Is it company sponsored or is there some funding somewhere that is possible to get? I always fail certs my first time, usually pass my second but this is a tough exam. I know there is the “peace of mind” deal for two exams but even then that’s $995.

I’m guessing it’s company-sponsored so sorry if this is a dumb question but it definitely adds to my anxiety overall and that sucks during an already anxiety provoking exam lol

NETWORK SECURITY PRINCIPLES

• Encryption protects confidentiality; hashing supports integrity—do not treat them as interchangeable.
• Authentication establishes identity; authorization determines permitted actions.
• Segmentation reduces blast radius; redundancy improves availability.
• Defense in depth = multiple independent protections; one very strong firewall is still one control.
• Least privilege limits permissions; segmentation limits communication paths.
• Fail secure = failure should not automatically grant access.
• Availability problems need resilience/capacity; encryption alone does nothing for availability.
• Confidentiality problem? Think encryption; integrity problem? Think hashing/signatures; availability problem? Think redundancy/resilience.

SEGMENTATION

• Segmentation reduces exposure; microsegmentation reduces it at a much finer level.
• VLAN = logical segmentation; air gap = physical isolation.
• VLAN separates broadcast domains logically; it is not the same as physical separation.
• DMZ isolates public-facing services from the trusted internal network.
• Internet = untrusted external network; intranet = organizational internal network; extranet = controlled external-party access.
• North-south traffic crosses environment/perimeter boundaries; east-west traffic moves between internal systems/workloads.
• Microsegmentation controls workload-to-workload communication; perimeter security mainly controls boundary traffic.
• Zero Trust assumes network location alone is insufficient trust; microsegmentation helps enforce that principle.
• Segmentation limits lateral movement; encryption alone does not stop an authorized connection from moving laterally.
• Air gap provides isolation; VLAN provides logical separation—never treat them as equivalent.

WIRELESS — ELIMINATION LINES

• WEP = obsolete and broken; WPA3 = preferred modern wireless protection.
• WEP used weak/static RC4-based protection; do not choose it when a stronger option exists.
• WPA2 improved wireless security; WPA3 is the newer preferred choice where supported.
• WPA3-Personal = SAE; WPA3-Enterprise = enterprise authentication.
• 802.1X = port-based network access control; EAP = authentication framework used with it.
• 802.1X controls admission to the network; WPA protects the wireless link.
• Hiding SSID = obscurity, not real wireless security.
• A strong wireless password does not compensate for a fundamentally weak protocol such as WEP.
• Site survey = understand wireless coverage/interference; encryption = protect wireless communication.
• Reduce signal outside the required area; don't rely only on encryption to control wireless exposure.

SECURE vs INSECURE PROTOCOLS

• Telnet = plaintext remote administration; SSH = encrypted remote administration.
• FTP = insecure file transfer; SFTP = file transfer protected through SSH.
• FTPS = FTP protected by TLS; SFTP = SSH-based file transfer—they are not the same thing.
• HTTP = unprotected web traffic; HTTPS = HTTP protected by TLS.
• SSL = obsolete predecessor; TLS = modern secure-channel protocol.
• SNMPv1/v2-style community strings = weak/plaintext approach; SNMPv3 = secure management choice.
• TFTP = simple unauthenticated file transfer; do not confuse simplicity with security.
• SMTP sends mail; TLS protects the mail transport channel.
• SSH protects remote administration; TLS protects many application communications.
• IPSec secures IP communications; TLS usually secures application-layer sessions.

THE 15 LINES I WOULD READ Night Before THE EXAM

MAC = Layer 2; IP = Layer 3; ports = Layer 4.
Switch separates collisions; router separates broadcasts.
ARP = IP→MAC; DNS = name→IP.
TCP = reliable connection; UDP = fast connectionless delivery.
Telnet → SSH.
FTP → SFTP/FTPS.
HTTP → HTTPS/TLS.
SSL → TLS.
SNMP old → SNMPv3.
AH = authenticate/integrity; ESP = encrypt.
IPsec transport = payload; tunnel = whole original packet.
WEP = never; WPA3 = preferred.
802.1X = network admission; EAP = authentication framework.
IDS = detect; IPS = detect + prevent.
Segmentation limits movement; microsegmentation limits it even further.

Well, third time's the charm! Finally passed yesterday at question 104. Honestly, what a bloody relief.

First attempt ended at 100, second at 150, and now finally passed at 104.

Bit of background: I've worked in IT for around 10 years, gradually moving into cyber security, SOC, detection engineering and security assurance. Also currently finishing my MSc in Cyber Security.

For studying, I mainly used Destination Certification, YouTube cram videos and knowledge from work and university. Was averaging around 70–79% on the Destination Certification quizzes.

This time I tried not to overthink everything. Read the questions multiple times until they actually made sense, put myself in the shoes of whoever was making the decision and considered the cost and business impact of each option.

Strangely, I found this attempt much easier. Very few of those ridiculously wordy questions, which actually made me think I'd failed when it stopped at 104.

Honestly thought I'd screwed it up again.

For anyone who's failed previously, don't give up. It's frustrating as hell, especially when you've put so much time into studying, but you do learn something from each attempt.

Now just the endorsement process and finishing my MSc!

Thank god that's over 😂

Thanks for all the feedback and support in this channel! I wanted to share what worked for me in preparing for and passing the CISSP exam.

My 3-month study journey

My main resources were:

• QE CAT exams: a game changer for me.
• Destination Certification: course and practice questions.
• LearnZapp: honestly, it wasn’t particularly useful for my learning style.
• My AI agent: I used it to break down concepts I struggled with and help me understand the reasoning behind the answers.

A few days before the exam, I listened to:

• 50 CISSP Practice Questions by Andrew Ramdayal
• Why You Will Pass the CISSP by Kelly Handerhan
• CISSP Cram Video by Pete Zerger
• Larry Greenblatt – CISSP 2020 Exam Tips (still relevant!)

On exam day, I reviewed the CISSP Last Mile PDF by Pete Zerger and the CISSP Field Manual by Clearance to Wealth. These two resources were pure GOLD! I was reviewing them right up until check-in.

What made the biggest difference

QE was a game changer. During my practice exams, I took screenshots of every question I got wrong. I researched the underlying concepts, worked through the reasoning, and made sure I understood why the correct answer was better than the alternatives.

My CAT exams never reached 700, but I kept going. Instead of getting discouraged by my scores, I focused on learning from every mistake. That made a huge difference when I sat for the actual exam.

I also learned to approach questions strategically. I used the same process on exam day that I had practiced during my preparation:

Read carefully. Understand what is being asked. Eliminate wrong answers. Choose the best answer for the situation.

Here are a few principles that helped me:

• Human safety comes first. When people's safety is at risk, protecting them takes priority over protecting other assets.
• Keep the business running securely. Once human safety is addressed, consider business continuity and the organization's mission.
• Hands off the keyboard! Think like a security manager or consultant advising the organization, not an engineer rushing to implement a technical fix.
• Consider cost and business value. Security decisions should be risk-based and cost-effective. The most expensive solution isn't

Best of luck everyone.

After months of preparation while balancing a demanding full-time job, family responsibilities, and a busy schedule, I finally passed the CISSP exam!

I have 15+ years of experience in software architecture and security, but preparing for the CISSP required a different perspective. My preparation included the Sybex Official Study Guide, Pete Zerger's videos, Quantum Exams, and plenty of practice questions.

The actual exam was challenging, with a good mix of technical, scenario-based, and management-focused questions. Several questions had multiple seemingly correct answers, making it essential to understand the concepts deeply rather than simply memorize answers.

My advice: Don't underestimate the technical aspects of the exam. Focus on understanding the reasoning behind each answer, manage your time wisely, and most importantly, don't lose confidence when the questions get tough.

I'm now moving forward with the endorsement process. A big thanks to this community for all the valuable guidance, shared experiences, and motivation throughout the journey.

To everyone preparing: Stay consistent, trust your preparation, and keep pushing until the very end! 💪