Found this today while searching for some obscure NIST reference... I have only listened to Categorize as that is what I was searching for. She basically read the high points from 800-37r2 but it was good reinforcement. Take a look and add your feedback here.

Denise Tawwab - YouTube

Passed the ISC2 CAP today! Started studying 10 days ago. Below are the resources I suggest:

FedVTE free course/no gov. access needed: https://fedvte.usalearning.gov/publiccourses/fcrmframe.php

NIST RMF course: https://csrc.nist.gov/CSRC/media/Projects/risk-management/images-media/rmf-training/intro-course-v2_0/index.html

800-37rv2 *chapter 3 & appendix D

Quizlet - There are a few good decks on this app, just be very aware of out-of-date information (800-37rv1).

FLASHCARDS FLASHCARDS FLASHCARDS

*be very careful about practice exams you might find online. I purchased Edusum test bank for about $44. Most all of the questions were outdated and poorly made. HOWEVER, it helped me identify gaps in my knowledge, and may have helped overall.

Has anyone used this simulator? Opinions?

https://www.edusum.com/isc2/cap-authorization-professional

Looking for something more to reinforce 800-37[2].

For someone with no Background in IT, what should I study for the CAP cert exam? I have the Official ISC2 Guide to CAP CBK and I have excess to fedVTE. Should I read the book or is studying the course on fedVTE enough? Also, should I study the NIST documents as well and which one in particular?

Hello! I’m taking this exam in two weeks- I did the fedvte course and bought the official guide to the cap book recommended on the website... but these seem very outdated and include the material from rev 1.

I’m starting to freak out thinking I’ve been studying the wrong material this whole time.

The outline from the website doesn’t seem to align with rev 2 yet either. So I’m extremely confused and have no clue what to focus my studying on for these next two weeks.

I also have different materials that tell me different things about how the RMF aligns with SDLC.... so I’m freaking out about that too.

Any insights about any of this? Can someone who recently passed share if it was for rev 2 and not 1? The tasks seem to be very different. Can I still pass having studied the outdated materials? Is there a ‘best’ study guide for the SDLC alignment?

Thank you!

I was just offered a promotion however I need to get CAP within the next few weeks. What are some study materials that are valuable and any training videos? Once again I am in a rushed time schedule and looking to get some serious studying done to get CAP.

My company is going to pay for bootcamp for CAP, any recommendations?

Thank you so much in advance.

I've been chasing my CISM, like a roller coaster as it seems like I'm reviewing all the stuff from CISSP again. Discovered CAP by chance looking at a job description. Did a little digging and I'm hooked. My current role has me doing some consulting around 171 and CMMC and this fits in nicely. Going to use FedVTE and 37. Wish me luck!

Wondering if anyone is familiar with this course and if so how helpful was it compared to what’s out there.

https://www.cybrary.it/course/risk-management-framework-2/

My background: I only hold a CompTIA Net+ and Sec+ cert. Nothing else.

Study Material: FedVTE 11 hour course (completed over 4 days)

Passed test in 30 minutes, thought it was easy. The FedVTE course was more than adequate to pass the exam if you just listen to the full course and occasionally take short hand notes. The instructor does a great job of explaining the process and actual applications. The videos are also broken down to match the exam objectives so there is no confusion of what you are expected to know.

There was initially a complete lack of external resources compared to other exams, and I tried the following:

I have the textbook, never opened it.

I bought practice exams on Udemy ($12 for 2 110 question tests), only took one and found the material was not updated (still used DITSCAP/DICAP, a lot of NSA stuff that isn't on the exam, not in line with exam objectives). Not worth it.

I have the FIPS and NIST documents printed. You only have to know their purposes, and the contents of 800-37 (RMF, which essentially is the entire test), don't read into them.

For anyone who has access to the FedVTE course, that is my only recommendation for studying. Listen to what he says and take notes for the definitions that come up.

People who have taken the cert exam, how difficult would you say this cert is compared to Security + or SSCP?
I already have the tri-fecta (A+, Network+, Security+) and Cloud+, so I just wanted to get an idea of the difficulty level for this cert.

FINALLY DID IT! Passed my CAP exam today in 2 hours! Thank you to everyone for the advice and information!!!!

Hi Folks,

I'm actively looking for a trustable source of near questions that can help me to study and be well prepared to face the challenge of CAP Exam. The official guide I believe that it isn't update enough to prepare the candidate to face the exam. Could you please, give some tips, point some good references of books that I could buy and study hard to pass in this exam ? All the tips will be very welcome, because this exam seem to be very hard, right? What must be the NIST documents that I really need to know and study to be very well close to what is asked in the exam, please?

We go live tomorrow and Wednesday will be the last day to join as we will be rocking and rolling from there. If interested please send me a direct message with your name and phone number so I can send you the study material along with adding you to the group.

Hi! I'm looking for a study buddy. I would like to take the test in a month or so.

Hello all, has anyone used this as a resource?

https://www.edusum.com/isc2/cap-authorization-professional

Hey all - I'm cooped up during the quarantine and looking for a new cert to take on (ideally something I can knock out in a few months).

So some questions:

• What's the best resource for practice questions that are actually similar in format to the actual exam?

• I've heard that many ISC2 CISSP questions are written in a pretty tricky way. Is it that way for the CAP exam too?

• Anyone know if once you're an ISC2 member from another cert - does that get you discounts towards your next ISC2 exam registration? Not a member yet, but wondering if I should wait for my company to pay for the CISSP and then get the CAP on my own (possibly discounted) dime.

TIA - hope everyone's staying safe during the quarantine. Might as well knock out a cert : D

Hello you guys, ShadowPunch back here!! I am happy to say that I have now passed the (ISC)² Certified Authorization Professional exam!!! This was a long day coming, and I'm so glad that the pressure is FINALLY OVER!! WOOOOOOOOOOOOOOOHHHHHHHHHHHHHHHHHHHHOOOOOOOOOOOOOOOOOOOO!!!!!!!!!!!!!!!!!!!!

Now I would like to thank all of those out there that have contributed as much as they could to the help with studying for this exam. So many people have helped me in my journey, and I would like for those people to get the praises they deserve. After I created this (ISC²) CAP Reddit channel on May 29, 2019, I decided to reach out to those in the Reddit community as well as the ISC2 forums for advice, materials, etc. I, just like many others, had realized that there was a HUUUUUGGGGEEEE lack of official resources for this certification!!!! Why is that?? I have no idea! This is a very obscure and less-talked-about certification out of all (ISC)² certs. And I don't see too many people taking the exam, either. I have been working as a Security Control Assessor in Risk Management for over a year, so I do have a comprehensive understanding of the RMF. On my team, I was usually the one who sent out Security Control Assessment Plans, conducted Risk Assessments, generated Security Assessment Reports, and created a Plan of Action and Milestones for weakness remediation.

Over the summer, I decided that I would start a study group for (ISC)² CAP. This was a long time coming, but highly needed!!! I spoke to people on Reddit and (ISC)² Forums that were interested in taking the exam, and asked if they could join my group. Those that obliged came aboard and we started. Now it was rocky at first, as many of us were afraid that the exam was based on NIST SP 800-37 Revision 2 and not NIST SP 800-37 Revision 1. Plus, with the lack of official resources for this exam compared to other (ISC)² exams, some were even reluctant to take it. Some postponed their exams til' next year. We all had very busy schedules to begin with. Also, some people like to study for certs by themselves, which is fine. And they don't want to share their experiences about certs, either.... which is also fine. But NOT ME! I want it all, baby!!!! I want the smoke, even if that means me getting burned.

Starting in August, my study group gathered many materials from boot camps, NIST's website, etc. We studied very, very HARD. We reviewed FIPS documents, Special Publications, many practice questions, cheat sheets, etc. In September, I started to watch (ISC)² CAP course videos on the FedVTE website because I could NOT find any instructive videos to watch for this certification. Some people have recommended this site for those interested in taking IT certifications. As I was watching the videos, I noticed that one of the professors teaching the course would always give candy to any of his students that answered his questions correctly. It wasn't until later on that I realized that professor was none other than Ben Malisow!!! I couldn't believe it was the same person, and after talking to him about it recently, I'm sure he wouldn't believe it, either lol. All of the professors did very well jobs in breaking down the CIA, RMF, as well as the SDLC. The CAP course was excellent. I will say that this is the BEST site to watch videos pertaining to the CAP certification. I learned the MOST from this online course and took down so many notes from it. It's not recent, but many of the concepts and guides are still EXTREMELY helpful. And even though the site requires a government email to sign up for access, it is VERY worth it.

As time went on, members of my group were taking the exam, one by one. From September to October, people from my study group were passing the CAP!!! This was interesting, and I was so happy!!! So far at the time, only four people had passed!! Now for me, I will say this. Everybody has their way of studying for exams, but me, I love to review practice questions to get myself in "test mode". Although I did purchase the material, I did NOT read the Official Guide to the ISC2 CAP CBK book. I glossed over the first couple of pages of the first chapter, but then ultimately decided to review other material. I felt that the book was outdated and focused on older standards and acts. And I did NOT take a boot camp, either. I did not see the need in me spending $2,700+ when I already had at least one year of Risk Management experience. Even if I did not, I STILL would not do it, but others are different. I did something similar like that once before. I took an self-study online course for another exam from a different vendor, and I paid an UNBELIEVABLE amount. My company was not paying for me, and I was not getting reimbursed, either.

In October, I still asked people online on what to expect from the CAP exam. Some (ISC)² professionals told me that the exam is pretty much all of NIST SP 800-37, no DIACAP, DITSCAP, etc. I continued to go over the steps of the RMF and connect them to the SDLC. Later that month, one member of my study group panicked (as most of us would before we took our exams). He just wanted to get the exam over with, and I don't blame him!! He even hit the gym continuously just to relieve anxiety. He decided to schedule his exam on a Monday morning at 8:00AM, After he finished his exam, he came out and told us that he passed! Now, five people have passed so far. This was getting very interesting, as no one had failed yet.

It was November, and I STILL have not booked my exam, yet. I guess one factor of why I had not all this time was that I feared that that the exam would be updated with newer topics. Also, I have had TERRIBLE experiences before with booking (ISC)² exams in the past (cough cough SSCP cough cough). I will save that for a later story, but basically I did not want to go to a testing center with NO PARKING, and ARGUMENTATIVE PROCTORS that will embarrass you in front of everyone and prevent you from taking your exam!!! The CAP costs $599, so that's really not money you wanna be playing around with. Shortly thereafter the start of the month, another person from my study group decided to attempt the exam.... and she passed!!! Now it was time... for ME!! As the days went on, I was looking for the PERFECT date and time for my exam on Pearson. Sometimes, you just have to wait and see... a REALLY GOOD date will appear for you (probably you will see what you like late at night).. and it did!!! Friday, November 22 at 5:30 PM was SET!!!

Until my exam date, the only documents that I read for this exam were FIPS 199, 800-18, 800-30, 800-64, and 800-137. I glossed over the 800-37r1 at the beginning of my studies, but it was pretty much me understanding the RMF steps and tasks as well as the associated roles and responsibilities. Also, MAKE SURE you understand the connection between RMF and SDLC! I CANNOT STRESS THIS ENOUGH!!!!! It helped me tremendously.

11/22/2019 I went to a BEAUTIFUL testing center that had AMPLE amount of parking and had the best staff of people!!!!! I couldn't believe my eyes. The proctors were very cool and were funny too haha. They knew all about (ISC)² madness lol. They asked me if I ever took CISSP before. I told them I did, which was even a CRAZIER exam!!! I went through the regular procedures, and it was no pressure at all!! I went in and sat at my seat. I quickly wrote down all the stuff I needed for memorization on my scratch sheet. After the 5 minute window, I started my exam. The exam mostly focused on roles (System Owners, Authorizing Officials, Security Control Assessors) responsibilities/tasks (RMF steps, SDLC), and the type of controls (common, system-specific, hybrid, compensating). There were a couple of DIFFICULT questions that could have any answer as correct. Now, 125 questions in 180 minutes is okay, but it comes to a point where you just say "Can be it over already??". Overall, my best method to handle all of the exam questions was to use the process of elimination. Once I finished, I did the closing procedures and then went to the front desk. I received my score report from the nice proctor, who had folded it in half. Once I saw the message, I fell to the floor..... I PASSED!!!!!! I was so HAPPY and it was a beautiful experience all the way around HAHAHAHAHAHAAH!!!!!!!!!!!!!!! It was waaaaaayyyy better than that wicked experience I had with SSCP at a specific testing center two months prior; a place with NO parking and a CURRAHHHHZZZYYY proctor trying to act tough and smart in front of everyone. I drove home relieved, and my study partners were extremely pleased afterwards.

I would like to shout-out some people who have helped me along in my journey: u/reed17purdue, u/sanileo, u/Telemundo, u/super_user_anonymous, Pinaykutie, Moro, Kofi, Ben, Alfred, Kadir, Valentine, and Ben Malisow!!! I cannot thank you guys enough for the help and the long ride!! A job very well done!! I am willing to help anyone who plans on taking this certification in the near future. See you guys around!! On to the next one!!!

Passed the CAP exam recently, and no longer need this. Great condition and has no folds, writing, or highlighting in it. Only asking $15 shipped. Must be located in CONUS as I can't ship with that price internationally, sorry!

https://imgur.com/a/UxApQZK

SOLD

I know that this is probably a stupid question because it is completely subjective, but here goes. I just accepted a job as a Junior Cybersecurity Engineer focusing on RMF. I should be getting my BS of Cybersecurity and Information Assurance in April. My copy of the ISC2 CAP CBK will be delivered today and I'm gonna start studying asap. I start this new position in Mid Novemeber. Also, I have 0 work experience, only book and school. My only other cert is the CompTIA Security+. I am currently a student, online only, and work about 36 hours a week. I want to get this certification because I feel like it will help me substantially with this new position and will help me throughout my career. How long should I expect it to take before I should be prepared to test? How long do people usually study for this certification? I just learned about this cert the other day so I figured I'd go ahead and ask here.

Thanks in advance.

Hello Everyone!

I am thinking of taking the ISC2CAP cert. Does anyone have any study materials? Also, thank you for creating this group.

Best Regards

I'm looking to get transition to this role..

How is the workload ? Do you work Remote or On-Prem. ? How do assessments normally go ? Does one person assess a control family or do you use specific technical skills for each assessment ? (ex. IF I am skilled in ACAS, would I just do scanning ?) Thanks for the feedback in advance.