CISSP EXAM PREP: Ultimate Guide to Answering Difficult Questions

[@colateh]

Passed my exam today, super blessed to have this video before it! Thanks Pete!

[@InsideCloudAndSecurity]

So glad to hear that! Congratulations! 🏆🎉🌟

[@ikedollar]

I got 5 correct out of 10. The Quantum Exam author says you should be good if you are getting 50%-60% on the actual Quantum Exam. I failed this exam three times last year before QE was introduced. 2021 CISSP questions were more straight forward. 2024 CISSP questions are more like this, unless you happen to get a 2021 type exam, as some have mentioned the questions being easier than QE while mine were like QE questions. I test my final time in two weeks and I bought QE before the price increase. We shall see…

[@InsideCloudAndSecurity]

Good luck on the exam! 🍀 🤞 👍

[@sabriallani]

"Great video, Pete! 🎉 The detailed breakdown of the READ strategy and the step-by-step walkthrough of practice questions are incredibly helpful for anyone preparing for the CISSP exam. The insights on tackling advanced question types are a game-changer! Thank you for creating such a comprehensive and practical resource for CISSP candidates. 🙌"

[@InsideCloudAndSecurity]

@@sabriallani Glad you like it! Good luck on the exam! 🏆🎉🌟

[@tyrellperkins]

Awesome video. Just bought QE yesterday for my last few weeks of exam prep. Now I have a perfect strategy ti approach each question! 🙌🏼

[@InsideCloudAndSecurity]

Glad it helped! Best of luck!🍀🤞

[@adriantakac2783]

Man these are brutal, I bought the Quantum Exams questions just before watching this video so I was pleasantly surprised to see them used in your training material. These 10 questions definitely exposed gaps in my reasoning and also technical knowledge. Good thing is I have another 600 of those from QE lol and also almost 4 weeks until my exam. Back to the drawing board I guess. Thanks for your training videos!

[@InsideCloudAndSecurity]

Glad I could help! Good luck! 🍀🤞

[@bulujena4302]

This was incredibly helpful. Thank you for sharing your knowledge.

[@InsideCloudAndSecurity]

Glad it was helpful! Good luck on the exam! 🍀 🤞 👍

[@KidlatTahimik-z4z]

Awesome!! Always helpful!! Taking exam soooon!!

[@InsideCloudAndSecurity]

Good luck! 🍀🤞👍

[@vincentkashaka394]

Awesome, taking the exam in February. Thank you so much!

[@InsideCloudAndSecurity]

Happy to help. Best of luck on the exam! 🍀🤞👍

[@alexchen1918]

Thank you very much for the content! I have subscribed to Quantum Exams, but I am a bit skeptical about the questions and the explanations provided for the answers. I would appreciate hearing your opinion on a specific question I came across. What do you think the correct answer should be? John, a network engineer, is tasked witch securing a corporate network against unauthorized access. During a recent review, he found that many employees are sharing their login credentials witch colleagues. what is the most effective measure John should implement First? 1.conduct training on password security. 2. Develop a strict password policy. 3. implement two-factor authentication for all accounts. 4. Monitor user activity for unusual login patterns. Looking forward to your insights.

[@InsideCloudAndSecurity]

The QE question you mention Is literally covered and answer justification is explained in this video (question #6). Give it a watch (or another watch) and focus on the explanation of why the chosen answer is the BEST answer. Start here kzbin.info/www/bejne/emmcXmqoiauarZYsi=a_Qp5K8-bYpd-yPr&t=1860

[@Nagarikudu]

Hello Pete sir, my take on question #05 on why either SOC 1 or SOC 2 aren't correct choices. SOC audit reports are meant to be consumed only by the external audience such as user organizations (clients/customers/prospective clients) and not for the service organization (Finance Station) by themselves. The question only states that service organization is looking for a way to assess the technical controls but doesn't mention anything on who the consumer is. Simply put, SOC audit reports exist in first place for helping the user organizations (clients) understanding the effectiveness of design/operations of control environment in the service organization (Finance Station), hence both SOC choices seem to be incorrect for me. Because, if a SOC 2 audit is to be performed, the firm Finance Station by itself cannot perform as it needs to pull in an independent auditor to perform and three parties are involved in any SOC audit- service organization (the organization on whose controls are being audited), user organization (client who uses this report to evaluate whether can rely on this service organization (to whom they have outsourced certain services) or not) and service auditor (an independent auditor hired by the service organization which performs an audit and issues report in compliance with standards prescribed by USA's AICPA, e.g., SSAE18). However, the question doesn't mention any of these details. Request you to kindly let me know your opinions on this, please. Apologies if my English is broken, I am from India.

[@InsideCloudAndSecurity]

You didn’t watch the video closely enough. The answer is SOC 2, I tell you that AND I explain why. Go watch #5 again.

[@Nagarikudu]

I did rewatch the explanation again but still couldn't understand. I agree that SOC 2 aims at testing the 5 TSCs (Security, Confidentiality, Availability, Processing Integrity and Privacy). However, the question doesn't mention any of the predisposing conditions required for commissioning an SOC 2 report which include hiring an independent auditor and also doesn't indicate whether user organization is going to use this report, it only states that the service organization is planning to assess its technical controls. As such, an SOC report cannot be used for internal consumption, it is meant for the user organization or customers to use the SOC audit reports.

[@InsideCloudAndSecurity]

@ a SOC 2 from a public cloud provider typically requires you sign an NDA in order to view it. I wouldn’t use the phrase “internal consumption”, but understand what QE was going for there. I tried to give you a full explanation in the video as to why SOC 2 makes the most sense as answer. in spite of any minor disagreements in nuance, I do believe SOC 2 it’s clearly the best answer.

[@SpicyPunkRockerOfficial]

Appreciate all you do sir!

[@InsideCloudAndSecurity]

Happy to help! 🍀🤞

[@Youngelder8010]

Great value

[@InsideCloudAndSecurity]

Thanks! 👍

[@michelventura2507]

Hi Pete, first of all thank you very much for the content! I respectfully disagree with the answer for question #4. I understand that the purpose of the question was to make us aware of the importance of physical security, but physically isolating the location of the fax machine only protects the information on the printed paper. It does absolutely nothing to protect the information in transit, as fax machines typically send data without any form of encryption. I mean, how can this be the MOST effective method to ensure protection of confidential information when anyone can tap into the network and obtain all the confidential data in cleartext? Thinking like a manager, I understand that alternative C is much more effective for protecting confidential data, policies are "corporate laws," and a policy discouraging the use of fax machines seems necessary in this scenario to initiate the transition process from fax machines to other, more secure transmission means that protect information in all its states. The perfect answer would be to completely abandon fax machines, so discourage their use seems to me like the closest alternative.

[@InsideCloudAndSecurity]

I’ll explain why the answer (which, along with the question, came straight Quantum Exams) here is correct. The question asks you to ensure you are PROTECTING Information. Reducing use does not actively protect, it simply reduces exposure. Logging, also does nothing to protect. Replacing the fax machines with other devices may do something to protect, but is not cost-effective. securing physical device devices that involve physical media behind a barrier physical security DIRECTLY PROTECTS sensitive information, making it clearly the best answer by all measures. And while eliminating use of fax machines would be great, it’s not an option amongst the answer choices. you have to read the questions carefully, and work within the parameters given. You’re often going to be given a list of imperfect answers amongst which you need to choose the best option. On the exam, just as in life, we can’t always choose the perfect solution and so we choose the best solution available to us

[@michelventura2507]

@@InsideCloudAndSecurity Thank you for the explanation and specially for taking the time to provide such detailed answer. Just got your book and I believe it will be an amazing tool in my arsenal!

[@InsideCloudAndSecurity]

@ happy to help. Ping me anytime if questions along the way. Good luck! 🍀 🤞 👍

[@mohammadyawer3174]

hi pete, for question 1 : the question never talks about about the organization is a nuclear facility or reorganization handling nuclear facility management. so how can we choose that answer when he question never mentioned it . the question only mentions "the organization" it can be any organization . as per the writer of QE said on reddit " don't make things up on your own, just answer the question". i understand that human safety always comes first , but the question never talks about a nuclear facility.

[@InsideCloudAndSecurity]

The question tells you nothing about the organizations business. It asks you which of these account management risks they’re looking at would be the most important to address. Because they don’t tell you anything about what the organization does and says these are the risks to evaluate you take that at face value. If they’d given you substantial conflicting information like “ Mary’s organization is a public library” that would be a different situation. Just as you said, you don’t invent/make up anything, and to say that that nuclear risk somehow doesn’t make any sense means you’re inventing some assumption about what the organization does.

[@mohammadyawer3174]

@@InsideCloudAndSecurity thank you for your quick response .. i understand your explanation , however I have 1 more doubt about the same question lets assume the question is same and the option C would be " unauthorized accounts have access to SCADA with weak passwords, which connects to water distribution plant" will we still choose the answer C or will go with A? water distribution plant doesn't have to do anything with human safety, any issue with it will cause disruption to the distribution system..

[@InsideCloudAndSecurity]

You’re inventing again. SCADA appear in many industrial and critical infrastructure scenarios. There’s no mention of water distribution in the question or answers.

[@mohammadyawer3174]

@@InsideCloudAndSecurity i know i am going off direction. but what I am trying to understand if we would still choose option C, if it didn't talk about human safety.

[@InsideCloudAndSecurity]

@ I see your point. If option C didn’t mention a risk involving human safety, we’d have to reevaluate .

[@Byeffect]

Thank you so much !

[@InsideCloudAndSecurity]

You're welcome. Good luck on the exam! 🍀🤞

[@ITaddict-m7m]

Thanks for all the great contents you are sharing on youtube. They are very helpfull for my exam preparation. My exam will take place in around 2 weeks and i'm wondering if buying your book now make sense ? As diagrams, reference tables and the what, when, why are things that help me to prepare for the exam.

[@InsideCloudAndSecurity]

Only if you've gotten everything you can out of your other materials. if so, mine's easy enough to flip through quickly and gain insights.

[@hanantariq5560]

#4 should be C. That is the only way transmission vulnerabilities are avoided.

[@InsideCloudAndSecurity]

PROTECTION is the key verb here and as I mentioned in the explanation, there is no security without physical security. And the policy option does not protect in this case the situation where people could choose to ignore the policy. I strongly encourage you to go back and hear the explanation again.

[@JiahaoLiu-j6b]

it is a bit sad that I only got 6 out of 12 correct, they are quite hard, I wish the real exam could be eaiser, but anyway I prepared for 4 months already, after finishing Quantum practice, I will book my exam, thank you Pete for your great video and Last Mile book, they are really helpful. I have one more question with the Last Mile book, it contains fewer topics than OSG, does that mean those exlcluded topics wont show in exam?

[@InsideCloudAndSecurity]

Glad you found it helpful. The Last Mile covers every section in the official exam syllabus, and I did my best to cover every relevant topic, but provide clear simple explanations and good tables and graphics to help you onboard concepts. It's designed to be a consolidated reference alongside the OSG you can get through through more quickly and where you can find a different explanations that help you focus on what is important for the exam.

[@InsideCloudAndSecurity]

6 of 12 is a GREAT start. Many reported only getting 2-4 correct going through this video.

[@hanantariq5560]

Question 6. The first thing he should do is creating awareness which is achieved by Option B.

[@InsideCloudAndSecurity]

Sorry you are incorrect here. As my explanation in the video says you cannot create awareness of a policy that has not yet been written. You are assuming a policy exists which is not the case in this scenario. You’re making an assumption that is in no way implied in the question.

[@amol24by7]

Thank you

[@InsideCloudAndSecurity]

Happy to help! Good luck on the exam! 🍀🤞

[@Goatman3333]

Hey awesome video, quick question though. I went to the quantum exams website and all I saw was the sample practice exam questions (which were 10) and the course. Is the course where the practice exams are? Thanks for your help

[@InsideCloudAndSecurity]

Not sure I 100% know what you mean, so ping me with a follow-up question if I am missing your meaning. The 10 questions I used are not the 10 sample questions you have access to on their site (for my video, I arranged for different questions with them). As for the "the course" that I mention, that's my 8 hour video and PDF on my KZbin playlist, where you'll also find the 2024 addendum and CISSP mindset videos. Playlist at kzbin.info/aero/PL7XJSuT7Dq_XPK_qmYMqfiBjbtHJRWigD&si=gARzuCSWJu7lTKUR

[@Goatman3333]

Never mind I understand now, I’m about to make a payment. Is there a promo code that you have for the course???

[@InsideCloudAndSecurity]

I don't know what course you're talking about. My videos are free, and QE are practice exams.

[@Goatman3333]

@ yea I was talking about the quantum exams practice tests

[@nadzhasan4995]

Questions 8 caught me off guard !

[@InsideCloudAndSecurity]

That’s not a bad thing. Will make you sharper for exam day. Good luck! 🍀 🤞 👍

[@shilezi]

thanks but these are ridiculously hard... information owners mentioned but not data owners in the centext of PII is wild lol

[@InsideCloudAndSecurity]

Data owner and information owner were both mentioned in answer options on that question

[@InsideCloudAndSecurity]

Yes, difficult but I would place them at roughly similar level of difficulty as the real exam

[@shilezi]

@ oh ok, thanks again

[@aminhamid9757]

Thankss

[@InsideCloudAndSecurity]

Happy to help. Good luck on the exam! 🍀🤞👍

[@aminhamid9757]

@ Passed Cissp today.. Thanks for your video

[@nocontenttwozerofour]

Sir Quiz 4 I need some more explaination, Why not C As a CISO why i won't go policy over a Process

[@InsideCloudAndSecurity]

As I say in the explanation, the ask is 'MOST effective method to ensure protection of confidential information' (meaning preventive), and that the threat is primarily physical in nature. A policy is not more effective than physical security for a largely physical disclosure threat. A policy does much less to protect against a physical threat than a preventive physical security control.

[@nocontenttwozerofour]

@@InsideCloudAndSecurity Clear.. ! Thank you so much Sir

[@InsideCloudAndSecurity]

@@nocontenttwozerofour anytime. Good luck on the exam!🍀🤞👍

[@sarine61]

Hi Pete, I don’t want to spoil this video by watching it now, as it seems I need to finish all training before watching it, is that a safe assumption?

[@InsideCloudAndSecurity]

No, you should watch it now as you’ll benefit from practicing this system during your practice quizzes throughout your preparation. The READ strategy also make your technical knowledge deficiencies more obvious anytime you encounter a scenario where you can’t complete the strategy because you don’t understand the technology or concept referenced in the question and answers

[@sarine61]

⁠​⁠​⁠@@InsideCloudAndSecurity thank you, I watched it. Great questions, not too technical or require an end to end knowledge of the whole CISSP exam objectives. Thank you for putting this together, and helping us READ the questions during the exam. however, I don’t understand question#10 explained logic! this is my take: 1. The question is specifically asking for a way to “encrypt” sensitive data in its all states (transit, rest, processing), CASB can probably monitor but I don’t think it does provide “encryption” as a solution for data encryption. 2. The information about the responsibility of the security team that they do monitoring, was not a “requirement” or “ask” but more of an information about what they currently do, so I took it as “distraction or noise” only and not relevant to the “main” ask to encrypt data in the 3 states mentioned. 3. The actual question asked which of the solutions “First” to prioritize. Not sure if my manager ask me to encrypt data, I would first invest in an access monitoring solution and not address the real ask to “encrypt” data. I would argue that “A” is the closest to the right answer, it can be done “first” then invest in encrypting other states of the data for example during processing. Also the organization has “it’s” own cloud infrastructure, typically “Dropbox” is not used by companies to deploy their “Infrastructure”.

[@InsideCloudAndSecurity]

@@sarine61 The answer in the video is 100% correct. There’s some technology you should dig into a little further to gain further perspective into the nuance,: study more about the capabilities of a CASB, as well as cloud service models, where a VPC can (and cannot) help. And since the cloud environment is called out specifically, you have to remember virtually 100% of organizations that have adopted public cloud are also subscribed to multiple SaaS services, some of which is will likely include storage of sensitive data. The option A isn’t possible for ALL scenarios, but a CASB help in the organizations, public cloud environment, but also in third-party cloud storage scenarios, making it hands-down the winner. Appreciate your frustration, but suggest you dig into the technologies there and with a bit of additional reading I think you’ll come to the same conclusion. Best of luck in your studies. Reach out with questions anytime.

[@sarine61]

Thank you for you reply and advice

[@InsideCloudAndSecurity]

@@sarine61 always here for you for questions or discussions like this one. Best of luck.

[@Ucsd4life]

How is question 6 D? You could develop all of the policies you want but if your users are not educated it won't really matter.

[@Ucsd4life]

You answered my question

[@InsideCloudAndSecurity]

The question asks you which you do FIRST. You can’t train people on a strict password policy that does not exist yet. You would train the people on the policy AFTER you created the policy. Be very careful about questions on the exam that include FIRST, NEXT, BEST.

[@Ucsd4life]

@ so for the exam should we not assume that a policy exists?

[@InsideCloudAndSecurity]

@@Ucsd4life correct. if they don’t tell you a policy exists, and creating a policy is amongst the answers, then I wouldn’t assume a policy exists. Definitely want to avoid assumptions and inventions when you’re analyzing questions

[@Ucsd4life]

4/10 :( I was close to 5

[@InsideCloudAndSecurity]

Not a bad start!

[@karhoong7457]

Are you sponsored by QE?

[@InsideCloudAndSecurity]

No. Opinions are my own and unpaid.

[@tech_beast2127]

Got only 2 right out of 10😂

[@rajnibhardwaj7622]

I too, that too after studying day and night for a year. The other apps I am easily going above 80% but these blew my mind. I'm really worried about giving the exam now.

[@tech_beast2127]

@rajnibhardwaj7622 yeah in a dilemma whether to go for qantam exam purchase or not. I see lot of people telling about that in reddit but I think it's marketing strategy.

[@anttim8671]

I mostly get 70-80% in practice exams and feel not ready to risk it and take the exam yet 😐

[@InsideCloudAndSecurity]

Most practice quizzes do a good job of testing your knowledge of concepts (especially the technology). Historically, haven't found one until now that comes close to replicating the challenging nature of exam question format.

[@InsideCloudAndSecurity]

It's not marketing. They're a couple of security leaders who spent years putting 600 questions and developing the offering. And I was not paid anything ($0) by them to say what I said in this video.

[@anttim8671]

Thanks! Well timed as I'm planning to take the exam soon. The questions are always annoying to me as I'm always overthinking too much and not the right thing probably. E.g. Q4 is talking about the MOST effective and Pete is talking about COST effectiveness. These make me mad even though I picked the correct answer this time 🙃

[@InsideCloudAndSecurity]

Remember “cost effective” is a consideration in “most effective”. If I picked an option that was technically effective, but wildly out of line with acceptable costs, I’m forgetting about one of my duties as a security leader - cost effective risk mitigation.

[@anttim8671]

@@InsideCloudAndSecurity I'm a nit-picking grammar-n@zi (engineer) and I'll never understand these even though I understand that the CISSP is more about English comprehension and trick questions than actual knowledge 🙂

[@kumaarrahul]

Thank you!!😊

[@InsideCloudAndSecurity]

Happy to help! Good luck on the exam!