My experience taking the CISSP exam

It's been 2 days since sitting my CISSP exam, which I experienced with difficulties and the unlikeliness that I would pass 1st time. Though this isn't a shock considering it's reported that 81% of individuals fail on their first attempt. During the penultimate day, I investigated this shocking figure by reviewing blogs and forums to hopefully grasp an understanding to why so many candidates fail. Turned out EVERYONE was talking about their stresses and personal emotions rather than talking about the fundamental aspects of the exam. I asked myself, "why the heck are people talking like this?". If the topic was about school plays or getting your first period I'd understand, though this was a credited yet highlight professional examination.
August 29, 2012
CISSP

Turns out you're strictly prohibited to discuss the exam contents which also includes comparing the dynamics and potential topics (assuming you not disclose any answers). I quickly realised that I had little interest reading peoples emotions and decided to give it up as a loss cause. Instead, I took the executive decision by 'socialising' with friends over a 5hr period. Of course this wasn't a lack of due care, instead there was some logic behind my decision. Needless to say that spending time away from the exam revision clears your mind. You don't want to get bogged-down with the granulated information and anyway, you should know your stuff prior to the day before.


Teaching Others

https://technicalconfessions.com/images/postimages/postimages/_28_2_alternative_to_teaching.png

Another logical perspective of mine is that teaching is the best way to learn. Talking and presenting to others about your exam gives you a different perspective on what you already know allowing you to get that extra 10% . Yapping to close friends about compliance and security enforcements allows you develop a clearer understanding of the exam (even if your friend dont give two hoots about).

From my experience, below are my recommendations in preparing for the exam

  • Learn your stuff weeks in advance. Don't do the 80/20 theory by cramming your stuff in the later stages.
  • Don't read other blogs about people telling you about their emotions - No one ACTUALLY cares about their emotions and it doesn't do you any good either.
  • Ask your mummy to make you a pack lunch - this can be eaten whilst within the exam!
  • Don't leave before the 6hr timeframe. I noticed 2 people leaving after 2hrs... HOW IS THAT POSSIBLE, that's 28 seconds a question! I can't do anything in 28 seconds. In fact it takes me 30 seconds to count to 28 seconds! Use that remaining time to revise your answers.
  • Take a bottle of water with you - this is one of the very few items allowed on the table during the exam. Dehydration reduces your concentration so this is important.
  • Don't forget to print out your registration form (should be in your inbox).
  • You need a government published ID as proof which acts as Identification and accountability.
  • Use the Shon Harris videos 2007. This was something I didn't use and whilst revising though this can become extremely helpful.
  • Personally, I would not recommend the use of this book. I bought this believing that a larger, more in-depth book was not required - I was wrong. I spent more time using Google when grasping a getter understanding. This book is clear and concise, though lacks the necessary depth needed.

I woke up, read though my notes 1 more time and then travelled to the exam. You will find individuals talking about how the exam is difficult and to be honest, they're spot on. Even though there's an option of 4 possible answers, all the answers are fairly similar with only a slight differential between them, especially the more non-technical questions. The most valuable tip I could provide is this. The exam is focused forwards mid and upper management so it's suggested that it will be less technical-orientated and focused more on the demand of a general technical understanding to make executive decisions. The exam questions are not clear cut. Some questions are half a page long and with 360mins on 250 questions, you don't have that much time messing around.

Looking back, I can recall around 5 questions I took a complete stab at and got only 2 of them right after asking google immediately after the exam. If I'm honest, I'm happy I got 40% on my complete guesses, which statistically you should only get 25% correct. The magic number of correct answers to pass is 175 (ignoring the fact that 25 of the questions will not be marked).


The intelligence of a poo-throwing monkey

I believe I knew 116 questions with the remaining in question. For a second, lets imagine I never make a mistake and all those 116 I got correct (well done me!). If this were true, I would only need 59 out of the remaining 134 questions to pass. By a source of elimination, I could knock at least 1 possible answer on each question (otherwise they'd be complete guesses) though the majority were between 2 possible answers. So, if I was a monkey with limited ability only to throw poo at other surrounding monkeys and the intelligence limited to complete randomness, statistically I would get 44 correct if were to guess them all... Though I'm not a shit-throwing monkey, I am a diligent individual who's revised for this exam for 6 months. So my result is in the balance. I don't know if I failed nor have the confidence to say I passed. I wouldn't be surprised if I got 50% or 80%! That said, if I fail then I might as well degrade myself to throwing fetes as you're required to wait 12 weeks for the next opportunity to re-sit. On the bright side, The exam cost $550 and I got to keep the 2x ISC pencils from the exam. So if I a fail, these 2 pencils are now worth $225 each!

I'm not confident that I passed, I'd guess around the 60% mark. Even though I'm 10% off that mark, the probability on getting a higher score is not linear, as it becomes exponentially difficult to get for example 90% than 80%. You're meant to allow 4-6 weeks though you do hear individuals getting their results 7-10 days later. Hopefully I will update this blog around that time briefly highlighting that I passed and heavily focusing on how I underestimate myself.

About the author

Daniel is a Technical Manager with over 10 years of consulting expertise in the Identity and Access Management space.
Daniel has built from scratch this blog as well as technicalconfessions.com
Follow Daniel on twitter @nervouswiggles

Comments

Other Posts

AWS-PHP integration - Email not sent. SMTP Error: Could not authenticate.

phpsmtpaws

February 6, 2020
Created by: Daniel Redfern
AS I was migrating my environment into an S3 environment, I wanted to leverage off the SES services that AWS provide, more specifically, to leverage the off the SMTP functionality by sending an email via PHP
Read More...

SOLUTION: no headers files (.h) found in softwareserial - Arduino

Arduino

February 24, 2019
Created by: Daniel Redfern
The WeMos D1 is a ESP8266 WiFi based board is an extension to the current out-of-the-box library that comes with the Arduino installation. Because of this, you need to import in the libraries as well as acknowledging the specific board. This process is highly confusion with a number of different individuals talking about a number of different ways to integrate.
Read More...

NameID element must be present as part of the Subject in the Response message

ShibbolethSAML

August 7, 2018
Created by: Daniel Redfern
NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration.
Read More...

HOW TO provision AD group membership from OpenIDM

OpenIDMICFAD-connector

June 15, 2018
Created by: Daniel Redfern
For what I see, there's not too many supportive documentations out there that will demonstrate how provision AD group membership with the ICF connector using OpenIDM. The use of the special ldapGroups attribute is not explained anywhere in the Integrators guides to to the date of this blog. This quick blog identifies the tasks required to provision AD group membership from OpenIDM to AD using the LDAP ICF connector. However this doesn't really explain what ldapGroups actually does and there's no real worked example of how to go from an Assignment to ldapGroups to an assigned group in AD. I wrote up a wiki article for my own reference: AD group memberships automatically to users This is just my view, others may disagree, but I think the implementation experience could be improved with some more documentation and a more detailed example here.
Read More...

ForgeRock OpenIDM - InvalidCredentialException: Remote framework key is invalid

ICFIDMOpenIDMOpenICF

November 8, 2017
Created by: Daniel Redfern
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...

org.forgerock.script.exception.ScriptCompilationException: missing ; before statement

IDMsync.confforgerockopenidm

November 8, 2017
Created by: Daniel Redfern
org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...

ForgeRock IDM - org.forgerock.script.exception.ScriptCompilationException: missing ; before statemen

OpenIDMsync.confForgeRock

September 17, 2017
Created by: Daniel Redfern
ForgeRock IDM - org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...

Caused by: org.forgerock.json.resource.BadRequestException: Target does not support attribute groups

OpenIDMForgeRockICFConnector

September 17, 2017
Created by: Daniel Redfern
When performing the attempt of a reconciliation from ForgeRock IDM to Active Directory, I would get the following error
Read More...

ForgeRock OpenIDM - InvalidCredentialException: Remote framework key is invalid

OpenIDMForgeRockICFConnectorAD

September 17, 2017
Created by: Daniel Redfern
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...

ERROR Caused by com.google.api.client.auth.oauth2.TokenResponseException 400 Bad Request - invalid_g

OpenIDMIDMGoogleGoogle-AppsICFreconciliation

September 12, 2017
Created by: Daniel Redfern
During the reconcilation from OpenIDM to the ICF google apps connector, the following error response would occur. ERROR Caused by com.google.api.client.auth.oauth2.TokenResponseException 400 Bad Request - invalid_grant
Read More...