Hello Everyone,
First post here so I figured I'd give back to the community. I took SANS 504 this past October in Las Vegas. John Strand was the teacher. First off, John Strand is the man. He's so down to earth and delivers the material excellently.
I gotta say I got a man crush. This guy is legit. Check him out at Black Hills Security.
The material itself is very engaging.
I never read the books cover to cover as many recommended. I simply didn't have the time or the will power, but here is my advice none the less.
INDEX.
My index was ~30 pages w/ about 400 key points. My descriptions were a bit long which made my index longer than it really had to be. There were some key terms that I didn't have. My recommendation in hind sight. Go through the book page by page and index everything.
Tools, Attacks, Concepts, etc. Know the book and page number it's in.
I looked up ~80 percent of the questions, some times to simply confirm my answer. I had plenty of time, but I credit that to being able to find what I was looking for immediately.
If you can read the books, do it. Knowing the material is important specially when you're given logs and asked to describe what is taking place.
The exam is just like the practice exams. Same types of questions, same difficulty. I scored a 73 and a 79 on my practice exams. Use these exams to fine tune your index.
The most important piece of advice I can give anyone is to get a good night sleep and take a pre test ****. I learned this a couple of years ago.
I hope this helps anyone taking the test in the near future.
God speed.
