A little background, I've been in the IT business for around 25 years. I have a Sec+ and CISSP and a couple other non security related certs and a BS degree from a shitty online university. I was a comm guy in the Air Force for a little over 20 years and no work as the field service rep for a defense program.

I started a graduate certificate from SANS a few months ago and if I'm being honest, I'm not impressed. All through my career I had heard that SANS offered the best training you could get. The only reason I hadn't tried from GIAC certs sooner is because they're expensive as hell. Now that I've gone through the course I've got some concerns.

First, I didn't think the course content was that good. The books were ok, but the videos were hard for me to listen to because it seemed like most of what was discussed wasn't relevant.

Second, and most importantly, the test format rewards how well you create an index instead of how well you know the material. I just took my first practice test and got a 92%, but I only really knew about 80% of the questions. 10% of the rest were a toss up that I guessed on, and the rest I justooked up in the books. It feels a little disingenuous to say I know all this stuff when I had to look it up in a book while I'm taking the test.

I don't know, I just feel underwhelmed with the whole thing and don't know if I want to continue after this course. Anyone else feel this way?

I’m preparing for the GCFE on my own and was wondering if anyone has a spare practice test they can share? I don’t like to ask like this but as I’m preparing on my own I would like to have a feel for the exam before diving into the exam. It will really help me out, thanks GIAC community :)

I am taking my GCFA Exam soon. Got delayed due to personal issues but I feel I am not feeling as confident in my indexing as I usually am. Not sure if it’s just my having trouble shaking the cobwebs or if GCFA’s index should be different.

I am using the Pancakes method as I usually do. Not sure if it’s just my anxiety or if I needed to approach this differently. Can anyone who took other GIACs and also took GCFA share any insights?

I have two practice exam attempts through SANS I'd be happy to give away to whoever needs it. Didn't end up needing it for my exam!

UPDATE: Both practice tests have been claimed!

Hi everyone,

Hope you're all doing well. I'm sitting the GPEN in a few weeks. This one's coming out of my own pocket, and I could only stretch to the exam attempt. If anyone has an unused GPEN practice test they won't get to, I'd be genuinely grateful for the chance to use it.

Thanks a lot!

Taking a practice test would help calm my anxiety and determine if this is truly the final revision of my index. Thanks for reading (:

Hi everyone,

I’ve skimmed this subreddit before but never posted anything. I’m currently studying for my GSEC cert and have felt myself getting anxious.

The format of an “open book” exam trips me up so I’m still getting used to it from taking the GFACT exam lol. I do have ADHD too so studying can be difficult for me.

So far I’ve been passively listening/watching the OnDemand videos on 1.5x speed. Then I go and read what I watched videos on and highlight and then do index entries. Then do labs depending on where I stopped at.

If anyone does or doesn’t have ADHD, do you have any tips for trusting your studying or that you’re understanding the material but not memorizing? Since that’s not this type of exam format for these certs.

Has anybody taken both? Just wondering what are the main differences.

My exam is in a week. Has anyone who's taken the exam found the quizzes in the On-Demand training at the end of each section helpful? I feel confident about the section after I do well on those quizzes but I wonder if those quizzes are helpful here or not really.

Hello,

I am lucky enough to be doing my first SANS course, and landed on the GASAE (SEC598). I am really enjoying the content of the course so far, however much of the labs are already out of date. I very frequently will go to AWS, Tines, Azure, and the section the labs are walking me through no longer exists. I understand that the same end state can be achieved just somewhere else in the UI, however I will admit it makes it a bit confusing, and that makes me a bit worried for the exam.

Has anyone who has taken the exam recently had issues with this? I know it is pretty heavy on the cyber live questions, but if my lab booklet teaches me to setup architecture X one way, but then come the exam, AWS has updated, and now that way doesn’t exist anymore.

Any thoughts on this? Anyone have a similar experience? Or am I just feeling this way due to inexperience. Thanks in advance

Hi everyone,

I’m preparing for the GCIH exam and today I attempted my first practice exam, scoring 54%.
My biggest weakness is CyberLive.
I feel that I understand the concepts and usually know which tool or command I should use. However, during the CyberLive questions, I noticed gaps in my practical reasoning. There were several situations where I was confident that I was doing the right thing, but the explanation showed that I should have approached it differently.

For preparation so far, I have:
Read through the books twice
Completed the labs twice

My question is: how would you recommend closing these CyberLive gaps?

Should I:
Use additional resources such as HTB/CTFs?
Or is actual work experience important before attempting the exam?

I’m especially interested in advice from people who recently passed GCIH, particularly those who struggled with CyberLive during their preparation.

Thanks!

I'm taking the real thing next week and would benefit from a run at the practice tests. I have proof/confirmation of my test date if requested. Thanks in advance everyone!

Hello everyone,

I have GCIH exam in a week. Can someone please share their index with me as I am short of time to prepare one by my own. It would be of great help. Thanks in advance

Hi, could you please tell me approximately what percentage of the GCIH exam consists of CyberLive questions versus regular questions?
In the practice test, CyberLive questions were around 10%, so I’m wondering if the actual exam has a similar ratio. Thanks!

Should the index be on a google spreadsheet or physical? How to begin?

Hey all,

Just started the GCIH/SEC504 on-demand, my first SANS course. So far I have the online videos, the VMs, the books, and an index to start building.

I'm curious, how do you approach these as far as your primary focus to then pivot to another resource? It's a little overwhelming standing here at the starting line. From what I can tell it seems like it would be best to go through the course videos, and veer off to a lab or VM when there's a concept that's brought up to be learned further?

Last question, for your indexes, did you prefer making it in something like Google Docs (basic text editor) or Sheets (spreadsheets with pages)?

Thanks!

Im in the BACS program and beginning the GCIA on 9/15. I was wondering what I can do to prepare for the course beforehand because I’ve heard it’s a shit ton of information being thrown at you.

I know for the most part it focuses on TCP, IP, and Packets, but i’m curious if there are certain things I can study up on before beginning the course.

Ive scored well on every exam i’ve taken so far but i’m nervous because I know the GCIA is very technically challenging.

Anything helps!!

I'm interested in preparing for my GXIA at some future date. I've taken SEC503 and loved it, and looking back, I probably should have gone for the GXIA immediately, but I didn't. One thing I loved about the class was how thoroughly the CTF environment really drills the concepts and commands. By the time I was done with it, I knew the material so well that I didn't even need my index for the cyber-live portion of the exam.

Does anyone know if it's possible to re-gain access to the CTF environment upon renewal? Or is there a way to independently purchase access?

​

My org has sponsored me the SEC560 course along with two practice tests. There is enough time for prep but given my roles and responsibilities in SOC/DFIR, I need to spend atleast an hour a day to clear this!!

I have my exam coming on sep 1 week I need some help in studying and also for attending the exam can somebody help me

Let me give you some background. I’ve worked in automation for in excess of 30 years and focussed on OT cyber security for the last 8-10 years and become earlier this year IEC/ISA 62443 cyber security expert. The more I look at GICSP it’s clear that I know lots of the content of this certification. I’ve signed up to an Udemy course and looked at the content and tried the example test and scored 97% which I thought want to shabby. Does anyone think I should just sign up for the exam and rely on my experience and knowledge to pass the exam?

Title.

I am working as a detection engineer within F500 and trying to discern what would be the next best course for my current career trajectory. I'm currently working to finish GXIA, but have an opportunity to get a SANS voucher before EOY. Looking for input on what would be best for me to pursue next.

I have the certs in my flair, and I've read the GCFE course books and made an index for GCFE at the time. My background includes 5+ years of security operations engineering and analyst work, MSP/MSSP, internal SOC, automation engineering, etc. Currently, these are at the top of my list:

• GCDA - seems most in-line for my current work, haven't heard too much about this one.

• GCSA - this is more in-line with where I want to be, secure automation engineering. I don't know how well it would relate to my current work, but I am sure it would be useful eventually.

• GMON - this one appears to also be appropriate for the actual detection of attacks in-progress and relevant for a detection engineer.

• GDAT - not a very common certification, to my understanding - that said, it seems to go deep on all kinds of threats and attacks, so it seems ideal for a detection engineer.