Internal Monologue

I want to finish up my post related to my journey to the CISSP certification.  As mentioned in my prior post, I sort of put the cart before the horse per say and provided feedback about the exam without any details about what I did leading up to the exam.

First and foremost, I have provided a list of resources (books, websites, authors, training programs) that I either used or referenced while preparing for the exam.

I choose to take the SANS Management (MGT414+R) course during the SANS Network Security conference in Las Vegas in September 2010.  The course is six days in length and has extended hours both early in the morning and into the evening.  It is an intense course with tons of material, albeit focused on the core domains related to the CISSP.  The course also prepares you for the GIAC (Global Information Assurance Certification) – GISP (GIAC, Information Security Professional) certification.  This certification is also a 250-question computer proctored exam.   I will not detail this exam in this post.

My SANS course was instructed by Eric Conrad whom has also published two books related to passing the CISSP exam.

Conrad’s CISSP study guide is an abridged study guide.  I would say that it offers enough detail about any one CISSP related topic; however, do not expect the guide to offer in-depth knowledge about any one subject.  The goal is to give you only  and exactly what you need to pass the exam.  I say that with a caveat, the true test of the exam is understanding the topics covered within the domains; however, if you are unfamiliar with how to apply that knowledge, the exam will be difficult.  If you are unfamiliar with a topic or specific concept, you will need to get in-depth information elsewhere.  If you are a seasoned InfoSec professional and are preparing for the exam, you may not need in-depth knowledge and this book may be perfect for you.  The key is to understand the concept and know how to apply it.  How you get to that point will be different for each person.

Conrad also recently published, “The 11^th Hour CISSP Study Guide”.  This book was released after I had studied for the exam and I didn’t have an opportunity to review it.

I do not believe anything can replace the, “Official ISC2 Study Guide” or the well respected Shon Harris, “All-In-One CISSP Study Guide” which offers a great deal of detail and explanation to any CISSP topic.  These books are great for both ongoing reference and detailed study guide.  In my opinion, these books may be overwhelming if you try to read and learn about every concept in the detail offered by these books.  Frankly, I do not believe you need to learn each concept to the level offered in these books to pass the exam.

The SANS course was worth the investment, it offered an amazing amount of information both within the course and as a networking and education event.  They packed each day with opportunities for education from 7am to 10pm.  The conference was a fire hose of information, be prepared if you attend a SANS event!  I have attended a few SANS training events and by far they are the foremost authority on Information Security training.  I highly recommend SANS education and training events.

The SANS coursework is excellent and offers very good detail and closely matches the knowledge required to pass the exam.  I used the books from the course to review many of the concepts.  The course is broken down based on the 10 domains, at the conclusion of each domain, there is a quiz to test your knowledge.

Following the course, SANS offers a recording of the same class via the SANS portal.  The class recording I received was a recording of a class instructed by Dr. Eric Cole that occurred a few weeks prior in San Diego.  I loaded the MP3s on my cell phone and listened to them during my commute to/from work.  The class recordings were more helpful than I expected.  Having a different instructor explain the same concepts in a different manner cleared up confusion and also reinforced my knowledge on a number of topics.  If you decide to take the SANS course, I highly recommend the class recordings.  You can also follow along via the course booklets as well to reference notes you may have taken during class.

As far as practice tests, Syngress, the publisher of Eric Conrad’s book offers two online exams.  The practice questions were helpful and recommended.  I also used the practice exams provided during the SANS course.

I used Cccure.org, which was highly recommended by a number of sources.  I paid for six months of access to the site, you can gain partial access to the site for free; however, I truly wanted to immerse myself into long test taking attempts.  In all, I like the environment provided by CCcure, the test environment and feedback provided with each question is very useful.  I do have to say that many of the questions were dated and not relevant to the current exams.  In all, be careful how much effort you place on learning some of the question offered by this site.  It is helpful; however, you will see questions that are no longer relevant to the exam as it has changed over the past few years.

Ok, to summarize how I prepared for the exam.  I highly recommend the SANS course, it was phenomenal.    I scheduled the exam six weeks after the course.  The weeks following the course, I created a small study guide from the SANS coursework.  I took the Syngress and CCcure exams and began to figure out what domains I needed to spend additional time studying.  I used the Conrad book and if that didn’t do the trick, I pulled out the Shon Harris and ISC2 study guide for additional detail.  The two weeks prior to the exam, I spent a good deal of time taking practice tests and refining my own study guide of which I hope to offer here soon for download.  I want to update some of the information and make corrections prior to providing it.  I made every attempt to score at lest an 80% on most of my practice exams, this was a key number offered during the SANS course.

The night before the exam I reviewed my homegrown study guide a few times and relaxed.  It worked!  I’ll post the study guide soon, good luck in your CISSP endeavor!