There was another thing I realised during my CISSP preparation that I didn’t expect.
My experience, which I initially considered one of my biggest advantages, could sometimes become a disadvantage.
I have been working in cybersecurity for a long time. Over the years, you develop instincts.
You see a situation and your mind immediately starts connecting the dots.
You have seen similar problems before.
You have dealt with incidents.
You have implemented controls.
You have made decisions under pressure.
So naturally, when you see a CISSP question, your experience kicks in.
You think:
“I know what I would do here.”
And sometimes, that is exactly where the problem starts.
I remember coming across questions where my first reaction was based almost entirely on my professional experience.
The answer felt obvious to me.
I could justify it.
I could explain why I would take that approach in a real environment.
But when I went back and looked at the question more carefully, I realised something uncomfortable.
The question wasn’t asking what I would do.
It was asking me to understand the situation presented and make the decision that best fitted that situation.
That was a very important distinction for me.
Experience gives you intuition.
But intuition is built from the environments you have worked in, the problems you have encountered and the decisions you have made.
CISSP questions can put you into a different context.
And if you allow your past experience to automatically dictate your answer, you can miss what is actually being asked.
This happened to me more than once during preparation.
I would see a scenario and immediately jump to a solution.
Then I started forcing myself to pause.
Read it again.
Forget what I would normally do for a moment.
Look only at the information given.
What is the objective?
Who is responsible?
What is the priority?
What is the risk?
What is the question really asking me to decide?
That pause made a difference.
It wasn’t about ignoring my experience.
Quite the opposite.
I started using my experience differently.
Instead of allowing it to give me an immediate answer, I used it to understand the situation better.
That’s a subtle difference, but it matters.
I also noticed something else while working through thousands of questions.
Sometimes I knew too much about the subject.
That sounds strange, but it can happen.
You start thinking about all the possible real-world complications.
You bring in assumptions that aren’t actually part of the question.
You start building a much bigger scenario in your head than the one presented on the screen.
And suddenly, a relatively straightforward question becomes complicated.
I had to learn to stay within the boundaries of the scenario.
If the question gives me certain information, I should work with that information.
I shouldn’t create another story around it.
That was difficult at times because professional experience naturally makes you think beyond the immediate problem.
But an exam question has a defined context.
The ability to stay inside that context became important for me.
This is also where the thousands of practice questions helped.
I wasn’t simply checking whether I had selected the correct answer.
I started paying attention to why my first instinct had taken me somewhere else.
Was I relying too much on my experience?
Was I making an assumption?
Was I solving a different problem from the one presented?
Was I choosing an answer because it was technically familiar to me?
Or was I actually answering the question that was being asked?
Those reviews were sometimes more valuable than getting the answer right.
Because once you understand your own thinking pattern, you can start correcting it.
And I think that’s one of the less obvious parts of preparing for CISSP.
The journey isn’t only about learning more.
At some point, it becomes about unlearning some of your automatic reactions.
For someone with less experience, the challenge may be understanding the concept.
For someone with significant experience, the challenge can sometimes be preventing that experience from making the decision too quickly.
Neither is necessarily better.
They are simply different challenges.
This became particularly relevant when I eventually sat for the actual exam.
Those first 30 questions had already shaken my confidence.
The questions didn’t look like the practice questions I had become comfortable with.
For the first 30, I was spending a lot of time trying to understand what was being asked.
I had to remind myself not to fall back into the habit of saying:
“This is how I would handle it.”
Instead:
“What is this question asking me to decide?”
That shift helped me regain my rhythm.
The next 70 questions took me around 60 minutes.
Looking back, I think one of the reasons I recovered was because I stopped trying to make the exam fit my expectations.
I stopped trying to recognise the question.
I started responding to the situation in front of me.
And that is probably the biggest lesson I took from this part of my CISSP journey.
Experience is an advantage.
But experience can also become a lens.
And sometimes that lens can prevent you from seeing what is actually in front of you.
The trick isn’t to throw your experience away.
It’s to know when to use it—and when to step back from it.
That lesson has stayed with me beyond the exam as well.
Because in cybersecurity, our experience shapes how we respond to problems every day.
But the best decisions don’t always come from the fastest reaction.
Sometimes they come from taking a step back and asking:
“Am I solving the problem that actually exists, or the problem I have seen before?”
For me, CISSP preparation made me ask that question more often.
And that may be one of the more valuable things I carried away from the journey.
Knowledge gives you options.
Experience gives you instincts.
Judgement is knowing when to trust those instincts—and when to question them.
Part 4 will be about another part of my preparation that changed the way I approached the exam — learning to deal with the questions where there seemed to be no perfect answer.
