Here's an observation from when my youngest took Driver's Ed., and the "instructor" told her to download an app that poses questions about rules of the road; she could just learn the rules based on the feedback. I think that approach has become pretty common today (arguably it's a fair analog to machine learning, even).
While that may work for some subject matter, there are two problems you will run into with security:
- Foremost, things appear to change quickly in this industry. Major changes occur almost by accident, without much accurate prediction or any framework to understand their risks. They web blew up the client-server model, the cloud blew up on premise, and AI may burn it all down and start anew. You have to rely on foundational knowledge to be able to shift with it. Security is like developing an economic theory. You need to understand both micro and macro and have them work consistently in the face of outside factors.
- Most of those apps are written by people trying to make a quick name or buck. Often the question writers don't have subject matter expertise. They'fe just someone making $15 an hour (or an AI) looking at text and turning it around into a question.
In this industry, we face a lot of burnout that goes hand in hand with what is often called "imposter syndrome." This job can be tough, but it becomes a lot more stressful if you feel like you are always swimming over your head. A lot of us who survived in this industry began at a time when there really wasn't much formal security. It was something we did as part of system administration, running the network, etc. It gave the opportunity to amass a lot of well-rounded experience. That's valuable not just from an ability to "know out" a problem or new technology, but also the ability to communicate and manage. It's harder to do that today with all the pigeon-holing of duties, but what I have seen too is that people are in such a rush to get certs and climb the pay scale, they leap over a lot of that opportunity to move laterally, gain experience, and maybe find something that they really like.
So yes, test prep may be part of the recipe, but don't rely on it as a way to gain knowledge or confidence. Get hands-on as much as you can. Take a look at the ISC2 suggested references and read these:
https://www.isc2.org/certifications/references
I'd also add to that list Ross Anderson's Security Engineering (which I am shocked is not on that list).
