Larry Greenblatt - CISSP 2018 Exam Tips

[@T-_R-_E-_Y]

I passed the CISSP yesterday and just wanted to give thanks to people like you who took the time to share their knowledge with the rest of us.

[@muthusamykms]

William Trey Murray , can you please guide me which study material to prepare the exam

[@stephenmullennex2709]

Shon Harris, 11th Hour, Official (ISC)2, Sybex, Sunflower Notes, and lots of practice questions. Sybex, Pluralsite, Boson, Security Tutoring, etc.

[@pillz_wc]

Thanks for helping me pass first try! I’ve been sharing your videos around to all my colleagues and friends. Spock 🖖 vs Kirk FTW 🤓

[@peteryoungUSMC]

Another success story here, thank you for this video it was key.

[@Vmr48765]

Hi Max, i think im not able to read the question properly, so if the question says which of the following sites is best for an organization with propriatry equipment. I think that the equipment talked of here is the organization's equipment and not the eqipment of the DR site..so i understood it completely opposite to you. Even as per english it says organisation with propriatry equipment so wont it be the organization's equipment and not the DR site's equipment?

[@maxquasar]

Hi Vinay, thank you so much for your question. This question has been very tricky for people for the 20 years I have been asking it and maybe that is the problem! Today's Cloud Computing world has led to DRaaS providers and most organizations have either switched or in the process of switching to these solutions. So the terms Cold/Warm/Hot/Mirrored are in my experience, legacy designs. I created a video to explain this more. I hope you don't mind me mentioning you. Let me know if you object and I will remove any references. kzbin.info/www/bejne/nn3XdGxrfrJ7bqM Thanks again and may you and your loved ones Live Long & Prosper!

[@kingk789]

Thank you so much Larry!!!! Your methodology of taking exam was a critical piece to my success in passing the exam today.

[@gungho1984]

Hi Caleb. Congratulations! So glad you found it useful and thank you so much for sharing this. Live Long & Prosper!

[@tonyrobson1597]

The Kirk/Spock bit was brilliant, made me smile.

[@JohannGambolputty22]

I. Love. The way. Hendrix plays. LOL

[@rpsloss]

Taking the test this Friday - haven't gotten a single question here right. Anxiety = increased

[@Nkvijay]

Your videos are incredibly helpful for aspiring people. It helped me to get through the exams!

[@julianharrison9407]

A "resume generating event". Priceless :)

[@devonboling]

I appreciate the enthusiasm with which you delivered this content. It makes a huge difference on how much a student can retain from a teacher.

[@iyer_anoop]

I cleared it last Monday, your tips really helped.

[@rvinodh86]

Hello Larry - Thanks for your wonderful video. Fabulous explanation. I am an Info Security professional with 11 years of experience. I took the CISSP CAT 2018 exam day before yesterday after 4 months of tremendous hard work. Studied 8 hours per day for the last one week. I failed after getting 150 questions. It was a nightmare and I was really disappointed. I am trying to figure out where I could have gone wrong. I had known from people that the exam ends at 100 questions if it can determine with certainty that the candidate is above or below the passing standard. I do know of people who had their tests ended at 120ish questions and passed and the others failed at 120 odd questions too. When I crossed the 100th question, I knew I was not doing good enough for the computer to determine that I was above the passing standard. I decided not to lose my cool and answered every question patiently expecting that the exam would end at some point of time. After 125 questions, I seriously lost hope. It was like a roller coaster ride. It kept giving me questions that invariably had key words like "BEST", "MOST", "LEAST" and so on.. While I was able to eliminate 2 choices, it was really hard to narrow down on one. And I also feel like it kept hitting me on areas where I did not fare well. After attempting 150 questions, the test report said that I failed and provided me with a report that said I was above proficiency level in 4 domains and was near or below proficiency in the remaining 4 domains. One thing, I can say for sure was that the exam clearly determined the areas that I personally felt I was weak at. But there are certain confusing aspects that I need clarity on...… My questioning is merely in pursuit of understanding. Please enlighten me on the below 1. If the CAT could fail a person at 120ish and pass another candidate at 120ish, why does it throw 150 questions for a few?. Does that mean that I could have got the last 5 questions right and still passed ?? Was my answering so unpredictive that the algorithm was not efficient enough to determine my capability until the 150th question ? If yes, it contradicts with my testing report where it says I was near or below proficiency in 4 domains. Why does an algorithm have to wait till the1 50th question to finally determine I did not reach the proficiency in 4 domains ? 2. Can a candidate be below proficiency in 1-2 domains and still pass at the 150'th question ? I see people posting that they had 150 questions and came out thinking that they surely failed but passed to their surprise. Quite a gray area 3. If a candidate has cleared the exam at 100 questions, is it mandatory that he should have received all 25 unscored questions ? If yes, does it mean that of the 75 that were scored, he/she could have answered merely 70 percentage of them correctly(close to 50+ questions) and still passed ? If yes, this seems not ok. 4. The difficulty level of a question is relative. What is difficult to one could be easier to another. How does ISC2 determine that a question is difficult or easy. If ISC2 had a way to determine the set of difficult questions, the exam could throw only questions from the difficult pool to all candidates and determine if the candidate scores 70% of ISC2's difficult questions correct? That would be a much fair way. Why even give the easier ones ? I can read the Sybex 2018 edition twice before my next attempt, but I don't want this scaring experience again :-) You could choose to answer the above questions in public so it will be useful for everyone or you could respond personally on my email id [e-mail].

[@gungho1984]

I just sent you an email. My advice is to take my program (~_^)

[@nghibui6162]

have u tried again yet?

[@justinrauschuber5231]

I listened to this on my way to the exam center and it helped TREMENDOUSLY!!!! Thank you for the help!!

[@hackchoice8553]

One of the best CISSP videos, thanks a lot

[@letsgocapsbeatpens]

Why would you add in code before reviewing it?

[@maxquasar]

Hi, Thank you very much for your comment. can you help me understand where we may have misstated something? If there is a mistake, I hope we can fix it, if it has not already been addressed. Thanks again for the feedback.

[@thegreengeek]

Great Advice! I found this video helpful for (ISC)² CCSP certification as well. They used a lot of the same logic and wording on that exam.

[@punjabimitti]

Larry great tips. Watched it half and hour before exam, and many times before that too. Passed CISSP in first attempt. There were tough moments but your advise to keep focus on reading the questions and responses carefully and reading them twice helped me a lot. God bless.

[@Ghostrunner55]

I have my test today. and i wish I couldve found this video so early it wouldve changed the way I took my practice test

[@beny79kb]

Regarding the question: "Which of the following alternate sites would be best option for an or with proprietary equipment" -- wouldn't a mirror'd site be the best option considering proprietary equipment? Depending on the cissp resource used, some state that equipment would need to be delivered to the warm site. So if the company experiences a disaster at the main data-center, they may not have the ability to move proprietary equipment to the warm site. Thanks!

[@gungho1984]

Hi by79kb! The understanding with a Warm Site is that the organization may keep some equipment there. Since the question asks about proprietary equipment, without mentioning any recovery time objective, then the assumption would be that the Warm site is "better" than Mirrored Site since the Mirrored Site would cost a lot more. Does that make sense? It's kind of like with cabling; fiber optic is far more secure than unshielded twisted pair, but which is "better" for most operations?

[@beny79kb]

Yes sir -- thanks much for the reply and explanation! I'm still thinking too much in terms of technical "want" vs. org need.

[@kingtut6619]

CCCure is no longer free same with Cybrary. You get an intro with her, but then to continue you must pay. I loved your presentation. 🖖

[@zigzag230687]

Passed today thanks for the tips

[@rvinodh86]

I cleared the second attempt successfully and I am now a CISSP. Thanks for the video. Ignore my previous lament in the comments section :)

[@adityachachawa5421]

hi Vinodh can u shed some light what went wrong in the first attempt and what u changed for your second attempt , I too failed in my first attempt.

[@dashinganks]

Vinodh Kumar ...hi Vinodh...first of all many congratulations for your achievement...I am planning to start the preparation for CISSP...can you please guide me on materials and share your experience.. Thanks, Ankur

[@elvendarkness1]

Hello Larry, any suggestions for someone preparing to take the exam in May 2018...? Thank you very much in advance!

[@gungho1984]

Hello, I may be just a bit biased, but I hear my course is pretty useful. Are you looking to attend a live course? I teach live online and have a course pretty much every month. Please contact sales at internetworkdefense.com. I list a few other resources in this video at the end including Clement Dupuis' CCCure and the free course on Cybrary by the amazing Kelly Handerhan. Both are fantastic instructors as well. I just happen to be partial to my class (~_^)

[@zedzpan]

Thanks Larry for this. Very helpful advice.

[@choleighful]

I wish I could have Larry read my CISSP exam to me, great speaking voice. Anywho, thanks for the video it was a great help!

[@lincolnclark302]

Brilliant ....................... I was hooked by the way you deliver the content

[@alaarahhal2964]

Hello All , where are all ordered videos

[@SetasMushrooms]

Great video Max. Thanks for all the assistance. BTW, if you are burning your steaks, you really should think about taking a cooking class or two.

[@gungho1984]

I am not "burning" them. I am "searing" them. At least that is what I usually do, lol. Inside very rare. Thanks Chip!

[@PettingCatss]

"When do you feel testing is complete?" A - when there are zero vulnerabilities? B - when testing time runs out C - when the stake holders are pleased D - when testing criteria is met what is the asnwer to this question pleasse anyone. it came up on my test when i did not pass

[@GardoTheHardo]

I would say D because you're never going to have a system with absolutely 0 vulnerabilities, it might have 0 known vulnerabilities but that doesn't mean it is necessarily secure. I wouldn't say C because the stakeholders would not be involved that heavily in the implementation of a new software or system so that sound illogical to me. So I would narrow it down to B and D. When testing time runs out is a very viable answer. When implementing a new system ot software or resource there is going to be a timeline or schedule that needs to be met however, will management really implement a system that hasn't had ample testing, patching and validation? Probably not so final answer for me would be D.

[@natasyaadam2672]

Eupharia..what was your answer?

[@songofyesterday]

31:06 is hilarious.

[@Vv-xm6cw]

Larry can you help me with the spock question? My initial thought was C bc RSA is asymettric which is large primes but after I re read it seems like the question really is "hey these quantum things are gonna break our current encryption" so to me the answer is A. Ultimately, they are trying to reduce risk by mitigating attacks using these new lattice algorithms. Your explanation said A is incorrect because it is symmetric.. what about A is symettric? Thanks

[@gungho1984]

Hi Vin, sorry for the delay in getting back to you. The reason A should be assumed to be Symmetric is the words "Data Encryption". Recall that Data is encrypted Symmetrically and the integrity is checked with a Hash. Asymmetric systems are then used to Agree on the Symmetric Key (session key agreement/sharing) and to Authenticate the Hash (signing). While one could argue that the symmetric key and the hash could be looked at as a type of data, that is not usually how the term is applied.

[@billclancy4913]

Great advice!

[@tonyp4914]

How do we sign up for this class... And how much does it cost?

[@ChanRuns]

Hi Larry, how is monitoring Due care and not due diligence?

[@aulderyan]

Because due care is ongoing action, and due diligence is more "one time" research type stuff. Monitoring definitely is ongoing and action oriented.

[@Cars1Gunz1and1Weights]

Spock and Kirk analogy....priceless

[@SavageScientist]

22:43

[@seitnasir6072]

👍👑❤