Passed on 1st try, thanks much to this helpful group
I'm an IT generalist with many different disciplines under my belt after almost 30 years. Last 8 years has been in InfoSec, so the CISSP was just an inevitable part of my life so finally did it. Waaaaay over studied. As everyone says here, don't obsess with memorizing OSI model, ports, so many things. I found many resources to be helpful and some to be counterproductive--no one has unlimited time and attention so focus on what works for you! Here's my thoughts on what I ran into, most of it after reading so many comments here. Definitely a TLDR post.
Class & Video recommendations:
• ISC2 Official paid class. Did the class but I didn't use any of their resources and the class was mostly anecdotes to explain the practical application of everything covered by CISSP. Personally, I don't need someone to give me examples of security controls from their past, or examples of physical controls for buildings, etc. If you have been around for a long while, you've already seen or heard of most of that. If you are fairly new to IT and InfoSec then maybe that will help you, but you can get that for free on Youtube.
• If you want video training, use whatever you can get access to, but be sure to look up Peter Zerger on Youtube--I would give him a 10/10 rating as he has good example and explanations. Some of it seems dated, but as he mentions it doesn't change that much from one version of the exam to the next.
• Destination Certification videos. I went through their videos and took notes on the Mind Maps sheets (mentioned next) as the videos played, then re-watched the videos when I had time. It is not really that in depth, but oddly it's perfect for this exam. I give this a 9/10 rating, just feels a little light on detail.
Book and study material recommendations
• ISC2 Official Study Guide (OSG) paper book - This is the encyclopedia. I prefer to have a paper book and to take notes and over-study, this book is good for that. In terms of practicality for the test, it is probably a 7/10 because the content is not organized by domain, and there is a LOT of superfluous content. Yes it has everything, but I think you are better off with a resource that is organized like the domain outline.
• ISC2 Office Study Guide PDF book (obtained with my paid class). This is better if you want to search, but its search function is pretty rudimentary so I frequently couldn't find specific key words that I'm pretty sure should have been in there. This IS organized by domain, so it is TOTALLY different than their paper book. I'd rate this as probably 8/10 since it is organized by domains, but the ability to take notes and go back and re-study is limited
• Destination Certification paper book. I am a visual learner and this book is filled with graphical presentations of info and table versions of lists--definitely beneficial for me. And I think I got it for just under $40 on Amazon. I give this a 10/10. Organized by domains and the content 100% corresponds to their "Mind Maps", which I mention next.
• Destination Certification 'Mind Maps'. When I saw these months ago I knew they were my path forward. I printed them out and took very condensed, bullet point type notes on the pages. This was my touchstone and served me well. In terms of applicability toward passing the exam this was a 10/10
Flash cards, sample questions and Apps
• First off, let's categorize things. It seems that people consider flash cards as "content"--if you are doing rote memorization type learning let's call that 'content' (my personal term is trivia). Then there is our exam, which is almost 100% scenario based. These 2 (content and scenario) are very different approaches to learning, and you need to do the first so you can do the latter. Also, the various apps have flashcards and sample questions, here's my views on all of that
• Second off--every resource has a limited number of questions to go through. They all have a LOT of flash cards, but when it comes to sample questions you can quickly chew through their questions and then you'll be doing repeats. So just try and be mindful of your pace of using of the sample questions.
• Destination Certification app. Free, very nicely done. Flashcards (content) I give them 10/10. This maps to their video series and book very well--their stuff is 100% correlated across their platform, kudos for that. RE the sample questions in their app, well, just skip it. They are basically content questions and every 3rd question is either IoT or Cryptocurrency related. It's bizarre. Their book is the best but their questions are the worst. But again, this is free so it does have value. A 7/10
• ISC2 official flash cards. I only ever saw them on a computer online, and they are okay, but you have to be concerned that it's based on their encyclopedia book which has WAY more info than you need for the exam. This might not be the most focused use of your time.
•ISC2 question book that came with the OSG. The OSG on Amazon came with a 600-page or so book of sample questions authored by none other than Mike Chapple. The book has a 100-question quiz corresponding to the 8 CISSP domains, plus 3 or 4 full size sample exams covering all domains. These are all trivia content questions and barely any scenario questions. But this is a quality alternative to a digital app if you want a printed book. I'll give this a 6/10
• Pocket Prep - yah I paid for the premium (under $60 for 3 months) and I felt it is totally worth it. Their app and their online site are very similar and it's really easy to switch back and forth between them and your history and stats sync well. 90% of what you are going to see are trivia content type questions, but the one exception that makes them worth it was the 1st of 3 Mock exams (full size timed test). That one was mostly scenario question and makes it worth the money, in addition to how good the overall platform is. I give this one a 10/10 for sure, great value for what you get.
• Quantum exams, sample tests only. This is gold. This is 11/10. This is expensive 🙂 This is 100% scenario based and is the closest you can get to the real exam. It is very 'process' oriented so you need to memorize about 9 processes so you can have any chance of feeling successful with these tests. You can do quick 10-question quizzes, 100 question untimed, 100 question timed non-CAT, and 100 question timed CAT tests. BE WARNED - I don't know how many questions they have in there but I started to get repeat questions very quickly. By the time I got to my first CAT test I got 32 out of 146 questions that were repeats. That was frustrating, so be mindful of how many of the non-CAT quizzes you go through before you try a CAT test. Personally I'd say do just a couple 10-question quizzes, move to 100 question non-CAT timed test then CAT test. The key value you can get with Quantum--your pacing of your test. You MUST average 75 seconds or less per question to be able to answer 150 questions in 180 minutes. I consistently was at 60 seconds per question so it gave me a comfortable buffer.
Okay, so my final thoughts of what you should not spend your time studying/memorizing for this exam:
- OSI model. Yes be aware of what operates at roughly which layers, but don't obsess over this too much
- TCP port numbers. Yes be aware of what protocols are used in which scenarios
- Those 9 processes I memorized that helped me with Quantum, well that will only tangentially help you on the exam.
Good luck to anyone taking the test soon. You can do it!