I just took/passed 642-532 this morning. The only book i used was the cisc press exam guide. It has everything you need to pass this test (aside from an actual sensor to practice on). i had a few sims. a couple gui sims - event actions overrides/filters
1 cli sim - viewing past events, and resetting sigs to default
nothing too surprising on the test. everything on the test was covered in the book. needed 825 to pass (i rec'd >900). i studied for two weeks. but i have been administering 4240's for over a year now. nothing on security monitor, nothing on capturing traffic ie switch configuration (aside from the CLI packet command)...
63 questions. i finished in about 35-40min.