Dear DirkDE,
very sorry to hear that you did not pass. I can appreciate your disappointment - especially if you have tried three times, and have done a lot of studying and preparation. In such situations it is tempting to blame something else than yourself, especially if you fail to see what you did "wrong".
And that may well be the key: to find out where your weak areas are, and how to improve on them.
In most cases, people fail for mostly one or more of the following:
Motivation. Given your efforts and the time spent already - assuming you roughly spent the same time to prepare yourself for the first two tries - it seems that obtaining the CISSP is of enormous importance to you. So, you are well motivated, even though you may not feel like it right now. I don't think that is the problem.
Knowledge. The bare facts, the stuff that is listed in the CBK. To test your knowledge, you might, for example, do test exams. I have had some good experiences with CCCure when I prepared for my exam. If you consistently score somewhere over 80 percent on their tests, you should have adequate knowledge. You could also join or set up a study group (even a study peer is often sufficient), which often can help to build knowledge too. If you fail to fully understand a concept or topic, do additional research. E.g. you might use this community to help you find the answers. However - just check and doublecheck - also consider the quality of your efforts to study: if you study, do you actually study or just read fragments in the book? Do you create extracts? Do you try to formulate questions and answers from the materials? Do you try to explain a newly learned concept or idea to others? Do you actually USE the terms and concepts that you studied? Did you try to "braindump" - or do you really DIG what you learned? There is an excellent book that may help you with your studies: it's the Sciences Good Study Guide (ISBN 0-7492-3411-3), you may consider buying it.
Attitude. This is the most difficult thing: obtaining the proper mindset. Picture yourself as being responsible for advising a board of a large company about security: would you tire them with nitty-gritty details, or give them a broad oversight? Would you whack them around their ears with details, or give them a sufficiently detailed, but still broad vision? Do you, by nature, balance cost against risk? Do you understand that your mission must not be to make things overly secure - but just secure enough? The art of being able to oversee the entire, dynamic field and then destill a good advice on board level from all that is what a CISSP should be able to do. So, instead of focusing on details, focus on the main themes and try to be consistent with that when you answer your question. Don't fight the questions: read them as if you were that manager, then choose the best answer.
I hope that you will find out what the issue is, or the issues are, that stop you from passing the CISSP exam. I hope you have the energy and stamina to continue your studies. And remember: nobody gives a dang if it took you a couple of attempts to obtain this accreditation. In the end, a CISSP is a CISSP - that's the entire point of it!
--
Heinrich W. Klöpping, MSc CISSP CCSP CIPP/E CTT+
