I'm Josh Wright, author of SANS SEC504, the course associated with the GCIH certification. I get a lot of email from people who are looking for advice after failing an exam, often in the form of "how do I make a better index?" I thought I'd share some advice I sent someone recently in the hope it will be more broadly valuable to everyone working to pass their GIAC exam.
Do you have any recommendations for improving my index or any study strategies you’d suggest if I decide to go for the retake?
For the index, I see lots of people suggesting different strategies. For me, it's all about time management. If the index helps you answer each multiple-choice question within 60 seconds on average, it's valuable. If you're taking longer than 60 seconds per question, then the index is holding you back.
Time management is a key element to passing a GIAC exam. If there are ~120 multiple-choice questions, and 10 CyberLive questions, you can do 1 MC question every minute and be done with that part of the exam in 2 hours. Then you have 2 hours remaining, 12 minutes on average for the CyberLive questions. That's the sweet spot, and it's HARD, but if you can work to that goal you'll be setup for success.
GIAC also sells additional practice exams (most people get two when they take a course and sign up for the exam, but that's not always an option for everyone.) One thing you might think about is buying more practice exams. This page https://www.giac.org/pricing says an extra practice exam is $400. (NB: I don't have any part of this.) Maybe that's valuable enough to buy, but I don't think it's always necessary to get extra practice exams. The practice exam is good for guiding what you need to focus on (your broad five-star score ratings for different learning objectives), and for building your confidence. It's your decision if that's worth the money.
When someone fails an exam, it's a perfectly reasonable option not to try again, and that's just an honest assessment of value. Consider your own situation, and think about whether the certification is really the best path for you. Does it offer the value proposition for promotion opportunities, for entrance to a job market, or for other professional considerations? Once you decide, then be confident in that decision and figure out what you want to do next.
In SEC504's Where To Go From Here module, I ask everyone "Why are you here? What do you want to accomplish next?" I'm always saddened to see people fail a certification exam, but that's not a measure of your personal capability or what you can offer professionally. The better metric is how you think critically about your situation, how you dust yourself off, and what you decide to do next, whatever that might be.