I passed the CISSP exam on 3-3-2018 on first attempt. I answered question #150 with about 90 seconds left of the 3 hours allotted. Knowing 100 questions was the minimum, I was pretty convinced by question 130 or so that I wasn’t going to pass. I felt I was too ‘iffy’ on too many questions instead of feeling highly confident on a majority of the questions. When I picked up my test results when I left the testing center and saw I passed I was almost stunned. I have not taken certification tests in 20 years and that was for the Master CNE from Novell. When I took the 14 exams required for the MCNE my goal was entirely to pass the test and that’s how I studied. I’m at a different place in my career now with different goals and my primary goal was to know the material thoroughly rather than to study to just pass the exam. I passed the exam and am a CISSP, but the test really highlighted for me not how much I know, but how much I don’t know. My preparation for the exam involved using every possible resource I could get my hands on. I used the Shon Harris All-In-One guide the most (ver 6 and 7 for reference), various other CISSP study guides, Google searches of specific topics, especially cryptography, and took all the practice tests I could find. As I went through various materials I made flash cards with the FLASHCARD app for IOS and ended up with probably a couple of thousand flash cards. Many I never revisited but the act of creating the flash cards was enough to help me recall info later. Flash cards are my way of taking notes where other people might write notes down on note pads or electronically in Word, Notepad, etc. I had some good luck as my test date neared - about 4 weeks before my test I was assigned a project at work to develop a course for our customer covering basic system and operations security. The subject matter integrated perfectly with my study timeline, so it was almost like I was getting paid to study for the final month before exam. (The course I developed will be used now by about 5,000 federal employees.). With a vested interest now in the quality and reputation of the CISSP certification, I would encourage everyone pursuing the CISSP to study with the goal of knowing the material and not to pass the exam. If you thorough know the material, you WILL pass the exam. As a way to determine if you thoroughly know the material, ask yourself honestly if you could explain most of the CISSP topics to someone if they stopped you in the hallway and asked. About 2 weeks after my exam, I was presenting an overview of the course I developed to my customer’s Information Security Office management team. One of the managers stopped me on one of my cryptography slides and asked about my graphics covering the three types of cryptography. I had to give a quick overview of where hashing is used and why, and explain digital signatures and the cryptography used. I think that’s where the payoff showed up by studying to know the material rather than studying to pass the test. Good luck to you.
