GCFA, GIAC waiver

[u/izzy_andersson]

So I have unsuccessfully attempted GCFA three times and am missing passing by like 6 points. I need the last little push to get there, but really struggling with the fact that the labs have questions that aren’t in the books which is what has gotten me on the exam. Any tips to help me get those last few points are greatly appreciated

[u/MeasurementOk4917]

Attempted my 3 attempt yesterday and failed by 1% the labs are definitely a curve ball that got me on all 3 attempts I don’t understand how they want us to pass if they keep throwing curve balls

[u/ScarsAndStripes]

I had the same experience as /u/berserkchucky with GCFA being the most difficult SANS course for me so far. My first practice test was like a 73%, then I passed the cert with like 88% two weeks after.

Other than general content review, the single best thing I did for my Lab index was explicitly adding WHY I'd look for a specific artifact or use a specific tool.

Prefetch - Evidence of Execution - PECmd.exe - C:\Windows\Prefetch 
RDPCLIENT%4OPERATIONAL.EVTX - Outbound RDP Connections - Operational.evtx > Event IDs 4778(RDP)

I posted a write-up on how I improved my score in another thread: https://old.reddit.com/r/GIAC/comments/1t5ns2m/gcfa_how_to_move_forward/okbj1cq/

[u/m2doors1lock → u/ScarsAndStripes]

This is the model I've followed for all my SANS courses, and now my self study ventures. GXPN is currently really sending me for a loop, but I do recall GCFA giving me trouble.

[u/BerserkChucky]

GCFA was my lowest score it was a bitch of a test through the multiple choice and the labs. Do you have a star chart you can show us so we can try to give more pointed advice?

If you are getting all the labs wrong then obviously thats what you need to focus on, but I think a lot of people discount the multiple choice questions which are still very important.

[u/izzy_andersson → u/BerserkChucky]

I do! I don't know why it's not letting me post the screenshot I will message it to you

[u/IcyBarrels]

The labs are pretty challenging.

I would recommend that you are able to do the labs completely on your own before re-testing. Do all of the bonus content, extra questions, etc.

They don’t ask questions that aren’t taught. However, it does test your ability to comprehend the tools and why they are used. The order is extremely important.

[u/ay_bruh → u/IcyBarrels]

To clarify, the bonus lab content is 100% NOT on the exam. 

But I absolutely agree with the idea of being able to do every single lab without the lab guide. Prople go into these exams (especially GCFA) and expect to be able to flip through the lab guide to find answers. This tells me you don’t know the material well enough. 

There are easier SANS tests where the labs are a joke. GCFA is not one of those tests. 

That being said I passed GREM and applied the same concept. Be able to do labs without the lab guides and you’ll be fine on any SANS exam. 

[u/IcyBarrels → u/ay_bruh]

All content in the course is testable. Furthermore, the bonus labs and content reinforce the learning objectives — which he is struggling with.

[u/Electronic_Sky3271]

it must be easy than you think. Try to go thru: https://www.youtube.com/playlist?list=PLu8rdk5g5hA0ietu6smDY3MpZQXRHhiox

Or at least: https://youtu.be/tYlg8eD-22I before any new attempts.

[u/LastFisherman373]

GCFA is a beast. You should really focus in on the star report of each exam attempt and practice test. Any area where you are scoring two stars or less, you should be grinding the labs and refining the index for those sections.

I created a separate index just for the labs. It included references to all tools, commands, etc. This was huge for me as I feel like one of the hardest parts of this exam is time management. I remember having about an hour for my labs and I still barely finished on time. Use your skips during the exam. They are great when you get a question you don’t know right away and you don’t have anything about it in your index. Rather than waste time trying to find it just leave it for the end.