There were two groups of folks from my work who prepared and took the CISSP exam. The first group of 3 (including my boss) started off with a CISSP boot camp, studied for about 10 weeks, traveled to a different city, stayed in a hotel and took the exam. They felt very unsure after the exam and thought that they either barely passed or barely failed. They all passed. So the pressure was on me and the rest of the second group! The first group studied about 500 hours.
There were 4 guys from my team that made up the second group (including me). I started out with just the AIO Shon Harris book (Fourth Edition) and the online searchsecurity.com site that is extremely introductory but has some short Shon Harris videos (basically just introduces each domain). Shortly after I added a SANS audio/slides series taught by Eric Cole. The audio and slides were from a 1-week CISSP boot camp sponsored by SANS. And then I took many tests (http://www.freepracticetests.org/quiz/quiz.php). And failed miserably! I had to switch gears!
SO, the first thing I did was start a study group. I really think this is key. It was definitely a turning point for me. If you can get a study buddy then DO IT! We added a video series by Shon Harris. I also made some study cards based on a boot camp that centers around the Shon Harris book. The first group of 3 guys went through that actual boot camp by Eric Reed, they traveled and went through a week of hell. They said it was a waste of money. It was not sponsored by ISC2, but still a waste (in their opinion).
We conned our boss into buying 300 practice questions from ISC2. They are pretty good questions, but nowhere near the difficulty level of the real exam. And we focused on the freepracticetests.org site. We generated questions across each individual domain that we studied and focused on the pro questions. But then we discovered later on that the pro (the hardest) doesn’t give you much of the easy/medium/hard, but seems to pad with the rookie questions. So then we went back and generated 250 (or the max) for each level (Rookie, Easy, Medium, Hard & Pro) across all domains. If I had a chance to do it again (and I just might!) I would do each level for each individual domain (or 50 different tests).
Once we generated the questions we copied/pasted into note pad or text pad, printed the questions off, created a scan tron sheet (link here) and we practiced taking the real exam with the questions from freepracticetests.org. We were scoring in the mid to upper 80s to lower 90s. We made it a practice to write on the test. We wrote the answer (A, B C or D) on the test, crossed off the wrong answers, made notes, circled or underlined key words. marked questions that we were unsure or not confident about, etc.
One of the guys on our team used the Official ISC2 book and we also used an Exam Cram book and Exam Cram practice test book, we mostly used these as a reference along with wikipedia. I estimated that I studied around 300 hours-just me.
The exam that we registered for was in our metro area, but about 45 minutes away. We conned our boss into letting us stay in the hotel that was hosting the exam the night before the exam. That way there were no worries about traffic or travel. We relaxed the night before, did a little bit of last-minute testing and cramming and we felt pretty darn good. We visited the conference room where the exam would be held-nothing too special, but still building up our confidence. We made sure that we woke up 2 hours before the exam and we were ready to go when the doors opened a half hour before the instructions were given. The room was packed-about 40 testers, most seemed to be there for the CISSP exam.
And then there was the taking of the real CISSP exam after all that preparation. Holy hell. It was like a blow to the head from out of nowhere.
I came up with the idea of a cheat sheet. I started to create a cheat sheet (link here) that I wanted to memorize so that when I sat down for the exam I could just begin to write these notes on paper and create a cheat sheet from memory! I was proud of myself, before I even looked at a question I scribbled my notes on the inside of the first page. I made a half a page of notes. The OSI model, reserved IP range, Bell LaPadula, Biba and Clark Wilson model and some notes. And a few others. I never used any of it! I had one question on the OSI model and it was about an optical cable…physical layer. That was the easiest question on the test. Maybe the only easy question on the test. And I still spent a good 2-3 mins making sure I wasn’t being tricked.
About 3 pages in I had to close the booklet to make sure I was actually taking a CISSP exam. There were a couple of other exams being offered at the same time. Unfortunately I had the right exam. I will say this, about 3-4% of the questions I knew the answer before I saw the answers, but there were about the same amount that I didn’t have a freaking clue, as in I totally and completely guessed-but only 5-7 questions. MOST of the questions I was able to cross off 2 of the 4 answers and make a pretty good decision about the final answer-as in I felt pretty good about the answer I picked. I didn’t second guess too much.
Some questions took up a half or a whole page. It took me 5 solid hours. I took 2-3 bathroom breaks. I had 2-3 plastic 20oz bottles of Pepsi. I had a few chocolate granola bars. I went through 3 pencils (that they provided). It was brutal. I planned to review the questions I didn’t feel too good about, but just didn’t have it in me-plus I went a tad slower and was pretty comfortable with the answers I chose. 2 of the others in my group also took a solid 5 hours and one took about 3. I am very unsure of how I did. I THINK I guessed OK most of the time.
I had 3 immediate thoughts during and right after the exam:
- Inch deep mile wide my ass! I wrote this on the inside cover of the exam booklet.
- My boss got ripped off on the 300 ISC2 questions! The exam simply wasn’t like the practice test questions.
- I’m gonna have words with my co-workers who said that the test questions we were studying are an accurate representation of the real exam.
Most of the others on my team that took the exam were almost sure that they failed. The first group of 3 that took the exam last summer felt the exact same way, 2 were sure they failed and were on pins and needles waiting for the results. Boss thought that they would all barely pass (or barely fail). They all passed! They too expressed frustration with the practice questions they studied.
There was only 1 in my group that took the exam with me that is pretty confident that he passed. He has been in the telecom and tech industry for 20 years, and honestly, he is the smartest person I know. I am sure he passed. The other 3 of us just flat out don’t know. If I failed then I think I only missed the mark by a little-I doubt I got less than 60%. And I am very confident that I can switch gears and study another month or 2 and pass no problem.
My co-worker keeps asking if I think I got 75 questions wrong-that is about how many you can miss and still pass. The questions are weighted so that is not completely accurate. ISC2 throws out 25 that they use to just test the waters. 70% of 250 would mean one could miss 75 questions, but 250 minus 25 is 225, 70% of that is about 67 questions. So technically one could miss 67 plus 25, or 92! I really don’t know how I did! I sure could have missed 75 questions! I just don’t know. Hopefully I will know before Christmas.
I took the CISSP exam December 5th, 2009. It is my understanding that they just wait until they have “enough” exams and then they grade them all. So I don’t know when they will grade them or when I will get the results.
I will let you know ASAP! And I will be honest about the results.
1/8/10 update: I received my CISSP results today from (ISC)². I am now part of the 80% of the people that fail the CISSP exam their first time. I got 65% and needed a 70%, so I barely failed. Time to put Plan B into effect.
