r/cissp

I passed the CISSP on my first attempt last week, and I'm still not convinced my heart rate has returned to normal.

Yes, there were some easy one-liners... but all I remember are the questions that had me wondering if I was about to pass.....out.

For context, I come from a non-technical background and have worked in GRC for about 10 years. I studied for roughly 10 weeks. If anyone wants resources, I'm happy to share but honestly, they're the same ones everyone here recommends.

My biggest takeaway: "Think like a manager" isn't the answer to every question. It's only relevant when the question actually calls for it. I also expected everything to be conceptual, but there were definitely some questions that rewarded straight up memorization of minor details.

The best advice I can give is to ignore the "perfect" study method. Find what works for you. Textbooks, videos, podcasts, flashcards, courses, whatever it is because everyone learns differently and have different responsibilities (extra shout out to the parents, especially the moms, somehow squeezing CISSP into an already impossible schedule.)

People say the exam is "a mile wide and an inch deep," and that's mostly true... until the CAT exam decides to camp out in your weakest domains. I felt like mine kept coming back to the same areas over and over. It's almost as if you need to know everything... which is probably why this exam has the reputation it does.

Good luck to everyone taking it soon. May your exam end in a pass... and may your heart survive the experience. 🤞

If you have any questions on the study resources I used, let me know!

Passed the CISSP exam today!

I decided to take it in person at a test center because online proctoring is always a nightmare with room conditions and strict rules.

During the test, I faced several questions that I had never seen before and had absolutely no clue how to answer. I just tried to apply my best logic. When the exam stopped right at question 100, my heart sank. I thought I failed miserably and that the adaptive system just shut down because there was no way for me to recover.

My pacing was all over the place too. Some questions took me 10 seconds, while others had me staring at the screen for nearly 3 minutes. Total exam time was 1 hour and 10 minutes. Walking up to the desk and seeing the paper say I passed was an incredible feeling.

As for my study resources, my company paid for the exam, so I used the official ISC2 online interactive learning content. I also bought a one-month Udemy subscription and ran through all of Jason Dion's practice exams. Whenever I missed a question, I fed it into Claude to break down the logic, explain why I was wrong, and highlight the most important concepts for that topic.

I am really happy right now. I studied about one month and I have almost 4 years of experience, so I will officially submit my endorsement this September when I hit the 4-year mark, using my degree/other certs as a waiver. I also hold the ISC2 CC, CompTIA Sec+, Microsoft SC-900, and PECB ISO 27001 Lead Implementer, which definitely helped build a good baseline.

Good luck to everyone studying. You can definitely do this!

I passed late in the afternoon today at 138 questions with 3 minutes left.

Study resources:
OSG
Learnzapp
Pete Zergers exam cram
1 full CAT style Quantum Exam. Score was 526/1000

I was hoping to pass at 100 questions with an hour left but a pass is a pass.

Passed this morning at 100 questions around 90-95 minutes left. This community was a huge help in many ways. Thank you all.

A little background:

I’ve been furloughed due to budget constraints for almost 3 months now. Been job searching for a total of 6 months, over 300 applications and nothing. Started doubting if I was even in the right field. Job searching has been a nightmare. No feedback, getting ghosted, writing and rewriting dozens of resumes.

Been a Data Protection Officer for a small SaaS startup for 3 years. Was in US Army cyber operations for 2.5 years before that and an Infantryman for 3 years before that. So total experience in the field is just under 6 years.

Got Net+ and Sec+ several years ago, finished my BS in cybersecurity last May, I have 2 semesters left on my MS in information security management.

Decided 3 weeks ago that I was going to bite the bullet and pay for the exams and get them scheduled. Being out of work the last few months and having almost no interviews, my cybersecurity brain wasn’t exactly the freshest. Started with CRISC, studied for 5 days and crushed that one 2 weeks ago. Immediately started studying for CISSP after that.

To be honest, I spent every waking moment outside of job searching and graduate coursework studying. I spend 3 hours most days in the gym and ran videos and audio books the whole time. My recommendation if you’re busy, having something playing, even if you’re only paying attention with 20% of your brain. You’ll retain little things. My resources:

Pet Zerger videos - super helpful on the mindset and covered a solid amount of material. Watched some multiple times.

Dest Cert - MindMap videos on YouTube were great for giving a quick rundown of a lot of what you’re likely to run across.

TIA 50 hard questions - great for helping to work through questions and get to what they’re asking for.

QE CAT exams - the only thing I spent money on for studying and one of the most helpful resources for me. In all, I probably ran through around 750 of their questions including 20 right before my exam to help get my mind right. My scores for the CAT exams were roughly 430, 870, 930, 860. Don’t get discouraged if you’re struggling with those. They’re very difficult and tricky. For me, they were significantly harder than the actual exam.

One final thought from me on exam strategy: don’t focus on learning everything. Get to at least 75%. You don’t need to know everything. You don’t even need to know which answer is the right answer. You just need to know 3 answers that are the wrong ones. If you see 4 encryption types on a question and you have no idea what one is but you know the other 3 are wrong, you know the answer.

If you’ve stuck around this long, thanks again. I appreciate all of the advice, support, and study materials from this community. Any recommendations for a next cert to go for would be appreciated.

So, I shopped around in Canada looking for a CISSP training provider and narrowed it down to Training Camp after reading a few Reddit posts. One of my main requirements was getting the "Peace of Mind" exam voucher (with the second shot protection), since I don't come from a core security background and wanted to self-pace my learning. My company is footing the bill, so spending an extra $1,000 wasn't a big deal, and I wasn't in a rush to do an intensive boot camp.

However, during the procurement process, I missed the fine print: Training Camp is essentially just a middleman providing official ISC2 materials.

Basically, they give you 180 days of access to the ISC2 portal, and there is zero leeway or extensions if you don't finish within that window. The official ISC2 training itself is mostly textbook-heavy with a lot of reading and maybe only 10% video lessons. It feels like navigating an interactive ebook where, after every page, you're hit with random, incredibly tough questions on that specific topic. The questions are challenging, but I suppose the silver lining is that it prepares you for the real deal. Along with the e-learning access, I also got the official CISSP ebook and a practice question set.

At this point, I’m at a point of no return—I just have to make the most of what I have.

My friends in info-sec strongly recommended Destination Certification (Destination CISSP), but because they don't bundle the Peace of Mind exam voucher, I pivoted to Training Camp instead.

Has anyone else here used Training Camp’s self-paced option or the official ISC2 online materials? Any tips, study strategies, or words of motivation

I've been lurking here for a month or so. Had my exam scheduled for 2 weeks and the testing center cancelled it due to no AC in the building. Went through a whole process of ISC2 saying I no-showed which was not fun. But they got it all sorted out and I'm happy it's done with.

I've only done cyber security work at my job for about 4 years as kind of an additional duty on the side(and really only touching domains 1 & 2). Have an associate's in cyber security and a handful of certs from CompTIA. Don't think I qualify for full CISSP yet so I'll be an Associate for a few more years getting the experience.

My studying was for about a month - a 2 week bootcamp paid for by my employer and the LearnZApp for 2 weeks after the bootcamp. I actually found the app extremely helpful in preparing for the exam. Like everyone says, "think like a manager", is the way to go for most, but notnall of it.

Thanks to this group, good luck everyone and keep studying!

I cried reading my print out. I can't believe it. Genuinely, this is the only thing I've really studied hard for.

For.info, my background is Solution Design > Architecture > Enterprise Architecture.

Recommend resources:

Quantum Exams

Destination CISSP

LearnZApp (knowledge check, not question prep)

Think Like a Manager videos from Andrew R and Pete Z on YouTube

Gwen Bettwy Videos were handy too.

There were points where I thought I was never going to pass, and some questions were too easy to feel real if that makes sense. Really was a hit and miss and when I was creeping ever closer to 100, I didn't have clue as to how I was doing.

I will say, read the question thoroughly. Read read read!!!

Good luck all.

I'm an IT generalist with many different disciplines under my belt after almost 30 years. Last 8 years has been in InfoSec, so the CISSP was just an inevitable part of my life so finally did it. Waaaaay over studied. As everyone says here, don't obsess with memorizing OSI model, ports, so many things. I found many resources to be helpful and some to be counterproductive--no one has unlimited time and attention so focus on what works for you! Here's my thoughts on what I ran into, most of it after reading so many comments here. Definitely a TLDR post.

Class & Video recommendations:
• ISC2 Official paid class. Did the class but I didn't use any of their resources and the class was mostly anecdotes to explain the practical application of everything covered by CISSP. Personally, I don't need someone to give me examples of security controls from their past, or examples of physical controls for buildings, etc. If you have been around for a long while, you've already seen or heard of most of that. If you are fairly new to IT and InfoSec then maybe that will help you, but you can get that for free on Youtube.
• If you want video training, use whatever you can get access to, but be sure to look up Peter Zerger on Youtube--I would give him a 10/10 rating as he has good example and explanations. Some of it seems dated, but as he mentions it doesn't change that much from one version of the exam to the next.
• Destination Certification videos. I went through their videos and took notes on the Mind Maps sheets (mentioned next) as the videos played, then re-watched the videos when I had time. It is not really that in depth, but oddly it's perfect for this exam. I give this a 9/10 rating, just feels a little light on detail.

Book and study material recommendations
• ISC2 Official Study Guide (OSG) paper book - This is the encyclopedia. I prefer to have a paper book and to take notes and over-study, this book is good for that. In terms of practicality for the test, it is probably a 7/10 because the content is not organized by domain, and there is a LOT of superfluous content. Yes it has everything, but I think you are better off with a resource that is organized like the domain outline.
• ISC2 Office Study Guide PDF book (obtained with my paid class). This is better if you want to search, but its search function is pretty rudimentary so I frequently couldn't find specific key words that I'm pretty sure should have been in there. This IS organized by domain, so it is TOTALLY different than their paper book. I'd rate this as probably 8/10 since it is organized by domains, but the ability to take notes and go back and re-study is limited
• Destination Certification paper book. I am a visual learner and this book is filled with graphical presentations of info and table versions of lists--definitely beneficial for me. And I think I got it for just under $40 on Amazon. I give this a 10/10. Organized by domains and the content 100% corresponds to their "Mind Maps", which I mention next.
• Destination Certification 'Mind Maps'. When I saw these months ago I knew they were my path forward. I printed them out and took very condensed, bullet point type notes on the pages. This was my touchstone and served me well. In terms of applicability toward passing the exam this was a 10/10

Flash cards, sample questions and Apps
• First off, let's categorize things. It seems that people consider flash cards as "content"--if you are doing rote memorization type learning let's call that 'content' (my personal term is trivia). Then there is our exam, which is almost 100% scenario based. These 2 (content and scenario) are very different approaches to learning, and you need to do the first so you can do the latter. Also, the various apps have flashcards and sample questions, here's my views on all of that
• Second off--every resource has a limited number of questions to go through. They all have a LOT of flash cards, but when it comes to sample questions you can quickly chew through their questions and then you'll be doing repeats. So just try and be mindful of your pace of using of the sample questions.
• Destination Certification app. Free, very nicely done. Flashcards (content) I give them 10/10. This maps to their video series and book very well--their stuff is 100% correlated across their platform, kudos for that. RE the sample questions in their app, well, just skip it. They are basically content questions and every 3rd question is either IoT or Cryptocurrency related. It's bizarre. Their book is the best but their questions are the worst. But again, this is free so it does have value. A 7/10
• ISC2 official flash cards. I only ever saw them on a computer online, and they are okay, but you have to be concerned that it's based on their encyclopedia book which has WAY more info than you need for the exam. This might not be the most focused use of your time.

•ISC2 question book that came with the OSG. The OSG on Amazon came with a 600-page or so book of sample questions authored by none other than Mike Chapple. The book has a 100-question quiz corresponding to the 8 CISSP domains, plus 3 or 4 full size sample exams covering all domains. These are all trivia content questions and barely any scenario questions. But this is a quality alternative to a digital app if you want a printed book. I'll give this a 6/10
• Pocket Prep - yah I paid for the premium (under $60 for 3 months) and I felt it is totally worth it. Their app and their online site are very similar and it's really easy to switch back and forth between them and your history and stats sync well. 90% of what you are going to see are trivia content type questions, but the one exception that makes them worth it was the 1st of 3 Mock exams (full size timed test). That one was mostly scenario question and makes it worth the money, in addition to how good the overall platform is. I give this one a 10/10 for sure, great value for what you get.
• Quantum exams, sample tests only. This is gold. This is 11/10. This is expensive 🙂 This is 100% scenario based and is the closest you can get to the real exam. It is very 'process' oriented so you need to memorize about 9 processes so you can have any chance of feeling successful with these tests. You can do quick 10-question quizzes, 100 question untimed, 100 question timed non-CAT, and 100 question timed CAT tests. BE WARNED - I don't know how many questions they have in there but I started to get repeat questions very quickly. By the time I got to my first CAT test I got 32 out of 146 questions that were repeats. That was frustrating, so be mindful of how many of the non-CAT quizzes you go through before you try a CAT test. Personally I'd say do just a couple 10-question quizzes, move to 100 question non-CAT timed test then CAT test. The key value you can get with Quantum--your pacing of your test. You MUST average 75 seconds or less per question to be able to answer 150 questions in 180 minutes. I consistently was at 60 seconds per question so it gave me a comfortable buffer.

Okay, so my final thoughts of what you should not spend your time studying/memorizing for this exam:

• OSI model. Yes be aware of what operates at roughly which layers, but don't obsess over this too much
• TCP port numbers. Yes be aware of what protocols are used in which scenarios
• Those 9 processes I memorized that helped me with Quantum, well that will only tangentially help you on the exam.

Good luck to anyone taking the test soon. You can do it!

Hey guys. I need some advice on how to approach my exam that I will be retaking.

Hey guys. I need some advice on how to approach my exam that I will be retaking. I took my first attempt a couple of months ago and failed it. I’m not super technical as
Most of you here, so I thought I had the right mindset to think like a manager bc I work as a project manager.

Most of my questions were straightforward with one word answer. The answers didn’t have any navigating words for the management approach, like configure, implement, assess, reach out for help and etc. But then I was told that even with one word I need to think like a manager which makes it harder bc it’s just more of the technical question that just requires a knowledge and answer.

I don’t know if make sense, but when I retake my exam. Do I still need to have that mindset of ghink like a manager?

Hi All,
I have been lurking around here for a while now getting tips and tricks. I passed today at 100 questions with about 60 mins left.

Just wanted to say thanks.

I have been a Network Engineer for 10 years then Security Solutions Architect for 5. I have been studying the course material on and off for about 2 years. The OSG then the LearnzApp both of which I found hard going. I then moved to Destination Certification material and everything became clearer to me.

In the last few days I did Pete Zergers Difficult Question walk though. I found the approach quite helpful and the Quantum Exam freebie questions useful to see how hard things could be.

I have to say I never felt ready to take the exam but felt I needed to try it to see what it was like. It was difficult but dooable. I bought the voucher with a re-test just in case. Happy I didn't need it.

I bought a donut to celebrate!

Cheerrs!

Provisionally passed a couple hours ago.

Education:

BS in Mechanical Engineering and finishing up my Master’s in Cybersecurity in the Fall. I also have my A+, Net+, Sec+, CySA+, and AWS SAA.

Experience:

Currently a Security Engineer of 1.75 years after being an ME for 3 years. My realm of expertise is mostly Infrastructure and Software Engineering (DevSecOps).

Study Resources:

• Main body of knowledge resource: Cert Mike’s LinkedIn Learning CISSP Videos
• Concept Mapping: DestCert MindMaps
• Practice Test Sets:
  • Sybex Official Study Guide’s Practice Tests (3/4 exams)
  • Sybex Official Practice Tests (4/4 exams)
• Mindset Videos
  • Kelly Henderson’s Why you will pass the CISSP
  • Andrew’s 50 Hard Exam Questions & CISSP Mindset videos
• Extra help - AI tools for domain and concept drills

Also took the official CISSP bootcamp from ISC2 last Fall, sponsored by my job, but it honestly went over my head because it was near finals of that semester.

In total, I spent about 1.5 months of studying--from the conclusion of my Spring semester up until this past weekend--and completed about ~1000 practice test questions (including the AI-assisted drills).

Objective:

Of course the main objective was to pass, but I also wanted to do it without spending any of my own money. Voucher was company-sponsored; LinkedIn Learning, O'Reilly, and Sybex access was provided by my local library; used various AI platforms up until their free limits; and, of course, YouTube is free.

Testing Experience:

Never experienced adaptive testing before, so the long scenarios to the short, technical recall swings were interesting. Lots of Domain 3 and 6 questions for me. Only tip: read carefully and answer the question. The "think like a manager" mindset doesn't work for every question.

I was above proficient in only IAM. Near proficient in 5 domains and below proficient in the rest. I used the destination certification book to study, destination certification app for practice tests and the 50 hard cissp questions to quiz myself. Also watched the videos on the mindset.

After taking the test, i will say i started rushing after 150 because i had something else to attend very close to the 3 hour mark of the test. This was bad scheduling on my part.

I’ll look over my below proficient domains(domain 2,3,8) and re study the rest of the domains as well. I think I’ll pass in 30 days honestly, the test was hard(i failed) but it’s not discouragingly hard, i felt like i could pick out the right 2 answers for most questions. But i did fail so I’ll go back to the drawing board, updates in 30 days :)

I passed the exam today at 100 questions with 65 minutes left on the clock!

I'll keep this brief for ya'll:

• 13 years in IT, 8 of them doing SecDevOps and Security Tooling.
• I took a SANS CISSP bootcamp at the start of January 2026.
  • Don't recommend unless your employer is paying for it ($$$$$).
  • Material was okay in my opinion. But the big ole Sybex book would suffice for most I think.
• I wouldn't recommend this, but I scheduled my exam 3 months later in March 2026.
• I also don't recomend this, but further procrastination ensued. I didn't start studying until the end of May after a Memorial Day weekend trip. Materials I used:
  • QuantumExams - I can't recommend this enough; the money is worth it. QuantumExams has high-quality CISSP practice questions. The only caveat is that you have to ACTUALLY READ. All of it. The questions, the answers and the explanations.
  • Udemy: Complete CISSP Course, Exam and the Mindset by TIA Training, Andrew Ramdayal - This was a good refresher course. I primarily only made use the CISSP Ultra Hard Questions and Mock Exam sections. They're a great supplement to QuantumExams. But again, ACTUALLY READ. All of it. The questions, the answers and the explanations.
  • The key is putting yourself in the CISSP mindset and understanding what the question is actually asking!
• I focused on the Udemy course for a week while simultaneously doing the 10 question quizzes in QuantumExams. Probably did 3-4 quizzes a day during the weekdays. No study on the weekends. My philosophy is that you should give your brain a break, even if the pressure is high.
• Last Monday, I started making use of the CAT simulation exam in QuantumExams. Only did 6 of them between last Monday and today, scoring 550, 886, 683, 889, 599 and 953.

Now, this might not work for everyone. I think that my OJT and past experience with taking exams at testing centers helped a lot. I'm also not one to cram for months on end so the 1-month crunch was virtually business as usual for me. But for what it's worth, if you're someone like me and are looking in this sub for some reassurance, YOU GOT THIS. Trust yourself, trust the process.

If you're not like me and you need to grind for these things, guess what; YOU GOT THIS. Trust yourself. Trust the process.

I registered for CC exam two years ago however couldn't sit down or cancel the exam due to unforseen circumstances. Now I'm planning to attempt CISSP.

Do I have to pay the AMF for CC even though I was never certified?

Posting here to see if anyone has any experience with this situation.

Hey Reddits,

I passed the exam last Sunday with 117 questions because time ran out. I've got 10 years of experience in this field and I'm currently working as a cybersecurity architecture lead.

Honestly, for me, the exam had more technical questions than mindset ones. There were a lot of long scenarios that I had to read 2-3 times to understand what was going on, but there were also some straightforward questions.

My golden advice: never, ever lose hope. I was 100% sure I was going to fail and had to solve 10 questions in just 1.5 minutes, but I told myself I'd do my best until the end and hoped for a miracle, and it happened!

Finally, I want to thank you all for your support and daily posts that really gave me the power to trust myself.

Can anyone recommend good affordable CISSP course now

Also, if anyone's looking for a study partner or even a small grp to keep each other going & maybe share some costs/resources let me know

Heya! Just started preparing for cissp, need guidance

Are flashcards really useful? if so which is the best one.

Is the time spend on it worth or should I start with practice questions.

Thanks in advance

I’m taking my exam in 2 days. Been studying for 2 weeks using a number of resources. Been using QE for practice questions along with the official study guide and some video walkthroughs of questions.

My first QE CAT exam I got ~430. I reviewed what I got wrong and realized I needed to approach the questions very differently. I’ve taken 3 more since then, one every 3 days. Scores were ~880, ~935, ~860. Every time, I review the questions I missed.

My one concern is that I’m conditioning my brain to approach the questions in a way that works for the QE exams but may not work for the actual exam. At the end of the day, the goal is passing the real exam. Any thoughts?

Also, a lot of the questions I’ve missed on those exams ask about lifecycles and sequential events like SDLC, incident response, risk assessment and management (which is funny because I just passed CRISC 2 weeks ago). A lot of those questions seem like I’m missing information and the explanations almost feel like they’re making assumptions that I wouldn’t make in the context of the question. Any thoughts on last minute prep to help with that? Any suggestions for resources for that would be appreciated as well.

Passed today, so grateful to have that done!

Study materials:

I took the SANS LDR414 CISSP Course. It was good, though I don't think it's a top resource honestly. It costs $10k and don't recommend it unless your job pays for it.

Over the past couple weeks I found a lot of value in the Destination Certification mindmap videos which helped me to visualize relationships between concepts better, and also had great explanations for some of the topics as well.

I used LearnZapp and did about 500 questions and 2 practice tests. I also really appreciated 50 hard CISSP questions from TIA.

Schedule:

I did the SANS week long course at the end of April, then reviewed all the content one more time over the next month or two with the practice questions mixed in. With two kids 2 and under, I had to wake up and do studying before work and then again before

The test:

I had a lot of stress about the test and unfortunately, had a stomach bug over the weekend with some lingering discomfort during the test, but it all worked out. The tips about the manager mindset helped with some but not all the questions. A lot were still technical in nature