Passed CISSP 1st Attempt With 10 Weeks of Prep: My Journey, Study Plan, & Lessons Learned
read time 9 minutes
Welcome to Austin's Analects, a weekly newsletter where I share actionable insights for optimizing performance and living ridiculously well.
TL;DR
Why I decided to take the CISSP as a sales engineer
My 10-week study plan to pass the CISSP with minimal security experience
Exam day routine, coming damn near to failing, and then passing at the buzzer
9 things I’d tell myself if I had to take the CISSP again (which I absolutely never will)
Advice for those considering getting their CISSP or currently in the trenches studying
I'm 26 years old and work as a Sales Engineer at HackerOne, helping commercial companies implement hacker-powered security. I started at the company in September 2022 with very little security experience.
One of the people who interviewed me even called me out saying "You don't seem too passionate about security."
Was honestly a little offended… But he was right! My only work experience was two years of digital transformation work at Deloitte. And even though security was a critical part of my work, I wasn't particularly passionate about it — which seemed to be evident.
"You need to be passionate about the work we do and what we sell. Otherwise, our customers are going to notice."
He had a point.
Nonetheless, I got the job. And after a handful of sales calls with CISOs and CTOs, I quickly realized what he meant. The people we sell to know their stuff and can easily sniff out bullshit.
I developed a horrible case of imposter syndrome and knew I needed to do something about it.
So I made it a goal to develop a passion for security by immersing myself in it — subscribing to security newsletters, listening to security podcasts, and subscribing to YesWeHack.
But no matter how much security content I consumed, I couldn't shake that imposter syndrome — which isn't good because SEs are supposed to be the confident, technical voices in the room.
Why I decided to take the CISSP as a sales engineer
I was selling well, but I knew my lack of security knowledge was holding me back. So after a year at the company, I approached my boss for help. He recommended I get a certification, listing a few I should consider — Security+, CISSP, and AWS Certified Cloud Practitioner.
I took his recommendations and hit the forums for advice.
After scanning r/cybersecurity, r/salesengineers, and r/cissp, I decided I wanted to pursue a CISSP — mile wide and inch deep was exactly what I was looking for. My thought process was I just needed enough to be able to speak the same language as the CISOs and security leaders I was selling to.
My 10-week study plan to pass the CISSP with minimal security experience
So I developed a 10-week study plan, registered for the exam, and purchased my study materials.
At a high level, my study plan was as follows — cover one domain every week, and then spend the last two weeks doing as many practice exams as possible.
Full disclosure: the materials I used to "cover one domain every week" changed throughout my studies, but I did stick with the overall plan.
I started my study plan on January 1st, 2024 with the following materials:
The Official Study Guide
Pete Zerger's Exam Cram Videos
Destination CISSP Mind Map Videos
Weeks 1 - 2
In weeks one and two, I tackled the first domains with the following study plan:
Reading the domain-specific chapters in the OSG and taking notes
Doing the Review Questions and Written Labs at the end of every chapter
Watching Pete Zerger's Exam Cram video for the domain I was studying at the time
And then watching the Destination CISSP Mind Map videos for the domain I was studying
Weeks 3 - 8
Then, during week three, my boss gifted me the Destination CISSP textbook — which was 100x easier to read than the OSG — the Destination CISSP Workbook — which gave my notes some structure — and I subscribed to the Learnzapp questions — after hearing a lot of good stuff about them on r/cissp.
So for weeks three through eight — after adding some materials to my arsenal — I changed my plan to:
Reading the Destination CISSP textbook
Filling out the Desintatino CISSP Workbook
Doing a handful of Learnzapp questions at the end of each Domain
Watching Pete Zerger's Exam Cram video for the domain I was studying at the time
And then watching the Destination CISSP Mind Map videos for the domain I was studying
I followed this plan religiously until I covered all eight domains. Eight weeks down. Two to go!
Now, onto the practice exams.
Weeks 9 - 10
I followed Pete Zerger’s 5-Step Strategy for reviewing and reinforcing what I had learned in my first eight weeks of studying.
The strategy went something like this:
Take a practice exam (or set of study questions)
Review what you got wrong and do targeted reading
Review (and update) your notes to address gaps in your knowledge
Complete targeted practice problems in the domains you lack knowledge
Retake the same practice exam and then repeat with a new exam after that
Here is my score progression during my last week of testing.
I wish I had this insight when I was studying, so figured someone might also want to see this stuff as well.
Learnzapp Practice Test 1: 65%
Four days before the exam — Learnzapp Practice Test 2: 73%
Three days before the exam — Learnzapp Practice Test 3: 75%
Two days before the exam — Learnzapp Practice Test 4: 76%
I read somewhere that you know you are ready when you are consistently scoring above 80% on practice exams.
Well, I never got there and still passed. Not sure where I read that, but if that’s some sort of target for your studies, it’s a good goal to have, but don’t beat yourself up or whig yourself out if you don’t get there.
The day before the exam
The day before the exam, I read through my notes in the Destination CISSP Workbook and hung out for the rest of the day. Nothing crazy.
Like I said, I was a little nervous that I never got to 80% proficiency in my studies, HOWEVER, I had a plan and executed it perfectly.
Plus, what could I really do the day before the exam that was going to make a big difference?
Exam day routine, coming damn near to failing, and then passing at the buzzer
My exam started at 8 AM and the exam center was 45 minutes away from my house.
I woke up at 5 AM, ate a bagel, crushed a protein shake, and hit the road. I got to the exam center an hour early — just in case — and began the test at 8 AM sharp.
The first 50 questions were easy. I was pretty confident I’d pass at 125 questions.
If you’re not familiar with the CISSP exam, it’s a CAT (computerized adaptive examination) that delivers different questions based on how you are performing in different learning domains. Candidates are asked a minimum of 125 questions and a maximum of 175.
If at question 125, the exam is 95% confident you’ll pass given the remaining 50 questions, then the exam ends and you pass!
If at question 125, the exam is 5% confident you’ll fail given the remaining 50 questions, then the exam ends and you fail.
And if at question 125, the exam is between 5% and 95% confident you’ll pass given the remaining questions, then you unlock another 50 questions to demonstrate your proficiency (and hopefully pass).
So I was feeling good during the first part of the exam and thought I’d be in that 95%.
Wrong.
Two hours and fifteen minutes into the exam, I got whacked with question 126 with 45 minutes to spare…
At this point, I was certain I was going to fail.
I started doing math in my head to figure out how much time I had for each of the remaining 50 questions. I even started planning out when I was going to sit for the next exam.
But, I moved through the rest of the questions, my hand shaking on the mouse. All I could think about was how much it would suck to have to tell my boss, family, and friends that I not only failed, but I failed because I ran out of time — so dumb.
I finished the exam with 45 seconds to spare.
The TA escorted me out of the testing room.
And I was handed the notorious sheet of paper.
“Congratulations!”
That was the only word I was looking for on that sheet.
I shoved the paper in my pocket, thanked the person at the test center, walked to my car, and called all my family and friends to tell them the good news.
Phew.
I told myself I will pay my CISSP dues until the day I die. I will never sit for that damn exam ever again.
As stressful as the last 45 minutes of the exam was, the whole thing was a great experience — choosing a certification, creating a plan, and getting it done. I learned a lot along the way. And there’s a slew of things I’d tell myself if I had to take the CISSP again— which I never will.
9 things I’d tell myself if I had to take the CISSP again (which I absolutely never will)
Prioritize practice problems: I spent a lot of time reading and taking notes, but doing more questions helped me learn faster and build my confidence. To be honest, part of my reluctance to really invest in practice problems earlier on in my studies was because I didn’t want to fail. I didn’t want to get questions wrong. Sounds stupid, but that’s the truth. So don’t be like me. Don't be scared to get things wrong at first. Because that’s how you learn.
Practice your pacing: I didn’t do this at all, and it almost cost me failing because I wasn’t able to answer all the questions in time! The practice exams I completed were 125 questions, but if I was to do it again, I’d practice with full-length exams of 175 questions instead. I’d also stick with a set cadence of spending X seconds per question — I neither practiced that nor did it on the exam.
Buy the Destination Certification Crash Course: The Destination CISSP materials were awesome. I’m really grateful my boss gave me the textbook and workbook. If I were to do it again, I’d purchase the whole crash course. It was the most helpful material for me out of everything I studied.
Prioritize memorization techniques: Prioritize creating memory tricks to help remember things. I only did this in my last week of studying. It definitely would have made studying easier… There's a lot of material to learn, so don’t feel bad if you need some tricks to memorize stuff. I know a lot of people will tell you “Well you should really understand this stuff! You owe it to yourself and your employer” And they’re right. But also, there's a lot of stuff to know. Anyways, I highly recommend checking out Pete Zerger’s video on memorization tips and techniques. Oh, and check out this post on r/cissp — wish I had found this prior to two days before my exam.
Review your notes early and often: I should have read my notes more often while studying. My notes were in my own words, so they helped me understand things more easily than reading the textbook — highly recommend the Destination CISSP Workbook.
Do more math problems: For math problems — or anything that needs a formula — , just practice them. At first, I had trouble with some math parts, but if I practiced more, I would have been fine. This video from Pete Zerger is great.
Have a study buddy: I wish I had a study buddy during my studies — someone who was following the same study plan as me who was along for the ride.
Avoid reading too many success / failure stories on r/cissp**:** There's a lot of good information in reading success / failure stories, but if you read too many of them, you’ll drive yourself insane. Everyone’s background, situation, and journeys are different. So use those stories as a way to build your plan, but once you have your plan, just stick to it and get to work.
As stressful as the last 45 minutes of the exam were, the whole thing was a great experience — choosing a certification, creating a plan, and getting it done. I learned a lot along the way. And there’s a slew of things I’d tell myself if I had to take the CISSP again— which I never will. stick with a set cadence of spending X seconds per question — I neither practiced that nor did it on the exam.nd I did the work! So I had nothing to worry about.
Advice for those considering getting their CISSP or currently in the trenches studying
So there you have it — my journey, study plan, exam woes, and lessons learned.
If you’re thinking about taking the CISSP, do it. I thought it was an awesome experience and I learned a ton — especially as a dude with little security experience. It gave me the confidence I needed to do my job better.
If you’re currently in the trenches, keep at it. Review your notes often, do lots of practice problems, and invest some time in creating some memory tricks to make your life easier. And last but not least, make sure to pace yourself so you’re not trying to do 50 questions in 45 minutes like I had to. I do not wish that upon my worst enemy…