Solved Plan to Succeed at CISSP

---

Hey everyone,

I've been a member of the ITPro.TV community for some time, but this is my first time posting in the forums. I also apologize in advance if this post is lengthy. I am a transitioning Air Force veteran with 8 years experience as a technical leader in nuclear command and control and quality assurance. I am drawn to the technical leadership opportunities that exist in the cybersecurity community and I am pursuing a transition to the information security industry. I have tackled this on two fronts: academic education and personal education.

Academically, I was admitted to Norwich University’s Masters in Information Security and Assurance program. I have been taking classes for the past year and have a perfect GPA. My focus is on vulnerability management, and thus far I have taken classes on risk management, information security fundamentals, and information security technology. That last class used “Computer Security: Principles and Practice,” which went deep into each of the CISSP CBK domains.

Personally, over the past year, I have taken preparation courses for the A+, Net+, and Sec+, but my goal has always been the CISSP. I know that I might not have the experience to outright gain the CISSP after passing the test, but I at least want to gain the Associate of ISC2 designation.

All of this is background to my question. I plan on sitting for the CISSP exam in mid-April 2018. I have already watched the entirety of the ITPro.TV CISSP content, and plan on reviewing that content in January. I am also studying the CISSP Official Study Guide and will read through other study guides as well (Eleventh Hour CISSP, CISSP in 21 Days, CISSP for Dummies). I regularly take practice exams through Transcender and in the different study guides and I perform above 75% on average.

Based on this information, is there anything else that I can do to prepare over the next five months? Do the Transcender exams that we take through here translate well to what we will see on the exam? I know that there is a tough road ahead, but I have really enjoyed the subject matter so far and I seem to be gaining the necessary knowledge to succeed in the future. Thanks for your help!

Kelly McCormick

@kelly-mccormick,

I'll get Adam to look at your question today. Glad you're a member!

So before Adam answers, I'll add something to your list. Do not hesitate to ask questions here in the forums about topics you do not understand. Many of our members will look at the question and maybe even provide an answer or perspective for you. The hosts here also will monitor these forums and try and answer too if possible. You can make your goal a solitary pursuit but you don't have too.

@kelly-mccormick,

"Kelly,

I hope all is well. First of all thank you for your service to our country, and for your commitment to our security on multiple fronts.

With regard to your choices as you continue to execute on your transition plan for the next phase of your career, in short I think that you are doing everything that you need to do to ensure success.

The things that I would offer as observations are below:

The CISSP exam transitions over to adaptive testing as of December 18th of this year; see here:   https://www.isc2.org/Certifications/CISSP/CISSP-Cat
About (ISC)² - isc2.org
www.isc2.org
About Certifications. Overview Why Certification Matters
I would read up on the coming changes, but do not let them distract you, as they are cosmetic more so then anything else. The knowledge base is the same, and the exam outline DOES NOT change, which means that what you are studying is still 100% accurate in terms of exam preparation.


2. What I tell my students all the time for CISSP is that: 

    a. "the exam is a mile wide and an inch deep"
    What we mean by this is that there is ALOT of information that you are expected to understand and master for the exam, but the danger is going too deep in any one area. There are a small number of questions based on 8 domains that can be asked, even less as we move to adaptive testing, and as a result while there are always going to be questions that you may not know the answer to, the likelihood is that if you study smart, you will pass the exam.

    b. What you know about the "real world", especially in your case after 8 years in the military, being subjected to the specificity of DISA STIGs and all of the other craziness that Certification and Accreditation (C&A) and the Risk Management Framework (RMF) etc... leads to will cause you to fail if you allow it to intrude while you are taking the exam. You need to ensure that your focus on answering is driven by the material you study and the SPECIFIC KNOWLEDGE associated with that item as per the official materials / explanations that you are using.

    For example, something simple like the following translates regardless of whose guidance you follow:

    NEVER, EVER, EVER use Telnet to connect to and manage anything as it transmits in the clear. ALWAYS use SSH as an alternate that ensures Confidentiality protections are applied.

    An example of something that can be interpreted in many different ways depending on whose guidance you are following:

    Implement and use an L2TP-IPSEC VPN to secure traffic.

    What I would be focused on for LT2P-IPSEC is the EXACT steps involved in implementing, the functional definition of each of the moving parts associated with IPSEC ( the Authentication Header / the Encapsulating Security Payload / the Security Association / IKE via Diffie-Hellman or Public Key Certs / Tunnel vs. Transport mode ).

    c. Even if it seems crazy, know what we tell you to know.... ( what is a modem and what it does, port #'s, war dialing, etc... )

    d. The exam traditionally DOES NOT ask you to simply define a term or concept, but rather will force you to think critically and apply that knowledge in a variety of circumstances and / or scenarios.

There are many potential areas that you may need help with as you move forward towards the exam, and it is hard to anticipate what they may be ahead of time.

Please feel free to reach out to me directly if necessary with any questions you may have as you move forward.

e-mail: adam@itpro.tv

Regards,

Adam Gordon
Edutainer
(352) 600-6900"

@Ronnie-Wong Thank you Ronnie and thank you Adam for answering my question. I've got a lot of work ahead of me, but I really like this material and I am excited to learn all that I can about this exciting industry. I'll keep plugging away, and if I have any further questions, I'll let you all know. Thanks again!