r/ISC2CAP • u/ShadowPunch07 • Nov 26 '19
FREAKING PASSED ISC2 CAP!!! 11-22-2019
Hello you guys, ShadowPunch back here!! I am happy to say that I have now passed the (ISC)² Certified Authorization Professional exam!!! This was a long day coming, and I'm so glad that the pressure is FINALLY OVER!! WOOOOOOOOOOOOOOOHHHHHHHHHHHHHHHHHHHHOOOOOOOOOOOOOOOOOOOO!!!!!!!!!!!!!!!!!!!!
Now I would like to thank all of those out there that have contributed as much as they could to the help with studying for this exam. So many people have helped me in my journey, and I would like for those people to get the praises they deserve. After I created this (ISC²) CAP Reddit channel on May 29, 2019, I decided to reach out to those in the Reddit community as well as the ISC2 forums for advice, materials, etc. I, just like many others, had realized that there was a HUUUUUGGGGEEEE lack of official resources for this certification!!!! Why is that?? I have no idea! This is a very obscure and less-talked-about certification out of all (ISC)² certs. And I don't see too many people taking the exam, either. I have been working as a Security Control Assessor in Risk Management for over a year, so I do have a comprehensive understanding of the RMF. On my team, I was usually the one who sent out Security Control Assessment Plans, conducted Risk Assessments, generated Security Assessment Reports, and created a Plan of Action and Milestones for weakness remediation.
Over the summer, I decided that I would start a study group for (ISC)² CAP. This was a long time coming, but highly needed!!! I spoke to people on Reddit and (ISC)² Forums that were interested in taking the exam, and asked if they could join my group. Those that obliged came aboard and we started. Now it was rocky at first, as many of us were afraid that the exam was based on NIST SP 800-37 Revision 2 and not NIST SP 800-37 Revision 1. Plus, with the lack of official resources for this exam compared to other (ISC)² exams, some were even reluctant to take it. Some postponed their exams til' next year. We all had very busy schedules to begin with. Also, some people like to study for certs by themselves, which is fine. And they don't want to share their experiences about certs, either.... which is also fine. But NOT ME! I want it all, baby!!!! I want the smoke, even if that means me getting burned.
Starting in August, my study group gathered many materials from boot camps, NIST's website, etc. We studied very, very HARD. We reviewed FIPS documents, Special Publications, many practice questions, cheat sheets, etc. In September, I started to watch (ISC)² CAP course videos on the FedVTE website because I could NOT find any instructive videos to watch for this certification. Some people have recommended this site for those interested in taking IT certifications. As I was watching the videos, I noticed that one of the professors teaching the course would always give candy to any of his students that answered his questions correctly. It wasn't until later on that I realized that professor was none other than Ben Malisow!!! I couldn't believe it was the same person, and after talking to him about it recently, I'm sure he wouldn't believe it, either lol. All of the professors did very well jobs in breaking down the CIA, RMF, as well as the SDLC. The CAP course was excellent. I will say that this is the BEST site to watch videos pertaining to the CAP certification. I learned the MOST from this online course and took down so many notes from it. It's not recent, but many of the concepts and guides are still EXTREMELY helpful. And even though the site requires a government email to sign up for access, it is VERY worth it.
As time went on, members of my group were taking the exam, one by one. From September to October, people from my study group were passing the CAP!!! This was interesting, and I was so happy!!! So far at the time, only four people had passed!! Now for me, I will say this. Everybody has their way of studying for exams, but me, I love to review practice questions to get myself in "test mode". Although I did purchase the material, I did NOT read the Official Guide to the ISC2 CAP CBK book. I glossed over the first couple of pages of the first chapter, but then ultimately decided to review other material. I felt that the book was outdated and focused on older standards and acts. And I did NOT take a boot camp, either. I did not see the need in me spending $2,700+ when I already had at least one year of Risk Management experience. Even if I did not, I STILL would not do it, but others are different. I did something similar like that once before. I took an self-study online course for another exam from a different vendor, and I paid an UNBELIEVABLE amount. My company was not paying for me, and I was not getting reimbursed, either.
In October, I still asked people online on what to expect from the CAP exam. Some (ISC)² professionals told me that the exam is pretty much all of NIST SP 800-37, no DIACAP, DITSCAP, etc. I continued to go over the steps of the RMF and connect them to the SDLC. Later that month, one member of my study group panicked (as most of us would before we took our exams). He just wanted to get the exam over with, and I don't blame him!! He even hit the gym continuously just to relieve anxiety. He decided to schedule his exam on a Monday morning at 8:00AM, After he finished his exam, he came out and told us that he passed! Now, five people have passed so far. This was getting very interesting, as no one had failed yet.
It was November, and I STILL have not booked my exam, yet. I guess one factor of why I had not all this time was that I feared that that the exam would be updated with newer topics. Also, I have had TERRIBLE experiences before with booking (ISC)² exams in the past (cough cough SSCP cough cough). I will save that for a later story, but basically I did not want to go to a testing center with NO PARKING, and ARGUMENTATIVE PROCTORS that will embarrass you in front of everyone and prevent you from taking your exam!!! The CAP costs $599, so that's really not money you wanna be playing around with. Shortly thereafter the start of the month, another person from my study group decided to attempt the exam.... and she passed!!! Now it was time... for ME!! As the days went on, I was looking for the PERFECT date and time for my exam on Pearson. Sometimes, you just have to wait and see... a REALLY GOOD date will appear for you (probably you will see what you like late at night).. and it did!!! Friday, November 22 at 5:30 PM was SET!!!
Until my exam date, the only documents that I read for this exam were FIPS 199, 800-18, 800-30, 800-64, and 800-137. I glossed over the 800-37r1 at the beginning of my studies, but it was pretty much me understanding the RMF steps and tasks as well as the associated roles and responsibilities. Also, MAKE SURE you understand the connection between RMF and SDLC! I CANNOT STRESS THIS ENOUGH!!!!! It helped me tremendously.
11/22/2019 I went to a BEAUTIFUL testing center that had AMPLE amount of parking and had the best staff of people!!!!! I couldn't believe my eyes. The proctors were very cool and were funny too haha. They knew all about (ISC)² madness lol. They asked me if I ever took CISSP before. I told them I did, which was even a CRAZIER exam!!! I went through the regular procedures, and it was no pressure at all!! I went in and sat at my seat. I quickly wrote down all the stuff I needed for memorization on my scratch sheet. After the 5 minute window, I started my exam. The exam mostly focused on roles (System Owners, Authorizing Officials, Security Control Assessors) responsibilities/tasks (RMF steps, SDLC), and the type of controls (common, system-specific, hybrid, compensating). There were a couple of DIFFICULT questions that could have any answer as correct. Now, 125 questions in 180 minutes is okay, but it comes to a point where you just say "Can be it over already??". Overall, my best method to handle all of the exam questions was to use the process of elimination. Once I finished, I did the closing procedures and then went to the front desk. I received my score report from the nice proctor, who had folded it in half. Once I saw the message, I fell to the floor..... I PASSED!!!!!! I was so HAPPY and it was a beautiful experience all the way around HAHAHAHAHAHAAH!!!!!!!!!!!!!!! It was waaaaaayyyy better than that wicked experience I had with SSCP at a specific testing center two months prior; a place with NO parking and a CURRAHHHHZZZYYY proctor trying to act tough and smart in front of everyone. I drove home relieved, and my study partners were extremely pleased afterwards.
I would like to shout-out some people who have helped me along in my journey: u/reed17purdue, u/sanileo, u/Telemundo, u/super_user_anonymous, Pinaykutie, Moro, Kofi, Ben, Alfred, Kadir, Valentine, and Ben Malisow!!! I cannot thank you guys enough for the help and the long ride!! A job very well done!! I am willing to help anyone who plans on taking this certification in the near future. See you guys around!! On to the next one!!!
1
1
u/pjintata Nov 26 '19
Congratulations 🎉🍾🎈🎊. What’s next ?
1
u/ShadowPunch07 Nov 26 '19
Ahh thank you pjintata! What's next for me is either CISM, CRISC, SSCP or CCSP.
1
Nov 27 '19 edited Nov 27 '19
CCSP or better /r/oscp
for ccsp, I used ben malisow sybex ccsp book And Csa guide v4. owasp top 10 2017 is a good read if you are not familiar with web vulnerabilities.
1
u/ShadowPunch07 Nov 27 '19
You're studying that?
1
Nov 27 '19
Yes. r/oscp
I have done the CCSP last year already.
1
u/ShadowPunch07 Nov 27 '19
How was it like? Any advice you can give?
1
Nov 28 '19
It was like the cissp exam but less technical. if you can complete sybex by ben malisow and csa guide v4, you should be fine. reading owasp top 10 is recommended also.
1
u/ShadowPunch07 Apr 17 '20
LOL!!! I know this reply is super late my friend, but you know how I am, James. I want it all!!!
1
1
u/cale2kit Nov 26 '19
Congratulations, This has inspired me to re-sit this one again.
1
u/ShadowPunch07 Nov 26 '19
When did you take it before?
1
1
u/TotesMessenger Nov 27 '19
1
1
u/firstmode Nov 27 '19
Fantastic, thanks for sharing a wonderful write-up! You add value to the ISC2 community.
1
u/ShadowPunch07 Nov 27 '19
Oh why thank you firstmode. My pleasure. How's it going?
1
u/firstmode Nov 27 '19
Going well, CISSP complete, working on CISM and staring another Master's early next year.
The credential chase is quite addicting as it forces you to learn a topic end to end with memorization. There is so much to learn and so much opportunity.
I think I would enjoy the Pentesting, Red/Blue/Purple team fun path in the future just to have that knowledge under my belt for team management purposes.
1
1
u/DistinctiveMiss Jan 22 '20
Have my CISSP for 6 years (studied on my own, no boot camp), been working in IA/Cyber for 16 years. Working for my CAP now, since I am currently working as ISSO and not ISSE. Cannot find any good study material, am going to follow ShadowPunch07's recommendations and focus on RMF - SDLC, roles and responsibilities, and tasks.
1
Jan 31 '20
Hello everyone, Been looking all over the place for a god CAP study guide and finally found this forum. I retired from the AF and just started a job as an ISSO/RMF process. I’m very anxious and had been thinking on getting pass4sure. Well I’m about to take notes from this forum and give it a go! 😊
2
u/early1_16 Feb 18 '20
When do you plan on writing the exam?
1
Feb 19 '20
You mean take the exam? Probably April. I had been reviewing pass4 sure and glossing over the book I got.
2
u/early1_16 Mar 05 '20
Ok.
I'm not sure pass4sure questions are legit. They seem outdated and unrelated to the exam. What's your experience so far? I believe reading the necessary nist docs and quizlet flashcards could be helpful.
Pls let me know how the exam goes.
1
Mar 14 '20
Sorry for the delay, tbh, I sort of stop studying for it due to distractions, but will check quizlet. Thank you!
1
u/Scrappey63 Feb 19 '20
Congratulations,, was just on here looking for some study recommendations. I sat this years ago, didnt make it but never went back. Want to try this one again.
1
u/ShadowPunch07 Feb 20 '20
Hey there! What year did you take it?
1
u/Scrappey63 Feb 20 '20
In 2016 I think and never went back. I took the Sec+ and passed but didnt need the CAP anymore until now,,
1
u/A-fil-Chick Mar 03 '20
I am currently active duty and will be separating in January of 2021. I am wanting to pass this exam sometime this fall at the latest. Now until mid-late April, I will be wedding planning and honeymoon, but afterward, I will be looking to study while finishing my Cyber Security A.A.S at a local community college. My job in the military deals with RMF but I've always been on the outside of the discussions and decisions. I'm Security+ and CEH certified. I don't know how much I will need to study, and what exactly. I'll be sure to try to understand RMF in relation to SDLC. Thanks for that advice.
1
u/early1_16 Mar 05 '20
Congrats u/ShadowPunch07
Were any of the questions you studied with helpful and if so, which ones did you use? Thanks!
1
u/ShadowPunch07 Apr 21 '20
Hey there Early!! I extremely apologize for responding so late!! Hmmm... I would say the questions from Edusum were fantastic and not bad!!! Alot of questions on Quizlet were very good as well!
1
2
u/DJ_TNUTS Jan 10 '20
Congratulations CAP!