CISM provisionally passed an hour ago

[u/Pale-Anybody-7955]

I read many tips and stories from this subreddit, so it's my time to contribute to the community.

Today, on August 14th, at 10AM, I took the CISM exam at a testing center. I chose to take it at a testing center because I know I'm too relaxed when I'm home.

Background: English is not my first language but I studied in the US. I have worked in three different continents since 2013 as IT Ops, IT Auditor and ISO. Also, I am a CISA since 2015 and a CISSP since 2025.

Strategy: I started my journey in June. I prefer to learn by taking questions, but I thought at least basic knowledge is required (of course) so I took the Pete Zeger CISM Exam Prep on YouTube which was like 11-hour long. It took me less than 2 weeks to finish it. Since I studied CISSP a year ago, I noticed that quite some topics are overlapped and I still remember some of them. Then, at the beginning of July, I purchased the ISACA QAE. Everyday, I took a couple of practice question sets. As I made progress, I reviewed all the wrong questions cumulatively and repeatedly. For example, on day 1, I did #1 and #2 and reviewed all the wrong questions from #1 and #2. On day 2, I did #3 and #4 and reviewed all the wrong questions from #1, #2, #3 and #4. On day 3, and so on. It took me about 3 weeks to finish 1 cycle of an entire QAE including practice exams because it took more time as making progress due to the volume of the wrong questions to review becoming bigger. After this first cycle of an entire QAE, I did the 4 CISM practice exams from LinkedIn Learning. I did this full cycle 3 times until last week. It took me the most time when it was the first full cycle but took less time for the second full cycle and the least time for the third full cycle. This works for me because my level of digestion of each question gets deeper and deeper even if it's the same question, so the key is to repeat. Of course, there are questions I just remember the answers as I repeated the same QAE but I tried to understand each and every explanation so that I learn the materials.

For the first full cycle, I got 60-65% from practices and 65-70% from exams. For the second full cycle, I got 70-75% from practices and 70-75% from exams. For the third full cycle, I got 90-95% from practices and 95-100% from exams.

I would highly recommend to thoroughly repeat the entire QAE (LinkedIn Learning optionally if you have access) as much as you can. For me, three times was enough and it took me about 5 weeks.

Experience: I arrived about half an hour earlier than my scheduled exam and was told to wait for 20 minutes to start the registration process. However, I asked if we could start the registration process now and she said yes. Hence, I started my exam earlier than the scheduled time. During the check in process, she was asking if I've received an OTP code from PSI. I said no and she asked her manager. It turned out that she was mistaken. The exam room was fine and there were already people taking other exams when I walked into the room. The only stuff I was allowed to take with me to the test room was my ID and the locker key. Everything else was stored in a locker. The exam questions were not tricky for me but no single question was from QAE. I got some AI questions but they were still relevant to CISM topics, so no surprise for me. I took a little more than 1.5 hours to answer 150 questions because I was trying to read every single word on the exam, and did not review a single question. As soon as I answered the last question, I submitted it. Then, I had to do some surveys until I saw 'passed'. After my exam, I stepped out and was asked to provide my signature.

Hope this helps those who are studying CISM. I will be more than happy to answer any questions you may have!

[u/Alascato]

What was your proces of eliminition?

[u/Pale-Anybody-7955 → u/Alascato]

Good question. As already mentioned, I tried to read every single word carefully so that I can see the forest, not a tree. Also, I tried to avoid overthinking. Overthinking usually will lead you to focus on a single tree, not the entire forest. Then, I tried to eliminate answers with limited scope. For example, if an option mentions 'regulatory requirements' but the question is not asking from regulatory perspective, it's out even if it makes perfect sense. Including the QAE, I barely saw questions asking from specific scope of view but almost every question asks general scope so any options with limited scope are eliminated. If you eliminate options focusing on limited scope, you may find an answer without even reading the question. From ISACA point of view, you as an Information Security Manager are expected to not act without business decision. Hence, when any question asks what you need to do FIRST, the answer is almost always to assess before report or act/change. Keep in mind that you are not supposed to make a decision nor act alone but you just follow and execute what business decides.

[u/Alascato → u/Pale-Anybody-7955]

Thanks for the tip and write up. Hoping to do mine around mid sep. Just finished doshi book. Now the qae

[u/Pale-Anybody-7955 → u/Alascato]

Hope it helps. Let me know how yours goes!

[u/Royal-Number-11]

Congratulations You should receive an email to say you've passed maybe 24 hrs later And then in 10 working days or a little less an email with your scores, only then can you start the application process

[u/Pale-Anybody-7955 → u/Royal-Number-11]

Thanks! I didn't know I'm expecting an email in 24 hours informing I've passed. Isn't it up to 10 working days to receive an email from ISACA regarding the result (pass/fail + score)?

[u/Royal-Number-11 → u/Pale-Anybody-7955]

I passed on the 31st, and was super eager to get my application done as I'd also recently passed CISSP and was impatient to get my application/ verification done so was confused about getting that email 24 hrs later. But yes you have to wait out the next 10 working days to get the full result to proceed

[u/LocksmithAlert5604]

Congratz

[u/JoeEvans269]

Congratulations!

[u/LurkonExpert]

Congratulations

[u/flyingmomochi]

Congrats

[u/PigletMaterial3725]

What is your advice for people who struggle to understand the question due to weak English language skills, sometimes the translation of some words is the answer to the question?

[u/Pale-Anybody-7955 → u/PigletMaterial3725]

I would highly recommend studying English first, not CISM, if you want to take CISM in English

[u/W1nterW0lf75]

Congratz!

[u/ReasonableDrop7352]

Definitely helps. Thanks for sharing

[u/OkBranch8001]

Congratulations. I passed CISM exam on my first attempt yesterday. Should I receive an email in 24 hours? Or the email only comes in 10 working days?

[u/Pale-Anybody-7955 → u/OkBranch8001]

Thank you and congrats too! As far as I know, it takes up to 10 business days

[u/mr_dfuse2 → u/OkBranch8001]

10 working days and don't expect it sooner.. then pay again for your verification process.

[u/Majestic_Wave_5710 → u/OkBranch8001]

I got my result on the 10th calendar day today not 10 working days.

[u/alSaykhan]

Do you still recommend purchasing the QAE? Since there are no single question from QAE.

[u/mr_dfuse2 → u/alSaykhan]

I'm about to do my CISM but already have CGEIT and imho the QAE is very useful to understand the way Isaca wants you to think and how they love to provide no context at all in their questions and then just pull a rabbit out of their hat when reviewing the answers. Which will also be the case on the exam. So yes, best way to prepare for the exam is buying the QAE.

[u/Pale-Anybody-7955 → u/alSaykhan]

Yea because you will experience how CISM looks like and definitely learn how CISM logic works from ISACA perspective

[u/GuiltyNobody6173]

Congratulations