Hi Everyone, I Passed the CISSP exam on Saturday. I attempted the exam in April 2024 but did not pass. Before now I used the following study materials - Official Study Guide (OSG) 9th edition, Sunflower, Luke Ahmed's How to think like a manager, ISC2 official exam prep and few you tube videos by Andrew Ramdayal. Preparing for this attempt, I joined the CISSP Skool Community where I gave me access to all the CISSP test questions and answers with explanation posted by Vincent and most importantly I joined the daily collaborative learning link where I was privileged to study alongside folks like Ed, Matthew, Ricardo, Pavithra, Aidah. Vishal, David, Babar, Emma and others using numerous question banks. I believed this helped me expand my learning and sharpening my exam mindset. I found this write up for my last minutes study - Cleared For Wealth | Break into defense contracting and build real wealth in IT as posted by Chiru. I really appreciate everyone that has helped me accomplish this milestone, especially to Vincent for running such a wonderful platform.

I am pleased to share that I passed the CISM exam on my second attempt last night! I couldn’t clear the exam on my first attempt, missing the passing score by just 9 points (441 against the required 450). Having passed the CISSP exam on my first attempt, I was perhaps overconfident and appeared for CISM without adequate preparation. That experience taught me an important lesson: success in one certification does not guarantee success in another, as each exam requires a different mindset and preparation strategy. In my experience, the CISM mindset is somewhat different from that of the CISSP. CISM places greater emphasis on information security governance, risk management, and aligning security with business objectives, rather than focusing primarily on technical security controls. My preparation resources included: - CISM Exam App by Vincent — special thanks to Mr. Vincent for this valuable resource. - Destination Certification CISM App - CISM Review Manual and old QB available to me in book form. - Selected CISM videos by Parab, Peter Zerger, and the 100 CISM Questions video. Interestingly, only around 10–15% of the questions seemed familiar from my first attempt. My experience suggests that the CISM question bank is dynamic, with a different mix of questions appearing in each exam. Therefore, relying on memorization alone is not a reliable strategy; understanding the concepts and developing the right CISM mindset are essential. My key takeaway: Prepare thoroughly, focus on governance and risk management, understand the reasoning behind the answers, and never underestimate the exam.

A regional bank's outsourced SOC closes most alerts as false positives, and analysts now mute noisy rules to hit response targets before a regulator exam next month. What should the security operations manager do FIRST? A. Tune the noisy rules to cut false positives B. Assess which muted rules covered risks the bank must detect C. Add analyst headcount to meet targets without muting D. Reinstate every muted rule before the exam (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A bank acquired a firm whose file shares hold 20 TB of unclassified data. Integration wants it in the bank's cloud tenant in 30 days, with a regulator exam next quarter. What should the security manager do FIRST? A. Migrate it under the bank's default classification B. Inventory and classify the data and assign owners C. Encrypt the shares in place until the exam ends D. Apply the bank's retention schedule and purge first (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Auditors found 400 active accounts for contractors whose engagements ended. Forty agencies supply staff, nobody owns their access lifecycle, and the business wants contractor single sign-on next quarter. What should the security manager do FIRST? A. Disable the 400 accounts and notify the agencies B. Assign an owner and define the contractor access lifecycle C. Extend single sign-on with mandatory MFA to contractors D. Schedule quarterly access reviews for contractors (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!