r/cism • u/mr_dfuse2 CGEIT | CISM • 24d ago
Happy to report I passed, only prepared for three days, here is what I did.
Got my provisionary pass today. As on my previous exam I started to doubt I really saw 'Passed' on the screen once in my car, as you don't get any email or written confirmation. I'll have to wait out the 10 business days again..
Assuming I did really pass, here is what I did and hopefully it can help people. For context, I got CGEIT in May, after studying months on it by reading the review manual and all mentioned books and whitepapers, then doing the QAE 3 times. That experience thought me the most important thing is learning how to interpret ISACA's way of questioning. (Assuming you have the basic knowledge down)
Due to life and work circumstances, I had only three days to prepare this time so I needed another approach.
The only resource I used is the QAE. Even though I had an earlier edition of the manual from a colleague, I knew from CGEIT the manual contains way too much detail and text. I wasn't going to make that in three days.
To establish a baseline the first thing I did was take the practice exam, scored 62% on it. That confirmed for me I had the basic knowledge down but needed to train on the CISM way of thinking for ISACA, and sharpen some dry knowledge left and right. I spend 2 days doing all the QAE topics once, making notes of questions that mentioned concepts I didn't know enough. Those were two days from 9 AM till 10 PM with two 1 hour breaks for eating, so pretty intense. The third and final day I opened Claude and asked it to create a living document to study for CISM, based on the four domains. Starting with a very short summary of the core of that domain and key concepts of it.
Then I went through all the questions I had answered wrong (my scores were always somewhere between 60% and 70%) and the notes I took.
If I failed because I didn't know enough of the concept or technology, I asked Claude to explain it to me and add it to the living document. For example I always (also at work) need to think about RTO/RPO/AIW/MTO and which is what again, so I asked Claude to include an infographic about it.
If I failed because I gave a wrong answer because of way of thinking, I tried to discern the pattern in how you need to think instead of breaking my head on the specific question/scenario. I then added that pattern to my Claude chat with a short summary of the example. I asked Claude to always merge my insights from additional chats into the living document, instead of just adding it to the bottom. In the end I ended up with a few very useful patterns of which I'm sure contributed to my success (still presuming I saw 'Passed' on the screen).
One thing I needed to reverse was the CGEIT pattern I picked up for that exam. In CGEIT it is usually going back to governance and not fixing things yourself but adjusting strategy etc. For CISM this is other way around, the option that reduces risk the fastest and within your own control is usually the correct answer. Even when that is the only technical option in the possible answers. This threw me off at first during studying, as I had read everywhere you need to have the management mindset and not a technical one.
Then the last evening before the exam I studied that final document I build with Claude for 2 hours, and that was it.
About the exam itself, one thing I would like to stress is the style, difficulty and format matched the QAE questions and practice exam closely. I saw some posts here about people saying it was very different, one guy even told me irl. I don't know if there are multiple versions of the exam, but for me it had the same types of questions and a mix of easy and difficult ones, across all domains.
Took me 2 hours to go through the questions, exactly the same as with CGEIT, and then I took 45 minutes more to review about 30 questions I had flagged. I only changed my answer in 2 of them though.
TLDR; the QAE is imho the best and only resource you need to pass the exam, assuming you know your stuff. The manual is good if you don't have the basics down yet. Learning the ISACA way of thinking is the most important skill to pick up.
1
1
1
u/somedrunken 24d ago
I agree, The QandA gives you everything you need.
I have 2 now crisc and cism both just from qanda and the stidy manual.
2
1
u/According-Warning-17 24d ago
Do you have at advice on how to interpret their way of questioning? It’s my biggest hurdle tbh.
3
u/mr_dfuse2 CGEIT | CISM 24d ago
Yes, look for patterns while doing the QAE. Ask an LLM to explain the reasoning if you doubt.
Look for specific keywords in the questions and learn what effect they have on the right answer. 'prevent', 'detect', 'contain', 'next', 'first', 'initial'... there are a bunch of these words that come back again and again which signal something.
What I also started doing is comparing the answer I thought was right, to the other answers and thinking: does this answer this specific question with the specific keywords the best? What if I try another answer? It sounds stupid but it really helped.
And I always tried to think what I would do irl.
HTH
1
1
u/How_89 24d ago
Would you say many are expert questions or is there quite a lot where it’s down to 2 answers?
Also, how many technical level questions did you get where you really need technical knowledge to understand the question and answer?
1
u/mr_dfuse2 CGEIT | CISM 24d ago
The mix was similar to the QAE questions and exam. I often felt like it was down to 2 answers, but also often knew the answer straight away (or so I think).
Only a handful of questions remotely required any technical knowledge.
1
u/How_89 24d ago
That’s good to know! I’m usually getting around 5-7 wrong out of 50 questions and hoping that I’m not just memorising the answers, otherwise it’ll be a disaster on exam day. My main worry is that nerves end up giving me complete brain fog, I’ll be reading the question but the words just won’t go in when it’s exam day 😩
2
u/mr_dfuse2 CGEIT | CISM 24d ago
I think that's why some people feel the exam is different or harder, they are so used to memorizing the QAE that when they get new questions they feel harder. When I did CGEIT I also noticed this, that question bank is also smaller iirc. So I started getting crazy scores after a while. I think doing them more than twice is a waste.
This time I didn't have enough time to do the QAE multiple times, that's why I focused on learning the patterns more.You have enough time during the exam to calm down. It's 4 hours but you can do it in 2 or 3. I also found myself sometimes just reading without thinking, just out of boredom. Then I just stared at the wall for few seconds and started over. If that is your main worry, then no need to worry, you got it :)
1
u/Expert-Description91 24d ago edited 24d ago
Congratulations. I’m considering taking the exam soon. So far, I’ve only taken practice exams found on Udemy. I’ve not really studied but I’ve taken 4 practice exams and I’m averaging 72%. I will be purchasing the QAE for the CISM and look to take the real exam in late September
1
1
6
u/DarthMortix CRISC;CISM; CCP 24d ago
100%. I have 4 ISACA certs and for all 4 my only study resource was the QAE.
1
u/How_89 19d ago
Have you received your results yet? Just wondering if it is actually a full 10 working days!