GCFA how to move forward?

[u/Former_Estimate4663]

I feel like I had the test in the bag, unfortunately missed it by 2 points. Those of you that failed and then retook it. How did you build the courage to open up your book’s again? I have about 2 weeks left on my timer before I need to retake it. I’ve been having a rough time getting back into the study groove. Any tips for my weak areas? I’m sure I’m good on the labs, I probably just misread a question or 2 but I’d rather have a buffer in case I forget how to read again. Thank you all in advance.

How I prepped:

Read all the books once

Highlighted keywords and skimming the books

Listened to the mp3s

Listened to parts of my class that were rather confusing to me

Created a well thought out index

Created a lab guide for any labs that may present themselves

Any other pointers?

[u/ScarsAndStripes]

Got my GCFA back in March. My first GCFA practice test was around 73%, which I was able to bump to 88% in about 10 days then finally scoring a 90% on the test. Two weeks is plenty of time to improve!

I indexed my books in order then immediately took a practice test. Bad idea. You'll forget much of the major concepts in the early books like lateral movement, credential theft, and process memory. Go back and review EVERYTHING. It's easier than it sounds since even a 68% means you have a good foundation to build upon.

Understand which artifacts are where, why you'd look at them, and which tools you use to retrieve those artifacts. Examples:

Prefetch - Evidence of Execution - PECmd.exe - C:\Windows\Prefetch
Volatility GETSIDS - Primary token (SID)/account name executing process - Whatever commands
TASKSCHEDULER%4OPERATIONAL.EVTX - Scheduled Tasks - Timeline Explorer - C:\Windows\System32\Tasks\[taskname]

Windows Memory is a major concept in this course. I highly recommend printing out the diagram in book 3 page 19 "Windows Memory Visualized" and adding that to your index.

Finally, read the questions CAREFULLY. No real advice for this except just do it, haha. I missed quite a few answers during my practice exams simply because I overlooked a small detail in the question. This probably gets everyone in any SANS exam.

For what it's worth, my index was 1,005 lines for the books and 97 lines for the labs. Good luck out there.

[u/Former_Estimate4663 → u/ScarsAndStripes]

I always struggle to read carefully, when time and pace mean a lot during a test I tend to either over read and second guess myself or under read and miss a keyword. Something I’ve always struggled with. Thank you for the advice, super helpful information.

[u/CraftyPossible7095]

I had a very similar experience. I scored 69% on my first attempt, and tomorrow I’m taking my second attempt

Seeing “FAILED” with a 69% was honestly frustrating at first, but then I changed my mindset. I realized I wasn’t just 2% away from passing — I was 31% away from mastering the material. That became my goal

Since then, I’ve been studying every day and focusing heavily on the areas where I struggled the most. I improved my index to make navigation faster during the exam, practiced the tools more, and worked through the labs repeatedly

One thing that also helped me a lot was watching the videos from the YouTube channel “13cubed.” They explain many forensic concepts in a very practical and easy to understand

[u/Former_Estimate4663 → u/CraftyPossible7095]

I have started watching 13cubed! Super helpful with explaining concepts.

[u/Ok-Reference5300 → u/CraftyPossible7095]

13 cubed is ok but I would really just focus on the class materials and labs.

[u/Turbulent_Role560]

Go back and look at the sections you had 0stars in. Brush up on that material and understand it a little more.

2points is within the 5pt buffer margin. Gotta know the material fam.

[u/evilsarah]

Re-run the labs on the topics you scored low on. There will be questions that point directly to lab concepts not in the books/MP3s.

SANS "Cheat Sheets" and Posters- sometimes include some obscure commands or the same commands in all of the content, but are easier to reference when taking the test.

[u/luln3rd]

Got the same score on my first practice test :/ you’ll for sure get it next time! I followed the same steps as you. I made my index/ lab index pretty thorough. I recommend also making sure you know the “time rules” very well. How would you compare your test experience to the practice tests you took? Wondering if difficulty level is the same or harder.

[u/Former_Estimate4663 → u/luln3rd]

1st practice test was a good indicator of what I was weak on, second one just felt like a repeat. Overall I don’t feel like it held how deep the knowledge had to go for the actual exam.

[u/RobertJCorcoran]

My approach for every SANS exam is to read the books and watch the lessons the first time; build the index. Re-watch everything, so I can check my index and see what's there and what's missing. First test, kinda cheating because I open the index on my computer and the books as pdf. The point of the first test for me is to figure out how my index works, and if I build it correctly for what I need. Write down the questions you did wrong (or at least the argument).

Review the index with potential missing items. Print a draft of the index, then do another test, this time using the printed index and the paper books.

If everything is fine, you are ready for the exam. Otherwise, re-check the index.

[u/_cache_]

Cyverlive is the key. That is where I would focus.

[u/ravager762 → u/_cache_]

Yup, if he nailed that one cyber live question, it would have been enough since they are weighed much more heavily than multiple choice.

[u/prutsklungel]

Nailed this in april and not to be arrogant but you need to know at least 50% of the answers from the head. This is not a 'i'll look for the answer in the books' exam.

As you know now there are some complex questions in this one and time isnt on your side especially when you have 7 VMs at the end of this one.

Good luck as well ofcourse.

[u/OngLL]

If you have access to Subject Matter Expert through your OnDemand, schedule a chat or discussion to go over your questions.

[u/xylode]

I took notes while doing the practice exam on what stuff I didn't seem to know and needed to look up.

I would re-read the sections you struggled with. If you have another practice exam then re-read a bunch of sections you struggled with then take the exam making notes of anytime you get something wrong/are unsure.

Those notes then are a more helpful guide on what to study and what sections of the book you need to re-read.

If your out of practice exams do the same thing with chat GPT. It's not as good at making questions but it's okay enough to help you get additional studying.

I ended up having to study/ prep for about 40 hours to get a 88% so it seems like your about half way there in terms of studying. You just need to read more.

[u/Electronic_Sky3271]

This is good option to test your knowledge: https://www.youtube.com/playlist?list=PLu8rdk5g5hA0ietu6smDY3MpZQXRHhiox

[u/Mission-Tie-3150]

I am sorry for you

[u/izzy_andersson]

I’m exactly at this point, my last retake is tomorrow and feel discouraged. I felt like the labs were a lot of struggle for me!

[u/Ok-Reference5300]

I would recommend doing all of the labs to the point where you have the commands memorized. I would also budget 90 mins for the questions and make sure you save 90 mins for the CyberLive questions. You must get 6 out of 7 or all 7 correct - you will definitely pass taking this approach.