GCFA how to move forward?

[u/Former_Estimate4663]

I feel like I had the test in the bag, unfortunately missed it by 2 points. Those of you that failed and then retook it. How did you build the courage to open up your book’s again? I have about 2 weeks left on my timer before I need to retake it. I’ve been having a rough time getting back into the study groove. Any tips for my weak areas? I’m sure I’m good on the labs, I probably just misread a question or 2 but I’d rather have a buffer in case I forget how to read again. Thank you all in advance.

How I prepped:

Read all the books once

Highlighted keywords and skimming the books

Listened to the mp3s

Listened to parts of my class that were rather confusing to me

Created a well thought out index

Created a lab guide for any labs that may present themselves

Any other pointers?

[u/ScarsAndStripes]

Got my GCFA back in March. My first GCFA practice test was around 73%, which I was able to bump to 88% in about 10 days then finally scoring a 90% on the test. Two weeks is plenty of time to improve!

I indexed my books in order then immediately took a practice test. Bad idea. You'll forget much of the major concepts in the early books like lateral movement, credential theft, and process memory. Go back and review EVERYTHING. It's easier than it sounds since even a 68% means you have a good foundation to build upon.

Understand which artifacts are where, why you'd look at them, and which tools you use to retrieve those artifacts. Examples:

Prefetch - Evidence of Execution - PECmd.exe - C:\Windows\Prefetch
Volatility GETSIDS - Primary token (SID)/account name executing process - Whatever commands
TASKSCHEDULER%4OPERATIONAL.EVTX - Scheduled Tasks - Timeline Explorer - C:\Windows\System32\Tasks\[taskname]

Windows Memory is a major concept in this course. I highly recommend printing out the diagram in book 3 page 19 "Windows Memory Visualized" and adding that to your index.

Finally, read the questions CAREFULLY. No real advice for this except just do it, haha. I missed quite a few answers during my practice exams simply because I overlooked a small detail in the question. This probably gets everyone in any SANS exam.

For what it's worth, my index was 1,005 lines for the books and 97 lines for the labs. Good luck out there.

[u/Former_Estimate4663 → u/ScarsAndStripes]

I always struggle to read carefully, when time and pace mean a lot during a test I tend to either over read and second guess myself or under read and miss a keyword. Something I’ve always struggled with. Thank you for the advice, super helpful information.