How I Passed the CISSP Exam After 9 Months of Study
Passing the CISSP (Certified Information Systems Security Professional) exam is no small feat. It’s known for its breadth, depth, and ability to test not just your knowledge but your practical understanding of cybersecurity. After nine months of intense preparation, I’m thrilled to say I’ve joined the ranks of CISSP-certified professionals! Here’s how I did it, the resources I used, and some tips to help you on your journey.
My Study Plan
1. Set a Realistic Timeline
From the outset, I knew this wasn’t a sprint—it was a marathon. I gave myself 9 months to study, breaking the material into manageable chunks. Each month focused on specific domains, and the last two months were dedicated to review and practice exams.
2. Create a Daily Routine
Consistency was key. I set aside 1–2 hours every day, alternating between reading, watching videos, and taking practice quizzes. Sticking to this routine helped me build momentum and stay on track.
3. Practice Makes Perfect
I can’t stress enough the importance of practice questions. They not only test your knowledge but also train you to think the way the CISSP exam does—focusing on management and risk-based decisions.
Resources That Helped Me Succeed
There are countless CISSP resources out there, but these were my go-to tools:
-
CISSP Study Group
A fantastic online community of fellow CISSP aspirants. The forums are filled with discussions, tips, and insights that kept me motivated and informed. -
Pocket Prep CISSP App
This app was a lifesaver for on-the-go study sessions. It offers hundreds of practice questions and detailed explanations that are perfect for quick reviews. -
LearnZapp CISSP App
Another excellent app for mobile learning. It helped me focus on weaker areas by tracking my progress across domains. -
CISSP Exam Cram on YouTube
This video is a concise and high-yield review of key topics. I watched it multiple times during my final review phase. -
CISSP All-in-One Exam Guide (9th Edition) Audiobook
A comprehensive resource that covers every domain in detail. The audiobook format allowed me to learn while commuting or doing chores, making study time more efficient.
What Worked for Me
1. Focus on Understanding, Not Memorization
The CISSP exam isn’t about rote memorization; it’s about applying concepts to real-world scenarios. I made sure to understand the “why” behind every concept and its implications in a business context.
2. Master the Domains
The CISSP exam covers eight domains. I tackled each one systematically, ensuring I had a solid grasp before moving on:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
3. Simulate the Exam Environment
Taking full-length practice exams under timed conditions was crucial. It helped me manage time effectively and get comfortable with the exam format.
The Hidden Gem: CISSP Study Group
One of the most invaluable resources in my CISSP journey was the CISSP Study Group (visit here). This free, open-to-all community was a game-changer. Preparing for the CISSP exam can feel like an uphill battle, but being part of a group of like-minded individuals striving toward the same goal made all the difference.
What sets this study group apart is the emphasis on comprehension over memorization. Through collaborative discussions, real-world application scenarios, and peer support, I gained a deeper understanding of the material. It wasn’t just about learning to pass an exam—it was about absorbing knowledge that I could carry into my career.
This community became the final, essential piece of my preparation puzzle. It pushed me to think critically, solidified my grasp of the concepts, and gave me the confidence to tackle the exam. If you’re on the path to CISSP certification, I can’t recommend this hidden gem enough. Sometimes, the best way to learn is in the company of others.
Lessons Learned
Looking back, I wish I had started taking practice exams earlier in the process. They’re invaluable for identifying weak spots and reinforcing concepts. That said, the nine-month journey taught me discipline, focus, and a lot about myself.
Final Thoughts
Passing the CISSP exam is a challenging but incredibly rewarding experience. It requires commitment, perseverance, and the right resources. If you’re preparing for the CISSP, remember that you’re not alone—lean on the community, leverage the tools available, and believe in your ability to succeed.
To everyone on this journey: good luck! You’ve got this. And when you’re certified, take a moment to celebrate—you’ve earned it. 🎉
AI Usage Transparency Report
AI Era · Written during widespread use of AI tools
AI Signal Composition
Score: 0.3 · Moderate AI Influence
Summary
Passing the CISSP exam is a challenging but rewarding experience. It requires commitment, perseverance, and the right resources.
Related Posts
Setting up Ollama on macOS
Recently, after some bad experiences with OpenAI's ChatGPT and CODEX, I decided to look into and learn more about running local AI models. On its face it was intimidating, but I had seen a lot of people in the MacAdmins community posting examples of macOS setups, which really helped lower the bar for me both in terms of approachability and just making me more aware of the local AI community that exists out there today.
AI Agent Constraints and Security
I really feel like in this era of AI it's essential to write about and share experiences for others who are leveraging AI, especially now that AI usage seems almost ubiquitous. Specifically, when it comes to AI in development and the rapid growth of AI-driven automations in the IT landscape, I believe there's a need for open discussion and exploration.
Vibe Coding with Codex: From Fun to Frustration
So there I was, a typically day, a typical weekend. As a ChatGPT customer, I had heard good things about Codex and had not yet tried the platform. To date my experience with agentic coding was simply snippit based support with ChatGPT and Gemeni where I would ask questions, get explanations and support with squashing bugs in a few apps that I work on, for fun, on the side. There were a few core features in one of the apps I built that I wanted to try implementing but the...
Turn Jamf Compliance Output into Real Audit Evidence
Most teams use Apple’s macOS Security Compliance Project (mSCP) baselines because they scale and they’re repeatable. Jamf’s tooling makes deployment straightforward and the Extension Attribute (EA) output is a convenient place to capture drift. What you don’t automatically get is the artifact an auditor will accept on a specific date—an actual document you can file that shows which endpoints are failing which items, plus a concise roll-up of failure counts you can act on. Smart Groups answer scope; they don’t produce evidence.
Secure Software, Secure Career: How I Passed the CSSLP
After passing the CISSP earlier this year, I decided to follow it up with the **Certified Secure Software Lifecycle Professional (CSSLP)** certification. For those unfamiliar, CSSLP is an ISC2 certification that focuses specifically on secure software development practices across the full SDLC—from requirements and design to coding, testing, deployment, and maintenance. My goal in pursuing this certification was to further develop my skills in ensuring the security of software throughout its entire lifecycle.
Good Cybersecurity policies, procedures, guidelines take time. They're not rushed and aren't rubber stamped
Cybersecurity is no longer a luxury or an afterthought—it's an absolute necessity. But how can you tell if the company you work for, as a security professional, truly values cybersecurity? Let's explore some clear indicators that demonstrate a company's commitment to implementing robust security practices in-house. A genuine commitment will be reflected in the organization's policies and procedures, which should be regularly reviewed and updated to address emerging threats.
Managing Bring Your Own Device (BYOD) for Android with Microsoft Intune
Alright, so today we're going to be talking about the management of bring your own device BYOD for Android devices. There's a lot of information out there for the management of iOS devices and you can do that with pretty much any Apple MDM on the market. We just happen to use Jamf where I work, but you could use anything from Braavos to SimpleMDM to Kanji or JumpCloud. Mosyle is also a great option.
BYO with me in 2025: iOS with User Enrollment in JAMF Pro
It really depends on your company's needs. For example, many companies need to hire 1099 contractors and in such a case they come with their own devices but not the correct security settings or enforcements. Remember BYOD is a security construct. The idea here is that you should be securing the company's sensitive data in all forms. This may involve implementing policies for contractor-owned devices, ensuring that all devices accessing company data meet minimum security standards, and regularly reviewing and updating these standards to stay ahead of emerging threats.
Securing BYOD Email Access: Exploring Strategies in Microsoft 365
In today’s mobile-first world, organizations increasingly rely on Bring Your Own Device (BYOD) programs to empower employees while optimizing costs. However, this flexibility introduces unique challenges, particularly around securing email access. To mitigate risks, we are implementing a comprehensive strategy to block email access on non-company devices by default and ensure only sanctioned apps can access organizational email accounts. This approach will help prevent unauthorized access and data breaches, aligning with our commitment to maintaining the security and integrity of company communications.
Enhancing Cybersecurity on macOS: Empowering Users for a Safer Digital Journey!
macOS has earned a strong reputation for built-in security, but the real value of the platform is not just that protections exist. It is that Apple continues pushing the operating system toward more context-aware security decisions that help users make better choices before a problem becomes a breach. This approach allows users to understand and mitigate potential risks in real-time, rather than simply reacting to threats after they've occurred.
