A CISSP Exam on a National Holiday: Lessons from a Career Changer

This post was written with one of our students, who passed CISSP after moving from administration into information security. We’ve shared the story in their own voice, adding some background and explanation that may help other candidates.

My CISSP exam was booked for the morning of a national holiday. While everyone else was sleeping in, planning trips or heading to see family, I was setting an alarm, checking my ID for the third time and taking the empty streets to the test centre. It felt odd at the time. Now I think it fits: CISSP is a slightly unusual exam, and I took it on a slightly unusual day.

It’s one of the most memorable international exams I’ve sat so far. I want to write down what it was like — the good, the strange and the moments that caught me off guard — for anyone who is still preparing.

From administration to information security

Some background first. I didn’t begin in IT. For years I worked in administration: scheduling, documents, procurement, coordinating between departments and keeping the office running. About a year ago I moved into information security.

People often ask whether that move was a shock. Some of it was, of course. I had to learn about networks, encryption and attack techniques from scratch. But my admin background helped more than I expected. A lot of security work is about process, documentation, policy and getting people to follow rules — things I’d been doing for years under another name. When I first read about security governance, asset management or vendor contracts, I recognised many of the ideas straight away.

In my first year I worked through several international certifications to build a foundation and prove to myself (and my employer) that I could do this:

• ISO/IEC 27001:2022 Lead Auditor, which taught me how an information security management system is structured and audited
• EC-Council Certified Incident Handler (ECIH), which gave me the hands-on view of detecting, containing and recovering from incidents
• IPass (beginner and intermediate levels), which filled in a lot of the basic technical knowledge I was missing

Each one gave me a piece of the puzzle. CISSP was the exam that asked me to put all the pieces together.

Exam day: being watched like a prisoner (in a good way)

If you’ve only taken online or classroom tests, the security at a CISSP test centre can feel a bit much. I knew in theory that it would be strict. In practice, it really did feel like being watched like a prisoner for a few hours. It’s a strange feeling, even though you know you’ve done nothing wrong.

Here’s what stood out to me:

• Everything goes in the locker. Your phone, watch, wallet, bag, notes and snacks all stay outside. You walk into the exam room with your ID and nothing else.
• You can’t take your phone to the restroom, even before the exam starts. I went to use the restroom while waiting to check in and was told my phone had to be locked away first. It seemed excessive in the moment, but the logic is simple: a phone in a restroom stall could mean a phone with notes, or someone sending exam content out.
• Check in first, then use the restroom. The centre wanted me registered and identified before I went anywhere. Once the exam has started, every break is signed in and out, and you’re identified again when you come back.
• Identity checks are serious. Expect a photo, ID verification and, at many centres, a biometric scan. Don’t be surprised if you’re asked to turn out your pockets or roll up your sleeves.
• Breaks come out of your exam time. The clock keeps running while you’re away, so plan your water and coffee intake accordingly.

None of this is meant to make you feel like a suspect. It protects the exam’s integrity, and that protects the value of the certificate you’re working so hard for. There’s also some irony in it: the whole experience is a live demonstration of physical security, access control and monitoring — exactly the topics you’re about to be tested on.

My advice: arrive early, read the candidate rules ahead of time, use the restroom after check-in but before you start, and accept that the rules are the rules. If everything goes smoothly, that’s all that matters.

About the Exam

I prepared very thoroughly for this exam. I read the official materials, made notes for each domain, and worked through a large number of practice questions until I was getting consistently good scores. Spatially, the SPOTO CISSP Dumps helped me practice the real questions, so I walked in feeling confident.

An experience: in the exam, you had to change how you were thinking. A few things helped me recover:

1. Think like a manager, not a technician. CISSP is written for people who advise organisations and make risk decisions. The best answer is usually the one a senior security leader would choose: protect people first, align with business goals, follow policy and get management involved — not the clever technical fix.
2. Read the last line of the question first. Knowing whether it asks for the first step, the best control or the primary purpose changes how you read the scenario.
3. Rule out answers that are true but irrelevant. Many options are technically correct statements. They just don’t answer what was asked.
4. Don’t panic about difficulty. The English CISSP exam uses Computerized Adaptive Testing (CAT). The questions adjust to how you’re performing, so if they feel hard, that may well be a good sign.

One more thing to know about CAT: you can’t skip questions or go back to change your answers. Once you submit, it’s done. That was hard for me at first because I like to review. But it also meant I couldn’t waste time second-guessing myself. I answered each question as well as I could and moved on.

The exam ended at around question 120, and I had scraped by. I won’t pretend it felt comfortable — when the screen went blank I honestly didn’t know which way it had gone. Seeing the pass result was one of the best feelings of my year.

A quick note on format for anyone new to it: the English CAT version is currently 100 to 150 questions over a maximum of three hours, and the exam stops once the system is confident about your result. Finishing early or late doesn’t tell you whether you passed, so don’t read anything into it while you’re sitting there.

Four things I wish I’d studied more carefully

Looking back, these were the areas that came up in ways I didn’t fully expect. If you’re preparing now, make sure you understand them, not just remember them.

1. Voluntary versus mandatory requirements

This sounds simple, but the exam tests it in subtle ways. You need to know which documents and obligations an organisation must follow and which are recommended.

Inside an organisation’s security documentation:

• Policies are mandatory, high-level statements from senior management.
• Standards are mandatory and specific (for example, “all laptops must use full-disk encryption”).
• Baselines are mandatory minimum configurations.
• Procedures are mandatory step-by-step instructions.
• Guidelines are recommended, not required. They offer advice and flexibility.

Outside the organisation, the same idea applies. Laws and regulations are mandatory where they apply. Contractual requirements such as PCI DSS become mandatory once you’ve agreed to them. Frameworks like the NIST Cybersecurity Framework are generally voluntary unless a law, regulator or contract makes them required. Pay attention to wording too: “must” and “shall” signal a requirement, while “should” and “may” signal a recommendation.

In a scenario question, getting this right is often what separates two answers that otherwise look equally good.

2. BCP, DRP, BIA and the other kinds of analysis

This is the area where I felt most confused during the exam. The terms are related, and the questions are designed to test whether you can tell them apart.

• Business Impact Analysis (BIA) identifies critical business processes and what happens if they stop. It’s where values like Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO) come from.
• Business Continuity Planning (BCP) is about keeping the business running during and after a disruption — people, processes, facilities and communication, not just IT.
• Disaster Recovery Planning (DRP) is narrower and more technical. It’s about restoring IT systems, data and infrastructure after a disaster.
• Risk analysis looks at threats, vulnerabilities and likelihood to decide which risks to treat and how. It can be qualitative (high/medium/low) or quantitative (SLE, ARO, ALE).
• Incident response deals with specific security events. It may trigger the BCP or DRP if an incident becomes serious enough.

Know the order of activities as well. The BIA comes before the continuity plan, because you can’t plan recovery until you know what matters most. Also remember that RTO must be shorter than MTD, or the business won’t survive the outage. When a question asks what to do first, the answer is often “get senior management support” or “perform a BIA”, not “build a hot site”.

3. What each layer of the OSI model is for

I thought I knew the seven layers because I could recite them. But the exam didn’t ask me to list them. It asked me to apply them: which layer does a protocol work at, which device operates there, which attack targets it, and which control would help.

A quick reference:

Go one step further and connect the layers to security: a SYN flood targets layer 4, ARP spoofing is a layer 2 problem, a packet-filtering firewall works mainly at layers 3 and 4, and a web application firewall works at layer 7. Once you understand the purpose of each layer, these questions become much easier to reason through.

4. Laws and regulations from other countries

This surprised me the most. I got several questions about regulations from other countries, and at first I couldn’t see how they related to the exam at all. I’m not working under those laws, so why test me on them?

Afterwards, it made more sense. CISSP is a global certification, and security professionals work for organisations that store data across borders, use overseas cloud providers and serve international customers. The exam isn’t testing whether you can quote a foreign law. It’s testing whether you understand the ideas behind it: data privacy, breach notification, jurisdiction, transborder data flow and intellectual property.

You don’t need to be a lawyer, but you should recognise the major examples and what they’re broadly about — for instance GDPR for personal data in the EU, HIPAA for health information in the United States, SOX for financial reporting and GLBA for financial institutions. When you see a question about a law you don’t know well, fall back on the principles: protect personal data, respect the strictest applicable requirement, involve legal counsel and follow due care.

Final advice for anyone preparing

If I could go back and talk to myself a few months before the exam, here’s what I’d say:

• Understand concepts, don’t just memorise them. Practice questions are useful, but only if you understand why each answer is right or wrong.
• Practise scenario questions specifically. Get used to choosing the “best” of several good answers.
• Keep the manager’s mindset. People’s safety comes first, then business needs, then technology.
• Know the exam-day rules ahead of time so nothing at the test centre throws you off.
• Look after yourself. Sleep well the night before and eat something before you go. Three hours is a long time to concentrate.
• Use your background. Whatever you did before security — admin, finance, development, operations — it gives you a perspective the exam values. Don’t think of it as a gap.

Taking an exam on a public holiday wasn’t how I imagined celebrating. But walking out of the test centre with a pass, into a quiet holiday morning, is a memory I’ll keep for a long time.

To everyone still on the road to CISSP: prepare thoroughly, stay calm when the questions surprise you, and trust what you’ve learned.

Good luck!

Please follow and like us: