While preparing for CISSP, I became quite comfortable with questions.
I worked through almost 6,000 practice questions.
Over time, that volume gave me confidence. I started recognising patterns, understanding what the question was looking for and, more importantly, becoming comfortable with eliminating options.
But the actual exam taught me something I hadn’t fully appreciated during preparation.
Sometimes, finding the right answer isn’t where the battle starts.
The battle starts with getting rid of the wrong answers.
Some options are easy to eliminate.
They look completely out of place. They don’t fit the scenario, don’t address the requirement or are simply irrelevant.
Those are the easy ones.
The difficult ones are different.
They can look technically correct.
They can even be something I would consider doing in a real-world situation.
But they may be indirectly irrelevant to what the question is actually asking.
That was something I gradually became better at during my preparation.
I stopped looking only for the answer that sounded right.
I started paying much more attention to the answers that didn’t belong.
If I could confidently eliminate two options, the question became much more manageable.
But then I realised something else.
Eliminating two wrong answers is only half the battle.
Getting from four options down to two is an art.
But selecting the one answer that actually serves the purpose of the question is another art altogether.
Sometimes both remaining answers can be technically correct.
Both may be things you could genuinely do in a real-world situation.
But the question isn’t necessarily asking what could be done.
It is asking what best serves the purpose of the scenario.
That is where I had to slow down and look beyond the individual answer.
What is the objective here?
What is the situation actually trying to achieve?
Which of these two answers addresses that objective?
Which one fits the context better?
Which one is appropriate at this point?
That final selection became just as important as the exclusion itself.
Eliminating the wrong answers is one skill. Selecting the right answer for the right purpose is another.
And I realised that the second part requires judgement, not just knowledge.
This was particularly interesting for me because of my professional experience.
My natural instinct can sometimes be technical.
I see a vulnerability, I think about remediation.
I see a security gap, I think about the control.
I see a problem, I think about how to fix it.
But a CISSP question can make you step back from that instinct.
Sometimes the technically attractive answer isn’t the best answer for the situation.
Sometimes it is the right action, but not the right first action.
Sometimes it belongs to someone else.
Sometimes it addresses the symptom rather than the actual requirement.
And sometimes it simply doesn’t serve the purpose of the question.
The more questions I worked through, the more I started noticing these differences.
And honestly, the questions I got wrong were probably more valuable than the questions I got right.
When I got an answer wrong, I didn’t want to simply remember the correct option.
I wanted to understand why my thinking took me in the wrong direction.
Was I too technical?
Did I miss something in the scenario?
Did I choose something that was correct but not the best answer?
Did I overlook an option that should have been eliminated?
Or, after narrowing it down to two, did I fail to recognise which one actually served the purpose better?
That process gradually changed the way I approached questions.
The 6,000 questions didn’t give me 6,000 answers to memorise.
They gave me thousands of opportunities to make mistakes, review them and understand my own reasoning.
And that became much more useful when I finally sat for the actual exam.
The first 30 questions were a completely different experience.
I had walked into the exam with confidence.
But those first 30 questions broke that confidence.
They didn’t feel like the practice questions I had worked through.
I started feeling underprepared.
It took me around 50 minutes to get through those first 30 questions.
For a while, I was thinking about the exam rather than answering the exam.
Then I had to reset myself.
I stopped looking for familiarity.
I stopped thinking about whether I was doing well.
I went back to what I had practised—read the scenario, understand what was being asked, eliminate what didn’t fit and then make the best decision I could.
Something changed after that.
The next 70 questions took around 60 minutes.
I had found my rhythm again.
And that experience made the value of exclusion even clearer to me.
You don’t always need to immediately recognise the correct answer.
Sometimes you need to recognise the answers that cannot be the answer.
Some will be obviously wrong.
Some will be subtly wrong.
Some will be technically valid but irrelevant to the scenario.
Some may be appropriate eventually, but not as the first step.
And once you get down to the final two, the work isn’t finished.
That’s when you have to ask yourself:
Which one actually serves the purpose?
That final judgement is where I found the difference between knowing the subject and understanding the question.
Looking back, I think that is what those 6,000 questions really gave me.
Not 6,000 answers.
They helped me develop the ability to exclude, compare, judge and finally choose.
When you’re sitting in the exam and four options are staring back at you, being able to remove two of them is valuable.
But being able to look at the final two and determine which one best serves the purpose of the scenario is equally important.
That, for me, was one of the real lessons from the CISSP journey.
Knowledge helps you understand the options.
Exclusion helps you narrow them down.
Judgement helps you make the final choice.
And sometimes, that final choice is what makes the difference.
Part 3 will be another lesson from my CISSP preparation and exam experience—when your own professional experience can sometimes become a bias that you have to consciously overcome.
