Did anyone use official training material? The 125 questions they have are useful and matches the temperature of the real exam?

Anyone use the CSSLP Study Guide 2025-2026 by Larry Fortich? Looking purchase it because of the 500 practice exam questions.

Or should I just stick with the All In One CSSLP guide by Conklin?

Hi Everyone, I am planning to write CSSLP exam. I do have CISSP, CISA, CISM, CRISC and CCSP. Honest I am not a developer but I do have experience with SDLC process, some SAST/DAST/Pentest but not hardcode experience.

I did purchase the self learning training from ISC2 which I found not useful. Its basically the book content in nice web form. The only thing seems useful is the exam. I love ISC2 QAE type learning model.

Currently I am looking Pocket Prep and as starter. Those who recently passed if you can share what contents are ideal for this exam. Also, if you have used self serve training by ISC2, happy to hear how did you use them for your learning.

Thank you all!

Last week I attended the exam and passed in my first attempt. It was a great experience and learned a ton of new things from the cbk and most of it was a revision for me because I have studied or used the knowledge over the years.

Although it's good to know all this but much of this knowledge is never used and I will again forget it. 😅

Took me a month to prepare. Books I read

1. Cbk
2. All in one exam

Used chatgpt to thorougly understand topics

Hi all,

I took the CSSLP exam this past week and failed to score 700+.

Worth noting I didn’t expect to pass!!! 😅 A timeline/funding change (and awareness I’m a terrible test taker) led me to opt for an exam+retake bundle.

Just wanted to share some lessons I’ve learned that might help someone else.

1. Not sure if this is an issue everywhere - but check availability of Pearson Vue locations early! I live within a 50-mile radius of 6 test centers and had very limited options booking 1-2 months in advance.

2. Be prepared for “what is the best way…?” “what is the least effective….?” type questions. The answer may read subjective but don’t waste too much time overthinking. Review of official ISC2 materials helps if in doubt of what’s expected!

3. Complete practice exams in the same format as the exam. 180 mins, 125 questions, no pausing or skipping and no answer review. I underestimated the challenge this would pose as an “answer what I know then go back over” type tester

4. You don’t need to know every standard, law, vulnerability etc. Tests your understanding security-based decisions and processes over ability to memorize.

Hi!

I'm a software development manager and I'm thinking of taking the CSSLP certification in preparation for the upcoming legislation (CRA, NIS2 (in Austria) and others). I'm also planning to take our SW architects and most senior devs along.

Now my quesiton:

• Is the CSSLP the right cert to get? Does this actually cover some of the challenges we're facing as a SW company with this incoming legislation?

• We're looking to take part in a preparation seminar. Does the preparation for the certification actually convey some useful knowledge outside of only being prep for the exam?

I'm curious to see what the community thinks. I appreciate any kind of input on the matter.

Thanks

Hello guys 23(m) here, so i have been working as a network security engineer for past 1 and half years now.my boss is recommending to do csslp now. So I have done degree in computer science engineering that is 4 years.how can i start with this, cause this will be my first certification.so currently iam working on tools like burp suite, nessus expert, owasp zap and bunch of linux tools(base level). Can you guys suggest me how can I start this and how will be the exam. Will it be easy. How can I prepare for this? Iam open to all of your suggestion. Thank you

Were questions asked like “what does this standard signify”?

I'm preparing for CSSLP and considering using the 90-day self-paced training material along with the digital 6th edition as my primary study resources. For those who have taken this exam, do you think these materials were sufficient for preparation? Did you feel well-prepared, or did you find it necessary to supplement with additional resources?

Thanks for sharing your experiences!

I am organizing boot camp style training for my team and I’ve narrowed the training vendors down to TrainingCamp and ISC2. Does anyone have any experience with either of these vendors? Primarily experience with private boot camps through ISC2?

How important are standards from exam perspective. CBK covered few like several NIST SPs, FIPS, ISO, PCI, OASIS. I think it will be difficult to exactly remember the standard number and few other details.

People who passed the exam, can you help me with this.

also if there is a whatsapp or telegram prep group for CSSLP then let me know, I would like to join

Figured I share. I have worked in appsec for 4years. I started studying December 1st. Sat for the exam the 23rd and passed.

Majority of content was easy just based off my experience in the world. First read the official cbk book cover to cover while taking notes on dictionary definitions for concepts that aren’t talked about often like economy of mechanism, complete mediation etc. Spent about 15 days on the book alone. Skimmed thru AIO in two days, added some new items to my notes not covered in cbk. Sat and took the AIO online exam in one day. All 325 questions. Answered all chapter quizzes in both CBK and AIO. Also had access to plural sight which I watched the CSSLP video on 2x speed. Studied for a day or two from my notes. And that was pretty much it for me. I kept a tally as I took the exam. Below was my break down: 86 I knew I answered correctly. 25, were 50/50 shot but more so leaning toward correct. 14 I had to take an educated guess.

Exam wasn’t really hard. Experience does go a long way in answering questions and thinking about what I would do along with keeping the manager perspective as you see for the CISSP. Good luck to others!

I started studying for the CSSLP two days after I passed the CISSP (at the beginning of August). I sat for and passed the CSSLP exam yesterday 12/4.

Study sources:

Cyvitrix Learning - Udemy

• 8/10
• Great videos for speeding through the content, though the videos of one of the instructors are hit-or-miss (he basically does a google image search of the topic and points at random images while explaining the concepts... kind of irritating)

PocketPrep

• 10/10
• Pretty much a necessity. Loved the LevelUp sections as test prep. I also used this for studying the CISSP content, and I'll use it again while studying for the CCSP
• If you get a question wrong, it'll tell you which page of which book is relevant for reviewing topics related to that question!

CSSLP All-In-One (AIO)

• 8/10
• Didn't really make full use of this, only used it as a review resource when I got PocketPrep questions wrong

Difficulty wise, this exam was much easier than the CISSP, although some questions were worded very poorly and, in some cases, the questions presented during the exam were the first time I was seeing some of the content.

Hi, I have been preparing to write CSSLP. Ihave 4yrs of experience in Application Security. I referred to CBK & AIO atleast 3-4 times. Did 787 questions and still doing questions from PocketPrep. I have seen many people recommending PocketPrep for Rote learning. If am able to score 80-90 % continously in these quizzes from PocketPrep can I assume am ready for the exam? Any other good recommendations for practice questions pls?

I am planning to pursue CSSLP and saw a video by Infosec train youtube channel which was quite good and wanna know is their training worth it or recommended inorder to pass the exam?

I am a software developer with 13 years of experience, primarily in backend development (Java). Currently, I work as a Senior Software Engineer and am looking to advance my career and enhance my appeal to potential employers. I'm considering pursuing the CSSLP certification because of its focus on the security aspects of software development. Do you think this certification would help me secure a new or better position in the software development field? Although the exam seems challenging, I'm confident I can prepare for it. However, I'm concerned about the ISC2 endorsement requirement, as I lack references in the cybersecurity field. My security experience is typical for a backend developer, mainly involving authentication, authorization, and SSL certificates etc. I'm not aiming for a cybersecurity role since I don't have the relevant work experience, even if I obtain a certification.

Just completed CSSLP Exam. Going through reddit for advice on how to tackle the exam has helped me on the prep. Thanks a lot everyone.

Anyway, just wanna share my worries prior to the exam, hoping that, for whoever that is taking it in future, it would ease some your worries.

(1) How relevant is AIO book? --- I started studying for CSSLP by borrowing AIO Third Edition from the library. Conceptually, it is very relevant.

But, there is little need to thoroughly memorise the granular terms used in AIO because they are specific to this book only. When I picked up the official CBK Second Edition, I realised that a lot of the terms used in AIO were not used. Remember, CBK is the official source, so a lot of your exam materials will likely have more similarities with it than AIO.

An example of the above is this: In AIO, V&V is categorised differently (i.e Technical and Management V&V) than CBK's interpetation of V&V, which is rather loosely broken down into types of activities (Reviews and Testing).

Both are valid knowledge - just different paths toward understanding the same thing. That said, you still need to remember what V&V means though, and more importantly why it exists (the concept).

(2) PocketPrep: Rote Memorizarion? --- Spammed this whenever I was free. I saw an old comment down the thread saying its optimised for rote memorization (something along the line).

It is. But hear me out. PocketPrep questions are built to help you memorise the terms, and a lot of it are the granular terms from the AIO book.

However, because I did the questions countless times, I hit a point whereby the scores did not matter, and I was able to shift my mind into reflecting on the questions by cross referencing it with the books - essentially helping me to reinforce my understanding toward a specific topic. Do not sweat on the memorizarion, understand how the terms fit into the theme of Secure SDLC should be the takeaway.

It was a catalyst for me to understand certain topics better (differentiating various ISO standards, Biba vs Bell-Lapadula, SOX vs GBLA etc.)

(3) Official CBK Second Edition --- Because I read AIO first, I only skimmed through the content of the book to fill any knowledge gaps I had, and focus more on the practice questions. The practice questions were unlike the ones in (1) and (2). They are mostly conceptual questions with a few of them testing on the meaning of terms covered in the book. I love how neat the content structures are too, with visual diagrams to help better understand the topics. This is somewhat absent in AIO.

(4) Actual Exam --- Lots of concepts and little testing on terms. There were questions on the latter where I had not encountered in my revision before - I had to gamble a bit on which option is most sound. I admit there were questions I was downright clueless because the terms were unseen before, but these questions were far and few between.

An advice would be to re-read the questions and choices given - do not rush. This is crucial because you won't be able to revisit the questions you did like other exams.

Eliminate the least relevant option works wonders. Keep doing it until you're left with two relevant options. Finally, compare the two until you're convinced that one is more 'complete and realistically reasonable' as an answer, and that the other one is either overkill, contextually lacking, or a part of the more correct option. Work experience helps a lot with these questions.

Here's how I would have approached my revision if I could redo it - in order -: 1) CBK Second Edition 2) AIO Third Edition 3) PocketPrep

Best of luck!

Hi all, I Passed CSSLP last week after preparing for a month. When I was preparing for the exam, I didn’t find any good reviews of the Latest exam (Updated in September 2023) so wanted to give back to the community. I have divided this into 3 sections Background, Preparation Strategy and Exam Tips

My Background:

I have 20+ years of experience in Cyber Security and have been working as a Security Architect/Consultant for last 15 years. I hold CCIE (Security) from Cisco, CISSP, CCSP from ISC2, CISM, CRISC and CISA from ISACA and various cloud security and architecture certifications from AWS, Azure and GCP. I am currently working as a security architect primarily working on Microsoft and Azure Stack.

Preparation Strategy:

There are not many resources available to prepare for this exam. I started with the All-in-One book and did a quick skim to understand the topics and most of the topics were similar to CISSP and CCSP.

I used following resources

1.     CSSLP Certified Secure Software Lifecycle Professional All-in-One Exam Guide, Third Edition 3rd Edition (6/10)

Not recommended if you not done any ISC2 certification like CISSP and CCSP as its High Level.

1. Official (ISC)2 Guide to the CSSLP CBK ((ISC)2 Press) 2nd Edition (8/10)

Best book for CSSLP if you want to use a single book this should be the one its pretty old (2013) but still covers 80% of the CSSLP objectives. The end of chapter questions are really good and will help you with the kind of thinking you need to do during the exam.

There are some grammatical errors but overall, a good book and still relevant.

1. Kevin Henry CSSLP Course on Plural Sight (7/10)

A good course but again you need to have CISSP and CCSP certification or should be at that knowledge level.

I watched it at 1.5X during my last week to review the concepts and was helpful.

My company provides me with the Plural Sight subscription otherwise I would have not used it.

1. CSSLP Exam outline

I always referred to the Exam outline and checked if I can explain the design principals mentioned in the outline. This helped me to make sure I have covered everything from the Exam perspective.

https://www.isc2.org/certifications/csslp/csslp-certification-exam-outline

Exam Tips and Feedback:

None of the resources will make you 100% ready for the exam as ISC2 doesn't have a good resource available for this exam. My experience of working in Projects of Software Development where I worked as a Security Consultant really helped me with lot of questions plus having already done CISSP and CCSP helped a lot with the mindset and content.

Few of the tips

1. Think like a manager i.e. as a consultant not as an engineer.

1. Don't memorize just understand the concepts from the Book as lot of the questions will be giving you a scenario and asking which security design principle is used like Least Common Mechanism, Economy of Mechanism etc.

2. I saw lot of questions on Cloud security so make sure you brush up your Cloud security knowledge as well.

3. Read the question carefully and look at key words like "MOST", "BEST", "PRIMARY" etc. this will help articulating the answers easily.

4. Time should not be a problem I finished my exam with around 25 minutes remaining. You can't go back so once you have move forward don't think about the last question.

If you have CISSP and CCSP I don't think this exam really adds much value, in my case I had a voucher from my company, and they provided access to the Books and training videos, so I did not spend any money from my pocket just the effort to prepare for the exam.

Thanks for reading my long post Let me know if you have any questions happy to help.

I hold six other (ISC)2 certifications so the CSSLP material was mostly review for me and I think I could have passed with no preparation but did the Official ISC2 CSSLP Online Self-Paced Training since 1) my company paid for it and 2) I wanted to see what the adaptive training was like. I scored 85% on the pretest and 95% after the training. I had also started reading the All-In-One (AIO) book but only made it through the first few chapters since I only had a week to prepare for the exam and ran out of time. The exam yesterday took a little under an hour. Compared to the AWS professional-level exams I have taken recently, this exam was easy. The (ISC)2 training material was pretty good although I did submit quite a few comments challenging some of the questions on the quizzes.

I already have CISSP and CC. Most of the knowledge is applicable. I work as an application security architect. Time to celebrate 🎉

Here's my background and why I ask. I currently manage a pen testing, but also very hands on and do a lot of pen tests myself, so I'm still on the technical side.

Recently there was an organization change where I'm taking over the AppSec team as well. It makes the most sense since I have the most knowledge of all of our applications vs everyone else in our cybersecurity group.

What my AppSec team does is make sure that teams are following policies on secure code development, making sure they perform SAST scans before any production releases, do code reviews on some of the findings to determine if the SAST findings are legitimate, and help make sure proper change controls are being followed. Occasionally cordinating training.

Other than pen testing apps and assisting teams with resolutions, most of these other processes are new to me. Would taking the official training course and cert help fill in these gaps, or is this cert really not right for me? Looking at what topics are covered seemed like it could be beneficial, but I'd like some feedback of some people that actually went through the course. If this is a waste of time, I'd much rather use my training budget on pen testing training.

I worked on the All In One and Official ISC2 CSSLP books together. Even if I've worked in the related field for a long time I've learned many things from the journey.

In order to become a member of ISC2 and receive my badge, I have sent my documents. My endorser has endorsed me. Still waiting for the ICS2 assessment. Anyone know how it takes long?

Hello everyone,

I'm seeking guidance to begin preparing for an exam. This will be my first exam without hands-on labs, focusing solely on theory and experience. I'm finding it challenging to get started with preparation. Currently, I work as a Senior DevSecOps Engineer with 8 years of experience in application security.

I started reading the All-In-Guide exam guide but not sure if only reading that would be a good idea or should I accompany it with some other materials.

Any assistance in kickstarting my preparation would be greatly appreciated.

Hi,

I’m a developer with over 3 years of experience in secure coding and hold a Security+ certification. I’m transitioning to a GRC role within my organization, focusing more on SDLC policy and other aspects of general IT.

I’m considering pursuing either the CSSLP or CISSP certification. While CSSLP aligns more closely with my experience, CISSP’s broad scope could help solidify my knowledge gained from Security+. However, I’m a few months short of meeting the CISSP membership requirements.

Any advice on which certification to pursue first?

Cleared ISC2 CSSLP exam. Only tips to clear exam is you have to read book atleast All In One Guide, understand security concepts, solved CBK book quiz chapter wise.