GCFE Index

ethkhkr

Fellow Forensicators,

I am in the process of building my Sans 408 index for the GCFE certification. Is it recommended to index the appendix that is included AFTER the main material covered in class? This will be my first GIAC certification and I have no idea what to expect.

Any assistance, advice, or guidance is greatly appreciated.

- ETHHKR

docrice

If the appendix helps you understand the material, I say go for it. That said, my approach is to index material that is strictly covered in class. Sometimes the appendixes have extra information which is very useful on the job, but if it's not covered on the exam, I avoid stretching my brain too thin and increasing my chances of failure. In other words, it depends on the appendix and the course. Some SANS courses that I've taken had exam-relevant appendixes, others more as helpful hints.

Everything ties together in the subject matter though, so it also depends on your learning habits.

ethkhkr

Has anyone taken the GCFE and if so would you say the material within the apendix in the back of the books appears on the exam? Thanks for the reply

- ETHHKR

docrice

I took the exam a few days ago. While I can't directly answer your question (since I'd otherwise be leaking what might be on the exam itself), I would say that if it was covered in class, expect to see it covered in the exam.

ethkhkr

Docrice: how long was your index? I have thought about creating **** sheets for the more dense topics (registry, log files, etc). Did you go through the workbook as well? What was your approach to studying

docrice

My index was around 15 pages with the font on the small-ish side. This is to reduce "page-flip latency," meaning I'm too lazy to turn paper so the shorter my index (physically), the better.

I've discovered that I rarely use my index anymore and rely mostly on the actual books. I tend to look at the courseware a lot, but much of the time it's to confirm my answer, which I'm usually right or in the ballpark. My index did have a bunch of registry key and file paths, but in the end I relied much more on the books than anything else.

The GCFE took me two hours and twenty minutes, which proportionately is a significant amount compared to most other GIAC exams I've taken. It simply means I wasn't as well-prepared for this exam as I wanted to be, but I knew this going in. In the end, I just wanted to get it over with and get back to work.

When I study for GIAC exams, I generally go through the course, then listen to the audio during commutes (I didn't do this with the GCFE), then index. This results in three passes through the material from different angles for varying degrees of reinforcement.