Good exam technique explained

In my work as a consultant, and particularly when helping define training plans and strategies with clients, I’m often asked about learning styles and exam techniques. For example, what method of learning works best and gets best results? Is there a right way or a wrong way to prepare for exams? 

I’m not an expert in education techniques, but I do know what works well, and what doesn’t work, for me. That is, I know what learning style suits me best. 

Some people are very comfortable with self-study, with reading text books, watching online lessons etc. I’m not one of that group. I prefer a blend of learning in a classroom, with a mix of theory and hands on, practical work. I’m reasonably ok with reading notes afterwards, but only once I’ve got my hands dirty, so to speak. The best advice I can give on this topic is for you to find and attend courses which match your best learning style. If, like me, self study isn’t a good option, don’t sign up for a course which requires that. If you learn best working on your own and not in a classroom, look for options which allow you work that way. 

Exam technique is something which is a bit more nuanced I think. Since leaving college and starting work I’ve not failed an exam or test, so I think I must do something right. 

Multiple choice exams

Here are my top tips, starting with multiple choice exams:

  1. Read the first question.
  2. Read it again, slowly.
  3. Read the answers.
  4. Read the answers again, slowly.
  5. Read the question again.
  6. Read the answers, and if you know the right answer, mark it on your answer sheet and move on to the next question. 
  7. If you don’t know the answer, discount those you know to be wrong then remind yourself who sets the questions. If for example you’re doing an ISACA exam, bear in mind that they are mostly taken by (and set by) risk and audit professionals, so the answer is likely to be weighted towards risk or audit. You can then choose the best option based on those remaining, and move on to the next question.
  8. If you don’t know the right answer after the first few read throughs, it’s unlikely you will know it after staring at the screen for five minutes, so choose the answer which is the best fit for you, the lest wrong, and move on.
  9. Repeat the above till the end of the exam.

Here’s the most important bit – don’t skip any questions, and don’t go back to reread them. In the majority of cases, your initial instinct will be correct. You can see this phenomenon in pub quizzes, on TV quiz shows etc – how many times does the first answer you thought of turn out to be right (or at least more right) than what you changed your answer to? I believe that going back, rereading and perhaps changing some answers actually loses you marks. The one time this isn’t the case is on the rare occasions when an answer turns up as the question later on.

For longer exams – CISSP and CISM are good examples – plan to take breaks regularly, every 15 or 20 questions. Stop, put your pen, pencil or keyboard down. Stretch your arms, legs, and shoulders, rotate your head on your neck, close your eyes and take 3 or 5 deep breaths. Relax. When you open your eyes, make sure you refocus them away from the paper or screen. Then start again. With CISSP I planned and took a fifteen minute coffee break half way through, had some food, walked around for a bit, got some fresh air, and felt the benefit when I got back in. 

When you’ve finished the test, double check that you have answered every question, complete the exit process and leave if allowed. There’s nothing to be gained from sitting rereading questions because as I mentioned earlier, you’ll only end up costing yourself marks if you do. 

Written exams

That’s all well and good for multiple choice, but what about written papers? Typically you’ll get a time limit a number of questions to do and a particular number of marks per question. All of this is stuff your tutor should brief you on before you sit the exam, but if not, make sure you ask them. There are fewer tips for this type of exam, and here they are:

  1. Before starting know how many marks per minute you need to get (allow 15 or 30 minutes at the end of the exam because you will think of stuff as you go on) and make sure that you only write for the amount of time each question is worth. For example, if a question is worth 10 marks, and you know you need to write 1 mark a minute, allow yourself no more than 10 minutes on that question. 
  2. Start each answer to each question on a fresh sheet of paper. 
  3. You should finish writing (in this example) 15 or 30 minutes before the end
  4. Use this buffer period at the end of the exam to add detail to any questions you feel you need to
  5. Reread your answers and make sure you add all the detail you can, even if it’s just a bulleted list of items
  6. You should only stop when time is up

A last word

The one other tip I’d give is to do as many past papers as possible, so you’re familiar with the language used, the way questions are phrased, the subtle ways that you can get caught out. Who knows, maybe some of the past questions will come up in your assessment? It’s been known to happen! 

Choosing your certification

There is a wide range of different security courses available, and a mind-boggling array of certification and acronyms which go with them. This article focusses on three of the most common, highlights the differences between them and provides guidance on how you choose one over the other.  I hold all of these certifications, and I’ve linked to a couple of previous articles where I’ve described the learning experience in a bit more detail. 
CISMP has been developed by the British Computer Society (BCS), and is the Certificate in Information Security Management Principles. It is a well-known and common entry-level qualification, which is typically attained by people who are looking to start their careers in information- or cyber- security. It covers, at a very high level, a wide range of topics and provides a good foundation level of understanding. It can be viewed as a preparatory course which you then build on, perhaps specialising in one area or another.

It covers the following topics, and typically these subject areas are covered over five days on a course, with a one hour multiple choice exam at the end:

  • Information security principles
  • Information risk
  • Information security framework
  • Procedural and people security controls
  • Technical security controls
  • Software development and life cycle
  • Physical and environmental security
  • Disaster recovery and business continuity management
  • Other technical aspects

CISSP is the Certification Information Systems Security Professional from (ISC)2, and is one of the two most popular high level certifications (the other being CISM – more on that shortly). Of the two, CISSP is more focussed on technical skills and management, and is based on 8 domains:

  • Security and Risk Management
  • Asset Security
  • Security Engineering
  • Communications and Network Security
  • Identity and Access Management
  • Security Assessment and Testing
  • Security Operations
  • Software Development Security

In order to achieve certification, you must pass a 6 hour exam consisting of 250 multiple choice questions, and be able to evidence at least 5 years’ experience in at least two of the domains listed above. You also need to have an existing CISSP verify your claims of experience. 

The Certified Information Security Manager (CISM) from ISACA is the other major certification which companies typically look for. It focusses more on governance and risk than technical skills, and is allied to the Certified Information Security Auditor (CISA) certification, also from ISACA. There are only 4 domains, namely:

  • Information Security Governance
  • Information Risk Management
  • Information Security Program Development and Management
  • Information Security Incident Management

Those applying for CISM need to be able to demonstrate at least 5 years’ experience in 3 or more of these domains, and also have to pass a 250 question multiple choice exam which lasts up to 4 hours. This is currently a paper based exam which is only available twice a year (all exams globally run at exactly the same time), though it is understood that this is moving to a computer based test in the near future. 

For both CISSP and CISM, certification is maintained by completing and evidencing a minimum of 20 hours Continuing Personal Development / Continuing Professional Education each year over 3 years, with a minimum of 120 hours CPD / CPE required in that time. Activities which qualify include attending seminars and conferences, contributing to papers, presenting on one of the domain topics etc. 


CISMP is a good foundation to start a cyber- or information- security career. Candidates cover the basics of the topics involved, and will have a sound understanding for each area covered, which will in turn help them decide which they want to pursue in order to further their career. CISMP has no ongoing CPD requirement.

It can also be seen from above that there is little difference in terms of qualification requirements between the CISSP and CISM: the former is more suited to those with a technical, more hands on, background while the latter is better for those who have spent more time on the policy, process and governance side of things. They both require 5 years’ experience in the industry and endorsement from an existing holder of the certification. The exams can be lengthy, but time allowed to complete them is plenty, and candidates should not find them too daunting. 

(ISC)2 and ISACA are aiming to ensure that, because candidates must have experience as well as pass an exam, their qualifications have merit and are valuable for the individual and the company. The requirement for CPEs also helps to ensure that knowledge is being maintained and refreshed over the course of the certification.

Certified Information Security Manager

Back in 2010 I attended a three day course with Net Security training in Wembley, in preparation for a Certified Information Security Manager (CISM) exam a couple of weeks later. All of the work was theoretical, and it was assumed that you already had experience in most of not all of the domains covered.

The exam itself was paper based, with four hours given to complete 250 multiple choice questions. You then have to wait a few weeks before you get your results, at which point you can then apply for the certification from ISACA. You need to be able to demonstrate at least five years worth of experience in two or more of rhe domains as part of the certification process.

The certification lasts for three years, and in that time you need to complete a minimum of 120 hours of Continuing Professional Education (CPE), with at least 20 hours in each of the three years. I have recertified in this way once, and have already reached my target for this recertification period.