@havinsomefun
I like the methodology of learning through practice exams too.
However, for the last two exams I sat (ISSEP and ISSAP) the available practice exams are all old and based on the previous version of the certification so the domains don't align - that seems to be the case with the CSSLP too.
As you have described, the lack of current practice exams requires you to adopt a different learning method. One that I have had success with is to use the suggested reference list (hence the post I made yesterday). All questions you will see on the exam should be able to be referenced back to text found somewhere inside items on that list.
For the ISSEP and ISSAP I took one practice exam for each to help me gauge any weak areas and understand the types of questions I might see on the real test, the topics I might be asked about, and the level of detail I need to know. I then kept those things in mind while I was studying to make sure I was absorbing the correct information at the right level. Even though I fared pretty well in the initial practice exams due to extensive experience in the field, I still felt the need to put in significant amounts of study not only so I passed the exams but so I actually increased my knowledge in the subjects to authoritative levels.
I appreciate there are a lot of suggested references for the CSSLP, so I would look to read the CBK and the AIO which others have used to pass, and then look to read at least one authoritative reference for each domain I feel I am weak in chosen from the list.
As I said yesterday there is always a lot of overlap between many of the books on the list, so you don't need to read them all as you just end up re-reading content you've already gone over - although this is good for revision.
I'm not sure re-reading the books you've already read before but not been successful on the exam with is a good strategy. Maybe you just don't "click" with those books? You wouldn't be the first person to find an ISC2 CBK to be very dry and difficult to get on with! So I'd definitely recommend some new material. As you have taken the test before you know the domains where you need to bolster your understanding, so just pick up some new references that cover any of your weak areas.
While I appreciate your point about the double speak style questions, in my experience with the CCSP and ISSAP tests, if you truly understand the material all these questions do is slow you down from arriving at the correct answer.
In terms of recommending the CISM or CISA over the CSSLP, aren't the purpose of these three certifications fundamentally different? The CSSLP is focused on software security. While the CISM is focused on developing security/risk management programmes and doesn't cover software security at all to the best of my knowledge - I believe it touches on secure systems development which is not necessarily the same thing. While the CISA is about security auditing although this does cover elements of auditing software development.
If you're looking for something to gain recognition on your CV/resume then CISM/CISA would be the way to go, but my reason for considering the CSSLP is to show I have capability in secure applications/software so they would not be appropriate.
I'm not sure when (or if) I will be tackling this certification as I have some other things on my plate right now, and I only consider it as a nice to have rather than a must have. I'm likely to attempt the ISSMP first anyway when I do find time for studying again just to complete the full set of CISSP concentrations.
Anyway, good luck with your studies, and I applaud your persistence and tenacity!
EDIT: updated to make it clear this is a reply to @havinsomefun
