The Beast Monster – CISSP

Last month I sat for a certification exam that in Cybersecurity circles, is one of the, if not the most elite cert a security professional can earn. After six months of consistent studies, I decided to take it on.

For reference, I have no prior cyber security work experience. My background is in IT, but it does not directly involve writing secure code or any of the domains on the exam, save one – software testing. That’s what I do in my work today. Anyhoo, my increasing passion for securing information on a corporate level and spreading cyber awareness to the public led me down this path. There are eight domains with a broad spectrum of the industry. It’s a manager’s exam, an executive exam, a very high-level conceptual type of exam. Learning so much information at times was hard to impress on my mind, I admit. I loved it though. For the last two years, I have been learning as much as I can on my own and earning the Security+ certification in 2018, which is a prestigious entry-level cert into the field. I wanted to know more. Which way should I go though? I bought a lot of books, watched many videos, read a lot of articles, blogs, and other industry news to stay abreast. Once I decided to try for CISSP (Certified Information Systems Security Professional) and began training for it, I knew I wanted to work in risk management or auditing. My work history has shown that I have success in these areas of business in multiple industries. So I leaned toward that area naturally.

Initially I was inconsistent with preparing for it. I rescheduled the exam once. I’d set a new date and paid my hard earned coin and was determined to apply myself to it. So I created a strategy that allowed me to feel confident enough on the test date. I figured six months was adequate time. Let me tell you, CISSP is not for play. It is not for the weak-hearted or weak-minded. It will weed you out fast if you’re not committed and serious about this career. I was not about to be punked because I knew I could do it. Out of the eight domains, I struggled grasping the most technical parts: networking, cryptography and the like. With no technical background experience to lean on, it was a challenge to grasp mentally. Mostly because I didn’t have an interest in that part. The other domains were better recieved and I enjoyed the training overall. I learned so much. Some concepts really excited me, lol.

On June 27th 2019, a Thursday, I went and sat for the exam. I went through the security check-in process. They take this part of testing very seriously. It is strict and rightly so. My belongings are locked away, my palms are scanned, my picture is taken, signed some forms, and then showtime. I was anxious and excited at the same time. After registering, I was told to sit and wait for the administrator of the test. The administrator gave me instructions, led me to a testing booth, and wished me luck. I sat down and prayed. I just wanted to be able to recall what I had studied, and be mentally strong enough to handle the questions so that I did not freak out. I expected the exam to be a beast monster and it did not disappoint. I took my time with it and to my surprise the questions were not unfamiliar, but the choices were like, “what the hell, bro?” Many times, I asked myself how do I make the right choice when two of the answers are disturbingly similar and correct? I had to remember and listen to the training voices. Again, this exam is managerial, it’s conceptual; managers are advisors, not fixers here. Keeping that in mind helped me eliminate answers better. After exactly 100 questions at about 90 minutes of wrestling the beast, the test ended on its own. I prayed again. Whew, I finished it! Then I began to tremble, my whole body shook, even my knees. I sat there for about two minutes before I composed myself enough to raise my hand to let the admnistrator know I was done and to come get me. My body was teeming with adrenaline afterward, but I thought I did well. I think subconsciously after I’d finished, I knew I could have done better. Still, I expected to pass. Everything was familiar or I knew answers outright. So I felt positive overall.

The administrator went through his spiel, handed me back my locker key, and allowed me to leave the testing area to pick up my results at the registration desk. I get my personal belongings and the registrar handed me the sheet of paper with my fate on it. Facedown. I didn’t want to look at it right away. As soon as I saw those bullet points through the paper I knew. I knew I had not passed. I know what the congratulations letter looks like and that wasn’t it. When I took it from him, I left it facedown and folded it in quadrants. I didn’t want to confrm it just yet. I went into the restroom to get comfortable and prayed a thank you to God for getting to this point. I looked myself in the mirror and tried to smile, told myself, “no matter what, it’s okay. You did it. Good job V.” I drove home reflective. When I got settled at home, I opened the letter and read. It lists my proficiencies in each domain. I did well, just not well enough. So I was weirdly comforted by the results. I was thankful that I had that to start training again. I decided that I would try again later this year.

Now, a month later, I feel like taking it on again. I need more time and to set a realistic study strategy. Not that I didn’t before, but I felt in such a hurry to do it that I may have cheated myself out of passing on the first try. Then again who knows, right? I do not have practical experience in the field yet, which allowed me to relax on the self-criticism. Now that I have a better understanding of the quality of questions on the exam (which no practice tests adequately prepare you for though) I feel ready to start again and knock it out the park next time around. I will conquer this beast monster. 🙂