Originally published on November 2, 2020, edited for grammar and better readability.
As I have managed to pass the CISSP examination this past Saturday morning, on my first try, no less, I thought it worthwhile to set down my overall impressions of the thing.
First, a general comment. Having sat for more university and professional examinations in the past than I care to either count or admit, I can typically sense more or less how well, or how poorly, things are going as I am working through them. It isn’t the same as being able to predict one’s exact score, and, especially on essay-based exams, there is always the issue of whether the examiners understand my answer in the same way that I do. Nevertheless, I typically have some sense of how things are going before I am given the results.
This, however, was the first examination I sat for in a very long time where I felt completely at sea in this regard all the way through. In fact, the results handed to me by the proctor1 came as something of a shock. Part of the problem stems from some of the exam specifics discussed below, but I suppose there was also the element of having studied so much information across so many disparate areas – compared, for example, to a single-subject university exam focusing on two or three clearly circumscribed topics – that it was difficult, at least for me, to get a real-time sense of how I might be doing.
To the gory details then. In keeping with my personal custom, stemming from having played far, far too many video games since my boyhood, here are three thoughts I had on the specific exam that I was presented with this past Saturday.
1. There were comparatively few questions of fact, and a great many questions of prioritisation.
In this context, a question of fact tests ones knowledge of some memorised specific. For example, which port is used by the HTTPS protocol2, or what is are the three components of the CIA triad3. These were very, very few and far between, at least in my particular exam session, each dispensed with in not much more than five seconds as I happened to know them cold.
Instead, my exam was primarily comprised of what I would term questions of prioritisation. That is, ones asking which of these options happens to be the most appropriate for this or that situation, and then presenting me with multiple valid alternatives. Here is a strictly hypothetical example – as, for obvious reasons, I am not going to divulge any actual questions from my examination – that I have just created from scratch to illustrate the point:
As a newly hired InfoSec manager, which of the following is the MOST important thing you should verify in your organisation?
a) All patches are up to date.
b) The organisation has a current security policy.
c) The internal network is protected by firewalls and a DMZ.
d) The accounting department has the correct details of your direct deposit account.
Obviously, choise (d) here is a deliberate distraction. Of the other three, however, all represent valid answers to the question posed. The task, then, is to form them into a sort of a priority ladder, essentially to ask – if I only could do one of these things, which would it be. In my hypothetical question, and in the context of CISSP study materials I had gone through, the correct answer is probably going to be (b), at least given the emphasis on security policies and centralised top-down decision-making in the CISSP study materials. Suppose, however, that choice (b) were instead replaced with something like – ensure all administrative passwords are changed from their default options. Now the question has, from one point of view, three equally valid answers, all of which would need to be done in a real-life situation. And yet, the way the CISSP exam is written, or, at least, the way my CISSP exam was written, one is supposed to know precisely which one of them is singularly more important than the rest.
Clearly, as I did not fail the exam, I must have managed to work out the correct answer for a clear majority of the prioritisation questions I faced. This, however, does not make the experience any less disorienting.
2. A majority of CISSP study domains were virtually ignored.
There was precisely one – one! – question on physical security out of the 149 questions I faced in total. There were zero questions on ports, one question on IPSec, at most two or three questions on any sort of encryption or hashes, zero questions on “classical” security models like Bell-LaPadula…In all honesty, if I were to take the official study guide for the CISSP examination, a weighty tome of exactly 1,000 pages not counting the index4, then approximately 600-700 pages’ worth of material could be safely chucked out without impacting my final score in the slightest.
I am not certain whether this is merely a statistical accident – after all, as the exam is adaptive, one presumes that each student receives at least a somewhat personalised set of questions as selected by the algorithm – or symptomatic of something greater, for example a global shift in emphasis on only some of the tested domains. Nevertheless, it is no small annoyance to discover that a great proportion of one’s study efforts were, ultimately, for naught.
3. Modernity uber alles.
To belabour the point, it may very well be that anyone else sitting for the CISSP exam will face a different array of questions than the one I had to overcome. Nevertheless, I did notice that my specific examination contained a lot of questions related to:
- Cloud computing, including all different kinds of “-as a service” agreements.
- Software development lifecycle, with a particular focus on some of the most recent development models such as Agile Development.
- Attribute Based Access Control (ABAC), to the complete exclusion of any other access control models. Of note, my study materials had included precisely zero information on ABAC, which meant that during the exam I had to improvise.
Not that there were not any questions on some of the more dated methodologies or technical developments. However, it certainly did seem to me that the algorithm overseeing my specific examination was hell-bent on stressing some of the most recent information technology trends, and far less concerned with, say, the differences between Biba and Bell-LaPadula, which is the precisely opposite impression from what one might perceive from published study guides.
Nevertheless, all that is behind me, at least for now. I suppose it would only be fitting to end this post with some brief notes on exam preparation. In my case, I eschewed any preparatory courses, and instead busied myself with several study guides and question books, both the official one that I had already mentioned, and, in essence, whatever else I could find at the local book shop that looked reasonably respectable. As well, in the same space of time I had also gone through CompTIA’s CYSA+ study guide, though it will be a while yet before I sit for that examination, and a number of theoretical topics do overlap quite nicely to create something of a positive concept reinforcement5. Clearly, that was enough, but, very importantly, this is not the sort of examination where one may get away with a couple of days’ worth of cramming6. In my case, it took several months to prepare, with the last few weeks being especially intense, and, looking back at it, I must admit that going it alone as I had might prove a little too stressful and not sufficiently structured for some.
- A simple form letter of congratulation, the exact score was not disclosed.[↩]
- 443, of course![↩]
- Confidentiality, Integrity, Availability. If I had a golden sovereign for every blasted time I have had to answer this question…[↩]
- My copy is the CISSP Official Study Guide, Eighth Edition, by Chappie, Stewart and Gibson.[↩]
- To be sure, the CYSA+ exam also heavily stresses reading security logs and working with specific InfoSec tools, none of which is on the CISSP examination.[↩]
- Unlike, say, the Series 7.[↩]