Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently CompTIA A+, Network+, and Security+ certified. As part of maintaining compliance with the DoDD 8570, I will also be sitting for the ISC^2 CISSP exam in the near future.

I have noticed that GIAC offers certifications with open-book exams that are regarded by DoDD 8570 as in equal standing to the CISSP. Given this, my boss was recently surprised to find that the ISC^2 CAP exam he took was not open-book!

Are the GIAC exams actually open-book? If so, is the test itself more difficult, to compensate for this?

share|improve this question
At what level do you need to get certified? If I'm reading the chart correctly, Security+ is good enough for Techs up to level 2, and first-level Managers. I found it to be pretty easy, even though it's not open-book. Also, what "different 8570 exam" did your boss take, mistakenly expecting it to be open-book? Not all vendors of 8750-approved exams allow you to bring materials to the testing room. – Iszi May 11 '11 at 5:12
@Iszi I have the 3 foundation certs for my industry (IT Military Contractor): Comptia A+, Network+, Security+. I am sitting for the CISSP on May 21st. My boss took the ISC^2 CAP exam and thought it was open book. I DID read the GAIC website regarding open book policies - I was just wondering if anyone (here) actcually took it. I may have gotten a response like "Its open book, but I couldn't find any answers in my book during the exam"...or something of that nature. It just seems very 'unbalanced' to be given the same weight (CISSP vs GAIC series exams) – Abdu May 11 '11 at 16:23
See my comment regarding GIAC, on my answer below. Just FYI: The CAP certification is, from what I've heard, a very difficult one to achieve. We had a handful of people from my department (some of them very qualified and experienced) take a class and still fail the test after even two tries - only one person in the department got it. – Iszi May 11 '11 at 20:37
I've edited your question to include the details you've given in comments, and hopefully to be more clear and specific. – Iszi May 11 '11 at 20:49
up vote 6 down vote accepted

According to the GIAC website:

GIAC exams are open-book/open-notes, therefore you are allowed to bring any non-electronic resources you may need during your test (this includes a notepad for writing). You are allowed to bring as many of the chosen materials as you are able to fit in a standard-size bookbag (roughly).

For the CISSP, page 11 of the registration form states that:

Reference materials, except as indicated below, are not allowed in the testing room.

The only exception is this:

...word-to-word language translation dictionaries are permitted for the English examination, should you choose to bring one to assist you with language circumstances.

It may be worth adding that most certification exams do not generally permit examinees to bring their own resources to the test. I personally have sat for CompTIA, Microsoft, and Cisco examinations and am looking at taking an ISC^2 test in the near-ish future - none of these allow the test-taker to take anything more into the testing area than whatever the proctors issue. Typically, the only things issued are a marker and whiteboard, and perhaps a simple calculator. Sometimes, a pencil/pen and paper are issued instead, but the paper is shredded after the exam.

Though this is wandering into the realm of subjectivity, I personally would wonder if a certification that allows open-book testing is truly regarded (by the industry at large, hiring managers, etc.) as having "equal status" to those that require candidates to rely only on their personal knowledge.

According to some colleagues of mine, and others here in comments, it seems that the GIAC exams do hold a good bit of weight on their own. The Silver exams alone are difficult enough that having open-book resources on hand is a practical necessity to pass. However, at the same time, the examination period is short enough that one cannot solely rely on the books for all the answers and still finish in time. Additionally, the Gold-level exams require you to write an original paper, better demonstrating a deep understanding of the material.

share|improve this answer
First part is very helpful. Subjective part seems wrong or overly broad to me. The goal should be an exam that is relevant to the real world. The real world is open book. If the exam can sort out those that know their stuff (including how to use references) from those that don't, it is a good exam. Note that I haven't seen this exam and can't vouch for it. – nealmcb May 11 '11 at 16:24
@nealmcb - I know the subjective bit is broad, and possibly not reflecting of real-world industry perspectives. Hence, the subjectivity disclaimer and usage of the word "personally". My boss is GIAC certified. His comments to me this morning on the topic were that you pretty much need the book for the test, but you don't have a lot of time to be completely reliant upon it. – Iszi May 11 '11 at 16:43
I've taken a GIAC silver Exam and yep with the volume of material being examined and the approach of the exam, open book was necessary. Knowing their approach, I hand prepared an index in advance to help look up, as timing is short. The GIAC Gold process is (in my opinion) a better demonstration that you know the topic at hand as you actually have to write an original paper on the subject, which will generally require a decent understanding of the topic – Rоry McCune May 11 '11 at 20:34
@nealmcb - Do you know the title of the book(s) your boss used? – Abdu May 13 '11 at 15:56
@Abdu - I think you may be referring to me? And no, I don't. – Iszi May 13 '11 at 16:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.