ISC2 doesn’t like to share much about their exam questions. So, here’s a candid description of what you can expect:

Hi abi,

ISC2 doesn’t like to share much about their exam questions. So, here’s a candid description of what you can expect:

The questions seem straightforward until you read the answer options. You either find multiple correct answers. Or maybe none of them are correct.

You end up answering questions about exactly the topics you hoped to avoid. The CAT (Computer Adaptive Test) algorithm will quickly identify where you might have weaknesses and prioritize questions about those topics.

Best part is that they publish practice questions, which create a false sense of confidence. Lots of people have answered correctly hundreds (or thousands!) of practice questions and still felt completely lost at the real exam.

All that said, we have some insider information for you. One of us, John Berti, has been on the exam committee. We want you to pass on your first attempt, so we want you to have the greatest advantage possible.

We can’t share real exam questions (ethics!), but we can share techniques that are well proven to make it much easier to find the BEST answer to each question on the CISSP exam:

1. Assume that each question tests your abilities as a manager. That’s not the case 100% of the time, but assume it is. Think in terms of, “Which of these answers best helps the organization achieve its goals and objectives?” For example, if one answer seems like the correct one because you know it solves some technical issue, but another answer speaks to ensuring controls are cost effective and aligned with organization goals, the second answer is likely the one they’re looking for. You need to think like a CEO
2. Consider which answer encompasses the others. Not every question works this way, but fairly often at least one answer encompasses multiple true answers. Take the question below as an example.

What determines the labeling of assets?

• A. Regulatory requirements
• B. Contractual requirements
• C. The organization’s security policy
• D. The impact to the organization if the asset is exposed

First, let’s understand what labeling means: It is simply noting the classification of an asset on the asset. Put another way, this question is asking what determines an asset’s classification? Answers A, B, C & D are all true answers —- these are all things that can determine an asset’s classification. The BEST answer is C, as the organization’s security policy will define classification levels based on regulatory & contractual requirements, and the impact to the organization if the asset is exposed. Answer C encompasses the other answers.

We created a video about the management-level mindset, which you need to use throughout your studies and especially at the CISSP exam.

CISSP is not a normal security certification. Whether you learn about cryptography, evaluation criteria, or biometric door locks, make sure you understand the management-level considerations.

That’s admittedly very difficult to do if your sources don’t highlight the management-level thinking. But that’s what you need to learn to pass the exam.

If you’d like to make it as easy as possible for yourself, that’s exactly what the Destination Certification CISSP MasterClass is about. Sure, you learn the technical stuff you need to know to pass the exam. But you also become a great security leader, which is what the exam tests you on.

See the details here and reach out to us if you have any questions.

“I had a great experience. I can honestly say you were the best teachers I have had in my entire educational career. I passed only because I attended this training. I am not even happy I passed, I am happy I got a chance to learn so much from you two.“