@veejaydee40 wrote:
It's very misleading when you state Project Managers, Quality Assurance Analysts & even Business Analysts can take the exams and pass it.
It's also implied that this exams is geared for folks with software development life cycle knowledge but in my opinion, it's really not. It's more for folks with hard-core IT background for example, coders, developers, programmer's etc.
Valerie,
It appears that you may have misread or misinterpreted the information on the CSSLP exam.
Here is what the CSSLP information page says:
=-=-=-=-=
The CSSLP is ideal for software development and security professionals responsible for applying best practices to each phase of the SDLC – from software design and implementation to testing and deployment – including those in the following positions:
Software Architect Penetration Tester
Software Engineer Software Procurement Analyst
Software Developer Project Manager
Application Security Specialist Security Manager
Software Program Manager Quality Assurance Tester
IT Director/Manager
=-=-=-=
There is no claim that individuals in any of those specialties can (or should) take the exam expecting to pass without preparation. The certification is one that covers knowledge that "security professionals responsible for applying best practices to each phase of the SDLC" should have. One reason that we have so much software without decent security built in is that a huge proportion of workers with SDCL responsibility, including oversight jobs like PM and QA, simply do not.
Similar to the basic philosophy of the CISSP CBK content, the CSSLP content CBK is based on knowledge that SDLC-involved workers should have, both to do their own jobs and also to understand what others in the SDLC environment should be doing. This broader knowledge is especially important for management level workers like project managers and software quality assurance workers, to be sure the architects, programmers, and covers are including the correct aspects.
Also, with regard to the expectation that the cram course will cover every question on the exam, I repeat the statement above by William @denbesten:
"f you read through these boards, you will find that there is no single source of material that will prepare you for an (ISC)² exam. The recommendations that you will consistently get are to use many references, to take lots of practice tests and to earn (much of) the required experience prior to sitting for the exam. (ISC)² exams are all about ability to apply your knowledge and experience in real-world situations. Although important, "book knowledge" is not enough to pass (ISC)² exams."
