SANS FOR 508 Content Changes?

flaminius

Hello,

I have attended the FOR508 course in Dec 2012 but I did not sit the exam. I had no problems with the material (very well presented by Chad) and the last challenge (the Hydra scenario) I thought was a lot of fun.
I am thinking of challenging the exam so the query that I have is straightforward. Has the content of the course changed radically in the past 16 months to the point that I should do the course again (which would be expensive) or can I use my old materials and still have a good chance of passing the exam?

Thanks,
Mihai

LionelTeo

From reading from threads on the internet on regards to GIAC exam changes, it has been mention via people that there isn't really much changes with exception to possible one or two syllabus add on. Your answer can be found if you can dissect the knowledge into two section, first would be baseline knowledge or technology that never change, this could be the same forensic methodology and forensic methods that has been applied over again for the last ten years, the other would be emerging trends, which could cause by obsolete technologies or new defense, which are usually replaced by new tools or methods, OS, systems; similar example would be that the attack to smash the stacks has always been the same since 1990, but new defenses like DEP and ASLR are introduced over the course of 10 years. Within two years, over 90% of the knowledge covered would probably still applies in the GIAC exam.

docrice

I just took FOR508 in San Diego and my guess is that the course materials is mostly the same from when you took it. You could also email the instructors (Chad and Rob) to see how much of a diff there is between then and now.

JDMurray

Specifically, ask about any changes in the tools and the target devices and OS platforms in the courseware. Those are the areas that tend to change the most frequently in digital forensics.

sura23

hi guys
My Gcfa exam is next month. Can anyone help me with Gcfa on demand self study book.Pleeeease

cyberguypr

Not sure what exactly are you asking but as a gentle reminder courseware is proprietary. You'll need to pay the course to get the books.

docrice

And to further clarify, here is the verbiage from the Courseware License Agreement:

User may not copy, reproduce, distribute, display, modify or create derivative works based upon all or any portion of the courseware in any medium whether printed, electronic or otherwise, without the express written consent of the SANS Institute. Without limiting the foregoing, user may not reproduce, distribute, re-publish, display, modify, or create derivative works based upon all or any portion of the courseware for purposes of teaching any computer or electronic security courses to any third party without the express written consent of the SANS Institute.

sura23

I have give three practice exam for gcfa, some of the questions were also repeated. I wanted to know do any of them come in real exam.

docrice

The questions on the practice exams might be questions on prior versions of the real exams (or of similar nature), but I don't think they're repeated on the real exams given currently.