, I don't think I would have passed CISSP without my +15 years of InfoSec experience).
Another element to consider is the type of exam. Back in March I did the adaptive CBT CISSP exam, what implies that after answering a question you cannot go back. You just move ahead. In the case of CCSP, as with CISM, you can review and flag questions, what can led you to some overthinking. I had flagged about 25% of the 125 questions when I reached the last question, in approximately 100 minutes. It took me 15 minutes or so to review the flagged questions and after a couple of hours I was done with the "Congratulations" printed sheet in my hand.
So, did I find the exam hard? Not hard, but not exactly easy either. Having done the CISSP exam and the previous intense studying helped a lot, and my experience in other IT fields did help too, but when I began studying there were a bunch of concepts I was not very familiar with. So if you are not into cloud computing but have experience and good knowledge of InfoSec, you will need to study a little, at least. As with the CISSP, you will need also some inference abilities, because sometimes it's not that you know the answer, but that you can rule out the other three options (or at least two, and then make some deep reasoning... or guessing).
When I planned for the exam, I was very ambitious (CSA, NIST, ENISA, etc.), but I got more practical as the exam date approached. My study materials were the following:
- CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide. I arrived to page 220 or so before getting into the tests, as I was running out of time.
- CCSP Official (ISC)2 Practice Tests.
- OWASP Top 10.
- EDUSUM test questions.
- Boson CCSP test questions.
- Cybrary's Kelly Handerhan's CCSP course.
- CSA Cloud Controls Matrix.
My thoughts on those materials are:
- The book is easy to read, not too deep. I found it helpful but (maybe) some chapters too high-level.
- I did the 1000 questions, easier than the exam, but extremely helpful for reviewing concepts.
- OWASP Top 10. I already knew them, but gave it a quick read.
- I purchased EDUSUM CCSP test questions because I had read some very good reviews. To my surprise, quite a few of the EDUSUM questions were very similar or completely identical to the ones I had done on the Ben Maslow's Official Practice Tests. To worsen the thing, the web interface is pretty simple (no graphs, no info on weak domains, no way to select only wrong questions, no way to rule out questions based on the number of times answered correctly, etc.) and there are no explanations on the right answers. Not glad at all with it, to be sincere.
- I purchased the Boson CCSP test from Boson marketplace, mostly based on my CISSP experience. In this case the experience was not that good, but not bad at all. Even though in some questions it gets into more detail than other materials, it's good at giving explanations of the right answers, and provides a more deep approach to cloud technology than anything I had read before, so it was an entertaining way to see further.
- I did not finish all the videos (something I plan to do soon), but what I saw was spot on, as usual.
- I already was familiar with it, but I made a quick review of the frameworks covered.
That's pretty much all. As I said with CISSP, it's an exam you can do with some effort, that will depend on your InfoSec, IT and Cloud experience, and if you have done CISSP before.
Hope it helps.
Good luck,
Manuel Benet
