I started as a network engineer and later became a penetration tester. Over the years, I gained a lot of technical experience and passed many technical certifications. But as I worked longer, I slowly understood that products and technology alone cannot really solve a customer’s security problems. This is why I decided to take on the CISSP challenge. My three months of preparation not only helped me pass the exam, but also changed the way I learn and think about my work. In this article, I will share my full preparation journey and what I learned. I hope it can help you if you plan to take this exam in the future.
Introduction｜My Background#
I started my career in system integration (SI). I worked as a network engineer for four years, mainly building and maintaining company networks. After that, I worked as a security solutions engineer for five years. In this role, I helped customers set up different security products and reviewed their network designs. For the last year and a half, I have worked as a penetration tester. I look at company defenses from an attacker’s point of view to find weak points.
Along the way, I earned many technical certifications, such as CCNP, PCNSE, NSE7, CEH, and OSCP. So my technical background is quite strong. However, working for a vendor company taught me something important. Some customers bought expensive security products but did not really become more secure. Some customers knew they needed better security but could not afford it. Others had no real plan or management process, so the products they bought were never used well. These experiences showed me that security cannot rely on technology alone. Good management and good processes are needed to solve the real problems.
Preparation｜My Study Process#
My coworkers strongly recommended a course, so I joined WUSON CISSP Class. I gave myself three months to prepare, and I studied about three and a half hours every day on average. But everyone’s background and family situation is different, so the time you need may be different too. My study time is just for reference. You can change it based on your own situation.
Here are the resources I used to prepare for the exam:
WUSON WPF Question Bank (a question bank made for WUSON students)
CISSP CBK Reference (the “big dictionary” of CISSP)
QUANTUM EXAMS (a question bank many people recommend on Reddit)
How To Think Like A Manager for the CISSP Exam (to build a “manager mindset”)
AI tools, such as ChatGPT, Gemini, and NotebookLM (to help organize notes and explain hard, old-style writing in the study material)
Google search (to find real-world examples)
If you feel that buying all these books is too much, and you plan to take CISM or other certifications later, you could think about a one-year subscription to O’reilly. But the price is not low, so please check if it is worth it for you.
I am a person who feels sleepy as soon as I open a textbook. So my study style is more like doing practice questions first, then going back to review the content. By doing questions, I can find out what I do not understand, and then fix those gaps. This way is more efficient for me.
In the first month (June 2025), I mainly followed the course lessons. I got familiar with the teacher’s mind maps, term definitions, and the order of different processes. This stage was more about building a foundation, so I could have a full CISSP framework in my mind.
In the second month (July 2025), I started to practice OPT questions a lot. I also did WPF practice tests every weekend, and did one question from Think Like A Manager every day. After each set of questions, right or wrong, I reviewed every question and wrote notes to fill in what I did not know. If I could not understand an explanation, I searched Google for examples. For example, I had never managed a database, so I did not understand database normalization. Even after reading the term definitions and question explanations, it was still not clear. So I searched online and found a helpful example that solved my confusion. Actively searching for answers or testing things by hand is very useful for fast learning. Once you search for a real example or try it yourself, you are much less likely to forget it.
In the third month (August 2025), I focused on reviewing the CISSP exam outline. I checked one by one if I understood every term in the outline. If I found a term I did not know well, I went back to the OSG book. If the OSG explanation was not clear enough, I checked the CBK book for more details. During this time, I also kept practicing OPT questions and kept reviewing my wrong answers, to make sure I really understood each topic.
In the final push (September 1 to September 13, 2025), I raised my OPT accuracy to over 90%. I focused on the topics I was least familiar with. At this point, I was no longer trying to do a huge number of questions. Instead, I focused on making my knowledge solid.
During my preparation, I also set flexible rules for myself. When I felt tired, I stopped and rested, then continued studying when I had more energy. This kept my study efficiency from dropping. Also, every time I reached a small milestone, I gave myself a reward, like watching 30 to 60 minutes of TV. This helped me stay motivated during the long preparation process.
But the whole process was not always smooth. My biggest challenge was that I kept forgetting things and felt like I was not making progress. This was especially true in August. Even though I spent a lot of time every day, I still felt stuck. To break through this, I used RemNote to make flashcards, focused on the topics I did not know well, to help my memory. Also, while practicing WPF scenario questions, I slowly learned how to find key words in the question. I learned how to answer based on what the question was really asking, and my scores started to go up again.
While preparing for CISSP, I heard many stories of success and failure from other people. One tip I heard was to study CISSP together with a group. It is hard to find your own weak points alone, and searching for information alone takes more time. But when you study with a group, you can discuss with each other and learn different ideas and knowledge that you may not know. So when you really have a hard time, do not just struggle alone in silence. Instead, actively ask for help. When I found a concept I did not understand, I checked the OSG or CBK books. If I still could not fully understand it, I discussed it with my classmates (Bruce, Fungi, Allen, Hung-Ming, Steven, Chang-Chun, Jeremy, Ken). I also asked AI, searched online, or even asked my coach or coworkers who had already passed the exam. This way, I could replace “memorizing” with “understanding.” Preparing for CISSP is never about memorizing every fact word by word. It is about learning how to think and judge things the right way.
It is also worth mentioning that I chose to take the Simplified Chinese version of the CISSP exam. Simplified characters and different sentence patterns can feel strange at first. To get used to this, I used the Immersive Translate tool when doing practice questions. It changed the questions into Simplified Chinese, so my brain slowly got used to it. This method worked very well. It helped me feel less nervous about the language on exam day.
Exam Experience｜Exam Day#
On exam day (September 15), I arrived at the test center thirty minutes early. I knew that my emotions could affect my performance, so I reminded myself to stay happy. I quietly told myself: “In three hours, I will pass the CISSP exam!” This small pep talk gave me confidence when I walked into the exam room.
When I saw a question I did not know, I told myself not to panic. ISC2 has said that 25 questions on the exam do not count toward the score. So I just assumed that any hard question was one of those 25, and stayed calm to keep answering. As for pacing, since questions can be short or long, my rule was to finish at least 40 questions every 30 minutes, to make sure I would not run out of time.
Here I want to give a special reminder: no matter how many practice questions you do, you should know ahead of time that the real exam questions will almost never be exactly the same as your practice questions. Instead of hoping for “luck” to see a question you already practiced, it is better to assume every question is brand new. This way, during the exam, you can focus on “understanding and judgment,” instead of worrying about “have I seen this question before?”
There is also a small detail worth mentioning: test takers enter the exam room in the order they check in. So arriving early is important. Also, I heard that the NDA signing screen has a time limit. Do not stay on that screen too long after you open it, or you may fail the exam because of a timeout.
Thoughts and Summary After the Exam#
While learning for CISSP, my way of thinking at work changed a lot. In the past, when I found a vulnerability, I focused on the technical fix. Now, I first talk with the customer about how the vulnerability really affects their business, and then give the best fix advice. This way fits the customer’s needs better, and customers accept it more easily, because it really solves the problem they care about.
CISSP covers a very wide range of topics with clear logic. It would be a waste to just rush through it only to “pass the exam.” If you spend so much time preparing but do not truly absorb the knowledge, you lose the most valuable part. I truly recommend not treating CISSP as just a certificate. Try to really understand the knowledge inside it, because it will not only help you pass the exam, but also bring long-term value to your real work and decisions.
My attitude toward learning also changed a lot. In the past, when I took certification exams, I mostly just wanted to “get the paper,” so I passed by memorizing old exam questions. But after preparing for OSCP and CISSP, I started to truly enjoy the learning process. I even felt happy when I finally understood a topic I did not know before. This made me realize that a certificate is just a side product. The real value comes from constant growth over time.
Another thing I gained is that, during the preparation for these two certifications, I found a study method that works well for me. This means that even after the exams, when I face a new field of knowledge, I can get up to speed faster. In other words, these certifications are not just titles. They are a method that keeps helping me learn and grow.
For anyone preparing for CISSP in the future, here are four tips:
Find good study partners who share the same goal, and work together.
Build the overall knowledge framework first, then go into details step by step, because the CISSP exam tests breadth more than depth.
Practice questions are important, but do not just do them blindly. Use questions to deepen your understanding of concepts and build your thinking logic.
Remember this exam focuses on scenario judgment. The best answer is often not the most technically perfect one, but the one that best fits the situation in the question.
Looking back on this journey, I believe even more that every step leaves a mark, and no effort is ever wasted. I hope that if you take on this certification in the future, you keep building your knowledge, learn to think the right way, and pass the CISSP exam successfully!
Finally, please remember that passing the CISSP exam does not mean you already have the certification. There is still an endorsement process you need to complete.