Friday, April 24, 2009

CISSP Study Plan

This is the method that I used to prepare for and pass the CISSP exam. It's pretty much an amalgamation of advice from the cccure.org forum, but it worked out great for me and I thought I'd share it for those interested.

The CISSP is the gold standard of information security certifications, one of the only certifications to be ISO standardized, and one of the most-demanded and highest-paying IT certifications. It's six hour multiple choice exam consisting of 250 questions, where often-times all of the answers are right, and one is just "more right." It's about as sadistic as a multiple choice test can be, and due to the difficulty level and high cost of admission, preparation should not be taken lightly.

There are several "boot camps" or one or two week seminars that you can go to that will prepare you for the test. I didn't go to one of them, and I can't see them being very valuable for this test, as the material is conceptual and demands understanding rather than memorization.

In addition to the test, a CISSP must have at least five years of experience in two of the ten CISSP domains ("Common Body of Knowledge"), and must have an active CISSP sponsor them. I believe the experience is important beyond that of the requirement, as I believe the test itself would be very difficult to pass without it. While I think my study was a great help, I know that I wouldn't have passed the test if it weren't for my experience.

So here's what I did. It's mostly an amalgamation of advice from the forums on cccure.org which is an outstanding website devoted to preparing for the CISSP and similar exams.

1. Watch Clement's Preparation Guide from start to finish (probably the most helpful thing, and free).

2. Obtain Shon Harris's "All in One CISSP" book, fourth edition. This book has all of the information that you need to pass the CISSP, the trick is absorbing it because the book is literally epic. What I did was write down all of the "quick tips" bullet points at the end of each chapter (writing helps me memorize), and then go back and highlight anyones that you are not 100% familiar with. Do the quizzes at the end of each chapter and read the explanations on all of the questions, and any one that you are not familiar with write down and highlight it. There are also third-party quizzes on the CD-rom but I found the quizzes in bullet #4 to be a lot better quality.

3. Religiously study the sections in the AIO book that pertain to the highlighted information.

4. Go to CCCure Quizzer and do a 100-question practice test every night. Also check "Review only incorrect answers". At the end, you will have a nice report with detailed explanations and reference material of any question that you got wrong. You can print it and it will become study material. On the last 2 days, I did 250-question practice tests. Anything from the question explanations that requires more clarification can be looked up in AIO.

5. In the last couple of days make sure you are absolutely clear on everything on this outline: Overley Outline. Anything not completely understood can be looked up in AIO.

6. My method for actually taking the test was to go through the book once, circle the answer of all of the questions that were gimmes. Then I did 50 questions, circling the answer in the book. After a solid 50 questions were done, I transcribed them to the scantron sheet and stood up and took a break. I don't know if this actually helped or not but it certainly seemed to make the test a lot less intimidating.

7. Potentially the most helpful piece of advice I read was "When in doubt, think like a manager". This sounds kind of hokey but was very helpful on many of the questions that I had doubts on. A lot of the questions have multiple good answers when evaluated technically but when taking a risk assessment or cost/benefit view the answer becomes clearer.

Good luck, I hope that you only take the test once!