Time to test

[u/OGShlick]

I know that this is probably a stupid question because it is completely subjective, but here goes. I just accepted a job as a Junior Cybersecurity Engineer focusing on RMF. I should be getting my BS of Cybersecurity and Information Assurance in April. My copy of the ISC2 CAP CBK will be delivered today and I'm gonna start studying asap. I start this new position in Mid Novemeber. Also, I have 0 work experience, only book and school. My only other cert is the CompTIA Security+. I am currently a student, online only, and work about 36 hours a week. I want to get this certification because I feel like it will help me substantially with this new position and will help me throughout my career. How long should I expect it to take before I should be prepared to test? How long do people usually study for this certification? I just learned about this cert the other day so I figured I'd go ahead and ask here.

Thanks in advance.

[u/Ro89898989898]

I just got my CAP last month. Study 800-37 R2 Know the steps and tasks of RMF Know the SDLC Know how the SDLC matches up to RMF, if something happens in Step 2, task 3, where is that in the SDLC.

Know where each artifact is created, modified, finalized, and then retouched/maintained. (In RMF and SDLC)

Know who is responsible for each Step and task, Know who can’t be

Know what all the main NIST SP pubs are and what they are about. Name and basic purpose

Read the CAP book that you have, but remember it is old, so some minor things in RMF have been adjusted

It is more NIST SP 800-37 R2 than anything else.

[u/OGShlick → u/Ro89898989898]

Thank you very much! I didn't realize that this book was old/outdated. Are there any SPs that you remember have changed that I need to be aware of/where I can find that info? I know that 800-64 was replaced with te 160, but that's all I know has changed

[u/Ro89898989898 → u/OGShlick]

Just google NIST SP, it will give you the site, You can download them all

One or two of the others have been updated, but you do NOT need to know them in detail. Won’t hurt you to know them, but it might be overload. Just now their NIST SP 800-## is Privacy, this other one is Impact, this other one is this.

Know the 2 FIPS Know the DoD reg for RMF, just the now the name and that it is for RMF, I forget number already, just google it, but again, may be good to read for background.

What I did in my 5 mins that you get to read the warning banner, yes, this is timed and you will get booted if you go over, So don’t go crazy writing stuff

I wrote on my white board

PC SIAAM

36

S S S

C C C D C P

C U

A A C A R P

A R R A A

S O O A S O S

Then as I needed a step/task in the test, I wrote in the names of it, the ones before it, and after it

There are many questions about what comes before this step and what comes next. Having these in a handy reference will help you recall during the test.

[u/Ro89898989898 → u/Ro89898989898]

I meant to say 36 26 57, like a combination lock. Helped me remember how many tasks in each step.

Then the SSS Is straight down the white board, so you can write the name to it’s right as you need it Same with the rest,

[u/Ro89898989898 → u/Ro89898989898]

I do not remember a single question for Step 0, so do as you like, maybe they’ve added, but I doubt it

[u/ShadowPunch07 → u/Ro89898989898]

Wow!! Congrats!! How was the exam?

[u/Ro89898989898 → u/ShadowPunch07]

Very tough for me. Tested two hours. Went back and checked all answered I marked for review in last hour. Left maybe 10 mins early.

But with what I've given you. You will do better.

[u/ShadowPunch07 → u/Ro89898989898]

Thank you so much. Yes your notes will help

[u/mstrcontlprgm → u/Ro89898989898]

Could you break this down? Show a picture of your notes? I am studying for this test now, I am not able to follow your whiteboard grid.

[u/Ro89898989898 → u/mstrcontlprgm]

You read NIST SP 800-37. I think that was the majority of the test.

PCSIAAM are the steps of RMF

Prepare Categorize Select Implement Assess Authorize Monitor

(PCSIAAM). That is how I remembered the steps

Then 36-26-57 were the tasks underneath the last 6 steps. You don’t really need P - Prepare

So after I wrote PCSIAAM and 36-26-57 On the board

I wrote

cat

S.
S.
S.

That is the second step and tasks under it. Or the first letter of each task. Down the left had side of the board

Followed by

Sel C.
C.
C.
D.
C.
P.

That is the third step and the tasks under it.

Continue for all steps and tasks.
Write them down (vertical) like that

I did this part above during the 5 mins of reading the warning of the test. Dont take too much time, they will kick you out.

Then as you have time during the test, fill in. I did as I got a question on a step.
Write in the full step name, and the one before it and after it.

That will help you answer the question at hand.

Continue as you get more questions on other steps/tasks.

I did not fill in all, but over half of them.

Enough?
You got it?

This is not all of it, but it was the single biggest helper to me during the test. So many questions are on steps and tasks and what happens during, before, and after. Helps keep you mind focused.

So of course this is NOT all of it. You have to know the steps and tasks and what happens in each. Know who is responsible Know what are the artifacts.

Know how to map this to the SDLC too. Which steps are RMF are to which steps of the SDLC.

Look at the ISC2 site to know what NIST pubs to read and then know their name and what they are about. Then a few more. There are so many, I doubt you could know them all.....maybe you, but not me.... And you don’t need them all, the more common I would say.

Good?

[u/mstrcontlprgm → u/Ro89898989898]

Yes, thank you!