All-in-1 / CISSP All-in-One / Harris / 5712-1
ch01.indd 3ch01.indd 3 8/9/2005 2:10:44 PM8/9/2005 2:10:44 PM
3
Chapter 1: Becoming a CISSP
Because the CISSP exam covers the ten domains that make up the CISSP CBK, it is
commonly described as “an inch deep and a mile wide”; meaning that the questions
are not necessarily very detailed in nature and do not require you to be a super expert
in each and every subject. However, the questions do require you to be familiar with
many different subjects within the security arena.
The CISSP exam is made up of 250 multiple-choice questions, and you are given up
to six hours to complete it. These questions are chosen from a large question bank to
ensure that the exam is as unique as possible for each person. The exam bank con-
stantly changes and evolves in order to reflect the real world of security. Exam questions
are rotated and replaced in the bank as the need arises. Each question has four choices
with only one correct answer. Only 225 questions are scored; the remaining 25 ques-
tions are included for research purposes only. These 25 questions are not distinguished
from the questions that will be scored, so you will not know which questions are count-
ed toward your overall grade. To pass the exam, you must obtain a minimum raw score
of 700 points. Each question is weighted based on its level of difficulty, and not all
questions are worth the same number of points. The exam is not product- or vendor-
oriented. In other words, you will not be asked questions specific to Windows 2000,
Unix, or Cisco, for example, but you will be tested on the security models and method-
ologies used by these types of systems. As of this writing, the exam fee is $499 for early
registration, and $599 if registering within 16 days of the exam.
The International Information Systems Security Certification Consortium (ISC)
2
credential process changed in June 2002. Now to obtain this credential, you must have
a sponsor who will vouch for your years of experience. Taking the exam is the first step,
and obtaining certification is the second step. As noted earlier, to qualify to take the
CISSP exam, you must have either four years of direct full-time security professional
work experience in one or more of the ten domains that make up the CBK, or a combi-
nation of a college degree and three years of direct full-time security professional work
experience in one or more of the ten domains. The experience does not have to be con-
tinuous, but rather can be spread out over some time. After passing the exam, you will
be asked to supply documentation, supported by a sponsor, proving that you indeed
have this type of experience. The sponsor will have to sign a document vouching for the
security experience you are submitting. The sponsor can be either an existing CISSP in
good standing or a manager that you report to or have reported to in the past.
The sponsorship requirement helps to ensure that someone who achieves the certi-
fication has real-world experience to offer companies. Book knowledge is extremely
important for understanding theory, concepts, and standards and regulations, but it will
never take the place of real, hands-on experience. The requirement to prove that you
have practical experience upholds the value and relevance of the certification for both
certificate holders and potential employers. A small sample group of individuals selected
at random will be audited after passing the exam and supplying the experience informa-
tion. The audit consists mainly of individuals from (ISC)
2
calling sponsors and other
contacts supplied by the CISSP candidate to verify the experience provided is in fact real.
What makes this exam challenging is that most candidates, although they work in
the security field, are not necessarily familiar with all ten CBK domains. If a security
snaking1232013-06-07第三版，内容比较旧
shmiroly2013-01-05很清晰,就是版本舊了點
jingji992013-01-08可惜是英文版的，貌似也不太全
