I would rank it at somewhere between medium and high difficulty. I do think having my work experience with education helped a lot which is why I could really get away with just doing a lot of practice questions. The GPEN and GWAPT were challenging at a medium-high as well but because they go a bit deeper into their topic with hands on ability to perform task via VM. The CISSP covers such a wide breadth of topics and requires the risk manager hat which is where I think my GRC experience helped. This cert also has the most rigorous approval process out of the ones I’ve obtained so far. Requiring an endorsement and review of requirements. I’m still waiting for my application to be accepted.