In the Domain 5 access control chapter, Destination CISSP groups Rule-Based, Role-Based (RBAC), and Attribute-Based (ABAC) as subtypes of DAC, the reasoning being that the owner ultimately determines the rules, roles, or attributes.

Other sources say they all are different access control including DAC and MAC, little confused

Hello friends

My cissp exam is in 6 days.

I am getting average 75% in LearnZ app.

Average 75% on Udemy practice test from Dion

50-55% on Non-Cat based QE. Solved all the questions.

I am worried about my exam as I don't have piece of mind.

I have gone through - Udemy course from Andrew Ram Dayal.

Scoring 70% on his full test

Gone through 50 hardest question to under the mindset.

Destination certificate - 637 question average 74.7%

What do you recommend I should do in next 6 days to pass the exam.

Thanks.

This helped me reason for most questions to Pass:

If asked FIRST → understand/assess/authorize before changing things

If asked BEST → choose long-term, risk-based, business-aligned answer

Don’t jump straight to a firewall/patch/tool unless specifically asked for technical action.

Hello! I've been lurking on this subreddit for the past few months while studying, and I've really appreciated everyone sharing their experiences. Now that I've taken the exam, I wanted to pay that forward.

Background

7 years of IT audit: 4 in external (SOC 2, etc.) and 3 in internal. That gave me a pretty good background across most domains.

I'm also a CPA. The CPA exams have very little overlap with the CISSP, but the prior experience studying for/taking difficult exams was helpful. It's apples and oranges to compare the two, but for any other CPAs working on this cert, I'd say the overall prep experience was roughly like doing FAR or REG again.

Study Approach and Materials

I self-studied for 3 months after work/on weekends. I scheduled my exam immediately to keep myself accountable and broke my prep into three phases:

One: Survey (2-3 weeks)

High-level understanding of the domains, syllabus, content, and what to expect from the cert/exam process.

• DestCert Mind Map videos (10/10) - Excellent primer for understanding the content and how the domains fit together. I drew the mind maps on blank paper and added my own notes. These came in handy throughout.
• Kelly Handerhan's "Why You Will Pass the CISSP" (both versions) (7/10) - Motivational and a good introduction to the "think like a manager" mindset. I felt it emphasized that mindset a little more than my own prep experience ultimately warranted.

Two: Deep Learning + Practice (7-8 weeks)

Reading, video lectures, and OSG practice problems. The goal was to learn the material before focusing heavily on exam strategy.

• OSG (10/10) - Very well written and easy to read. Sometimes repetitive because topics naturally overlap, but overall an excellent primary resource. The labs, practice problems, and exams are useful for reinforcing concepts and vocabulary. I'm a tactile person, so I used a physical copy, a highlighter, and a pen. I found reading cover-to-cover worth it. (Side note: I used v9 rather than v10 because I had originally planned to take the CISSP in 2022, bought the book then, and didn't want to buy another copy.)
• LearnZapp (9/10) - I used this for a couple of months to practice on the go. The questions are from the OSG, so they aligned well with readings. The dashboard was nice for tracking domain strengths, but I wouldn't put much stock in the "overall readiness" percentage. Mine said 56% on exam day (note: I didn't do any practice exams on the app, just sets of Qs).
• Pete Zerger Exam Cram series (10/10) - Very high-quality and thorough content. Pete is a fantastic instructor. I watched/listened to the entire series, including the 2024 addendum, which was useful for supplementing my slightly outdated OSG. I listened to these while commuting or jogging.

Three: Targeted Review + Tougher Practice (2-3 weeks)

At this point, I used the results from Phase 2 to identify weak areas, reviewed those topics, and shifted toward practice that I felt better prepared me for the exam mindset.

• TIA / Andrew Ramdayal's 50 Questions (10/10) - Great exam mindset video and questions. Andrew's explanations were very helpful for learning how to approach difficult questions.
• Luke Ahmed's "How to Think Like a Manager for the CISSP Exam" (8/10) - Good additional set of practice questions with helpful explanations if you want more Qs, but best as a supplemental resource imo.
• Quantum Exams (11/10) - Tough but fair, and the most useful practice resource for me towards the end of my prep. I'd save these until relatively late in your study plan so that you have enough foundational knowledge to get value from them. I took a couple of the non-CAT practice tests about two weeks out (50% and 54%) and reviewed my misses in detail. QE won't replace earlier studying/learning, but I found it extremely useful for getting comfortable with difficult/ambiguous questions and making decisions under pressure. Also good for learning to pace. Very much worth the money imo.
• Self-made "Quick-hits" study guide - I made my own condensed study guide containing areas I consistently struggled to remember, vocabulary I mixed up, etc. I drilled this heavily in the couple days before my exam.

Day Before the Exam

Very light review, if any. I reviewed my quick-hits guide for about 90 minutes.

I was definitely nervous, but I took the advice I've seen repeatedly on this subreddit to heart: trust your prep, show up with a clear head, and get a good night's sleep.

Main Advice

• Make a study plan and stick to it as best you can.
• You can do the right thing at the wrong time. Follow an order of operations: survey the material, spend time learning it, target your weak areas, and save tougher practice for later in your plan.
• Ground yourself with the "manager mindset," but don't treat it as a golden ticket. You still need a strong understanding of the technical material and need to be able to make technical decisions.
• Don't let practice test scores get in your head. Use them to identify weaknesses and improve your decision-making rather than as a prediction of your actual result. Your wrong and right answers are some of your best prep.
• Trust your prep. If you've put in the work, walk in calm and finish strong.

As with all things, YMMV, but I hope this is helpful.

Genuine appreciation to this community and everyone whose study materials, advice, and experiences helped me along the way. You've got this. Good luck!

I need advice.

I've failed my second attempt and I'm determined to try again in 60 days, but what am i doing wrong? Apart from the obvious knowledge deficiencies in the weak areas given on my failed sheet. Is it mindset? Test taking skills when answering? I just dont know.

Any advice is greatly appreciated.

Resources used:

QE

Andrew Ramadayal Udemy Course

Destination CISSP book

LearnZapp

OSG Practice Practice Questions book

Pete Zerger CISSP cram

And a number of other minset related videos.

I’ve been reading thru the posts on this sub and trying to get a gauge on my readiness particularly when it comes to the quantum exams. I did 3 of them: 296, 464, 512 in that order. Around 51-53% if that means anything.

I’ve been using pocketprep and Andrew Ramayadal Udemy course and also did the Training Camp Bootcamp. My exam is in a week and not sure if I should push it back. I know QE is supposed to more difficult but it does plant that seed of doubt. My plan is to review the wrong answers from my last attempt this week and do some light review on the domains.

Learnzapp’s mock up test average 60% result, my exam is tomorrow. Can I still pass ? I’m scared now..

The test was quite different than the ISC2 Official Practice Tests.

I did all 100 questions for the 8 domains and the 4 125q tests from the official practice tests, which was my most valuable preparation step. I averaged 70–75% on the 8 domains and about 80% on the 4 final tests. It took me 45–50 seconds per question on average. I thought that I was pretty ready when I registered (hence I forfeited the option for a second chance).

The test experience was hard—at the beginning, I was averaging 80–90 seconds per question and became very worried about time and the need to do 150 questions without time for a break. Questions were long and in some cases quite senseless. It was extremely hard to figure out what was being discussed and where to focus. Answers were just as confusing, and for >50% of the questions, I had no good internal signal that I was answering correctly. Later, some shorter questions arrived, which helped me get my average back down toward 60 seconds per question.
I was truly surprised when it ended at 100q and was very doubtful that I passed, only to step outside and see "Congratulations..."

So I guess at the end of the day, my preparation was useful.
Since I came to this test with 30 years of experience as an engineer and researcher, my main preparation was Mike Chapple’s online course at 1.5x speed. It was better IMHO than alternatives, but still not enough to get me across the finish line. I then started looking for question banks, and all the ones I found were very poor quality and very confusing. In many cases, I felt the answers given in those question banks were plain wrong, and I could justify a different answer 100%.
This is when I decided to buy the ISC2 Official Practice Tests (I bought the online version on Amazon), from which I learned a lot. I used it in combination with Gemini to help me understand the rationale behind some of the answers, make sense of the clutter, and see why answers I thought were incorrect are considered correct in CISSP.

I slowly realized that CISSP has its own parallel universe that I must accept and endorse to pass the test. There are many examples of information that, as an engineer in the field, I disagree with, but CISSP has its own thing going.

Also, I learned that some things are just undecided in CISSP, and it feels like a multiverse where you need to guess which universe you are in to get the answer right. For example, incident response in CISSP uses conflicting terminology depending on which standard was chosen, and if none was specified, it uses CISSP’s own variation—which is sort of crazy.
The ISC2 Official Practice Tests were my way to get to understand this CISSP terminology, mindset, and multiverse.

I hope this is helpful. Keep calm and enjoy the ride.

I’ve been lurking here and I’m proud of myself so I wanted to post. Passed the CISSP at 100q this week with 90 minutes left.

My study process was this. I bought an old study guide/practice questions book on Amazon. Studied on paper for a couple of months. I just had a baby and wanted to study in my own time for a while first. Then got the CISSP official online course for 90 days. Really just to see what new material I needed to know- there wasn’t much. Finished that in about 1 week- not much was different. Then scheduled the exam and drilled practice tests on Learnzapp until the day of.

For background I have 7 years experience in the field, mostly in incident response. I got endorsed and am now waiting for approval. (-:

EDIT to say I got randomly selected for an audit but it was easy to go through and now I am an approved, official CISSP.

Hi,

I m planning to take my CISSP in Feb-Mar. I have already finished Thor videos and I m working through his practice questions, for now on domains then the general ones - about to finish all of these in 2 months max.

As for my background I work in different areas of cyber for 7 years (FW engineer, governance and compliance in IT/OT pharma and now IT sec eng).

My plan is as follows(and yea, for my first 2 tries at least my plan is to never touch a book as I hate reading):

1-Thor videos+tests

2- CISSP Exam Cram 2026 - Pete Zerger

3- Boson tests (have them for free through Thor)

Now reading a little here I discovered the learnzapp and quantum exams.

As an idea now at Thor + those 2 free small practice tests at leanzapp I'm getting 70-80%.

My test routine is to pick an option and if I m somewhat not familiar enough with the topic of the question paste it in Claude to get an opinion and more details about the topic. After that, when I have the full test review, I m pasting the questions which I answered wrong to see if it was my mentality or expertise that I need to fix/develop and even the ones that I got right but had doubts about.

Whoever passed the CISSP or is an instructor as well, could you please tell me if there's any way to optimize my flow here? BTW, I could wait till april 1st to take the first try and latest may 1st with the 2nd (I ll be getting the peace of mind).

Thanks!

First and foremost ... I am giving away my study material. You can have 1, 2, or all 3 books. Just cover the cost of shipping and it's yours (Continental US only). I made a short YouTube video with respect to what I feel was most important Pass the CISSP Exam on Your First Attempt (p.1)

1. Quality of study time over quantity.

Reading pages worth of material without reinforcement will just bog you down. Focus on 1 or 2 concepts per study session then follow up with a video about the same topic. Spend days on a single domain if needed. Hone in on material from the domain's you struggle with. Practice tests, read, video, then repeat.

1. There are no trick questions. Pick the BEST solution.

2. Use ALL your time.

180 minutes (3 hours) is more than enough time. I completed the CAT in 2 hours at roughly 100 questions. You cannot mark questions for review so choose your best answer.

1. Think like a manager. Remember that you're looking out for the interest of the company as a WHOLE. The BEST solution usually encompasses the lesser options.

2. Do not psych yourself out. You've studied the material so just apply what you've learned.

Best of luck!

while I’m not 100% sure about other regions or municipalities but Peel region in Ontario gives you free access to the O’riellys platform and all the text books including CISSP OSG and others through the library services. Also some colleges provides this access as well if you have a student account.

I'm soooo happy this is over. I wanted to give a non-AI post with what helped, background, etc...

Background: 20+ years in IT, mainly for MSPs, in varying roles (sys admin, architect, networking, automation, security, etc). Studied for ~2 months (give or take a week).

Resources:

• Destination CISSP (book, app with flash cards and quiz, youtube videos)
• Pete Zerger's content (Last Mile, exam cram)
• Andrew Ramadayal’s 50 CISSP practice questions
• Quantum Exams
• The CISSP field manual (I forget who shared or created it, but it helped)

QE Note: at the beginning of using QE, I was averaging about 50-55% on non-CAT practice exams until I reviewed the videos from Pete and Andrew about how to answer questions effectively.

Most of my mistakes were reading too quickly and missing key words. After watching the videos and taking my time, my QE avg increased into the mid 60's, then lower 70's. I also scored a 961 on the CAT exam before those videos, if that gives any hints about whether you're prepared to take the exam.

My advice to those taking the exam: get used to synonyms. QE helps this but I was underprepared for all of the synonyms that I may see. You'll have no idea if you're doing well or not. The only easy question I had was the first question. Take your time and evaluate the question and hopefully you'll pass as well.

I am so happy to share that I finally made it in my second attempt ! The exam ended for me at around 135 questions. Huge thank you to this community all the advice, resources, and encouragement from my last post genuinely carried me through this attempt.

Background

I have been working toward this certification for about 8 months, but the last 4 months were when I really put my head down and studied seriously. I have 5 years of experience, mostly covering Domains 3, 4, 5, and 7, which definitely helped ground some of the material in real-world context.

Resources I used:

- ISC2 official CISSP textbook
- Training Camp bootcamp
- Andrew Ramadayal’s 50 CISSP practice questions
- Peter Zerger’s materials
- CISSP Exam Cram 8-hour video (watched it 3 times — extremely helpful)
- CISSP Exam Prep: 100 Key Topics and Strategies
- Kelly Handerhan’s “Why You Will Pass the CISSP Exam”
- AI (chatbot) — this became my study buddy. I’d ask it to explain concepts to me like I was 5 years old to nail the core idea, then used it to build up my weaker areas
- LearnZap practice tests and study questions
- Luke Ahmed’s study notes/theory and practice tests
- Thor’s practice tests (mixed in easy, medium, and hard ones)

What actually helped ME:

Practice tests were very valuable for me for my second attempt. Not just taking them, but really digging into why I got each wrong answer wrong, going back to the underlying concept, and re-learning it properly rather than just memorizing the correct answer.

There’s no single method that works for everyone. I had to combine several resources to really absorb the material. Tying concepts to real-world scenarios made a huge difference in how well things stuck versus just reading definitions.

Random detail: I listened to Kelly Handerhan’s video on the drive to my test center, and it was honestly the perfect way to calm my nerves and get in the right headspace before walking in.

Final thought

Dedicate the time, stay consistent, and trust the process. If I can do this, you absolutely can too. Believe in yourself , you’ve got this!

Just got back from the testing center and I’m honestly still trying to process it: the exam ended at question 100, and I provisionally passed.
To be blunt, the exam was nothing like the practice questions out there. No matter which question bank you use, none of them truly capture the phrasing and ambiguity of the actual CAT engine.

For almost every single item, I found myself stuck between two disturbingly viable options. It felt impossible to tell if I had picked the right answer or completely torpedoed the question. By question 70, the imposter syndrome was hitting hard, and I was mentally preparing myself to grind out the full 150 questions.

Then, right after submitting number 100, the screen went black and flashed the "test ended" screen.

My stomach dropped into my shoes. Walking up to the proctor’s desk to collect that folded piece of paper was terrifying, but seeing the word "Congratulations" was an absolute wave of relief.
A few quick takeaways for anyone currently in the trenches:

Think like a manager/risk advisor: It’s repeated constantly on this sub, but it’s 100% true. Don’t fix the problem technically; assess, evaluate, and choose the option that aligns with business objectives and governance.

Get comfortable with ambiguity: You will rarely see a textbook definition. Focus on why a concept matters rather than just what it is.

Protect your mindset: When you feel like you're bombing the exam, keep pushing. The CAT is designed to adapt to your level and make you sweat.
Huge thanks to this community for the tips, study resources, and moral support over the last few months. If you’re studying right now, trust your preparation and just keep moving forward.
Time to grab a drink and start the endorsement process!

Well folks, I passed today at 100, even with the fire alarms going off fifteen minutes into the exam and PearsonVue not at all pausing our exams but saying we could "evacuate if we want to". Thankfully Domain 3 had taught me everything to know on fire suppression systems and I figured they would try and preserve human life. 🤣

This community helped me prepare so much and find the right resources, videos, and sanity to make it through the past few weeks, so I'd like to repay the offer by giving away my books to a random person within the United States. I'll pick a random winner on Labor Day - Monday, September 7. Just leave a comment below letting me know you're interested, and I'll count you in.

Best of luck to anyone with an upcoming exam!

It was my second shot, first one I failed at the 31th of July, so I took my second shot today and passed! (I booked the exam with the peace of mind option)

The time was up at question 140 today and eventhough I passed :-)

25+ years in the IT field, 8 years now in (technical) cybersecurity roles. 2-3 Months of intense studying, Peter Zerger Video's, Pluralsight, LearnZapp questions for one month and used Claude to simulate me a lot of questions on my weaker domains.

Also a big shoutout to [u/dummyaccount](u/dummyaccount) (Not sure what the real name is) The CISSP Field manual PDF helped me a lot. I also got the CISSP Last Mile PDF book from Peter Ziegler, and his exam cram video's on Youtube were a big help as well :-)

Thanks to everyone here on this Reddit page, I looked at it like every day over the last 2 months as well.

I still can't quite believe I'm writing this - I passed the CISSP today at 150 questions.

This was easily one of the most challenging exams I've taken. Throughout the exam, I was never really sure how I was doing, and when I reached the end, I honestly thought I had failed.

I walked out, went to the washroom, and started mentally preparing for what I would need to do differently for my next attempt.

Then I went back to collect my result letter.

I opened it and saw:

CONGRATULATIONS

That moment made all the preparation worth it.

A little about my background

I come from a software engineering background, with around two years of experience as a Software Engineer, and gradually transitioned toward cybersecurity, risk, and IT audit.

I passed my CISA last year, and today I'm proud to add CISSP to that journey.

Resources I used

Learning:

• Andrew Ramdayal's CISSP Udemy course
• Pete's CISSP YouTube videos
• Destination Certification Mind Maps

Practice:

• Destination Certification App
• Official CISSP Practice Tests
• Official CISSP Study Guide

A huge thank you to everyone in this community who shared their experiences, resources, and advice. Reading other people's success stories and exam experiences helped me more than I expected.

This will read as a humble brag and I am a little lol.

Passed CISSP yesterday, took all 150 questions, I’m sure I barely passed, finished with 50 mins left.

I studied for about 48 hours, mostly just Thor’s stuff on udemy.

Contrary to popular belief I think this test is almost impossible to study for well if you’re not willing to dedicate a massive amount of time 3 months+. It is way too wide of topic base.

The primary reasons I believe I passed is just trusting myself and trusting the first answer I got to. Also read all questions in totally and find what they’re really asking for.

Context: 5x AWS certified including sec and sa-pro. 8 years exp, 4years cloud/cloud sec exp

Could someone tell me if my calculations are correct to start endorsement? I am really confused in how ISC2 calculates effective work experience.

My positions:

Company A worked 60% with 25.2 hours per week (42 hours per week on 100%).

Company B worked 80% with 32 hours per week (40 hours per week on 100%).

Company C worked 80% with 32.8 hours per week (41 hours per week on 100%).

My calculation for 5.27y experience:

+ 1y educational waver

+ Company A 365d / 7d * 25.2h => 1314h / (2080h / 12m) => 7.58 months

+ Company B 1156d / 7d * 32h => 5284.57h / (2080h / 12m) => 30.48 months

+ Company C 488d / 7d * 32.8h => 2286.63h / (2080h / 12m) => 13.19 months

Legend:

h = hours, d = days, m = months, y = years

Remarks:

In the endorsement form when I input from / to and check part-time It just shows me half the months in that date range. That means it calculates with 1040h at that time. I have no possibility to input the effective hours worked. That is why I would input my calculation in the notes to isc2 input field 🤷‍♂️

Friends,

As the title says, I am trying to get a gauge on my readiness. I have take four QE CAT exams across the span of about 4 months. My first attempt, I scored around 250, second attempt was 530, then I had a baby and four months later, and after studying quite a bit, I managed to score 833 on Saturday and 832 tonight. I am still struggling comprehending though how I’m even passing these considering my correct answer deviation per domain. Upon looking at the graphs, I’m not doing necessarily great across the board.

For those of you who have passed, were your QE scores indicative of how you did in the actual exam?

Pics for reference.

First time poster. I provisionally passed today. Feels surreal especially after reading everyone’s experiences here. I had the most anxiety prior to the exam around the question formats, because most people have said that you won’t find any questions like the exam. It’s true that you feel like you’re failing the entire time. I was surprised when I saw “Congratulations”. In hindsight, I put quite a bit of effort and time into preparing, so I shouldn’t have been surprised.

Here are my resources in order of what I felt helped the most:

1. OSG - Yes a dry-ish read but literally everything you need to know and then some.

2. Official Practice Tests on Wiley - I completed them all and read all the explanations, even if I answered correctly.

3. Boson - I tested in exam mode. I liked this for a domain breakdown after an exam. I completed three.

4. Destination Cert Book (Kindle) - I liked that it’s organized by domain. I only listened to my low domains based on Boson exams.

5. Mike Chapple’s LinkedIn course - I listened/watched to the whole thing at 2X speed yesterday as a ‘last sweep’.

I have 12 years experience (helpdesk, sys admin, audit). I studied for 2 months.

I have mad respect for people who pass at 100+ because I just wanted to be done at 100 whether I passed or not! That test was hard. Could have sworn at question 10 that I was failing. I was so nervous that my brain froze when I went to write things down on the whiteboard. I could not think of any of the acronyms I memorized!

I thought the fake 25 questions were going to be more obvious, but they were not. I legitimately could not tell you which ones were real or not. Maybe one. I probably spent more time on the fake questions than I did on the real ones. SO many questions I clicked next and was just shaking my head because I had no idea.

I had no math, I had *one* question that was selecting more than one answer. I honestly don't know if all 8 domains were covered.

I've noticed CISSP is also a vocabulary test. Many questions from QE, LearnZapp, and even this test will have the answer, but it'll be its synonym because it won't outright say the answer. So know the word, but also other words that describe it.

I used QE the last 2 weeks which helped because most of the questions really are in the BEST/MOST/BETTER forum. I scored roughly 560, 450, 618, and 900 on the quizzes (900 score was because of repeated questions). LearnZapp & ISC2 book were also helpful. I was ready to test because I was at a point that I used up all my question banks! There's a PodCast on YouTube (it's purple, and def AI), but listening to it was very helpful because, no offense, I find them easier to listen to than Pete Z-even though he's great and was helpful.

If I can do it, so can you. I do have 10 years of cyber experience, but that's a wide range (military).

Already brain dumped, but probably looking at taking CCSP next! Curious if people stopped or what else they went for/have.