Looking for Index Building Tips

Robicus

Hi ya'll,

I'm officially registered to take my first SANS cert next month. Specifically, I'll be sitting the GSEC exam.

I've heard time and time again, the importance of building a thorough and effective index. But I haven't come across what exactly constitutes a great index.

Using Excel, I'm currently organizing data into a 4 column table, sorted alphabetically by term: Term/Concept | Book # | Page # | Description.

Does that pretty much sum up the bare bones on a index? How lengthy should I anticipate this growing? (I've searched the forums and read that some people have 5+ page indexes). How detailed should I go with terms/concepts?

I have about 6 more weeks before I sit the exam, so I plan on going back through all of the books and building the index as I go. Does that seem like a reasonable amount of time?

Thank you!

cyberguypr

What you describe is exactly what I did for the GCIH, GCED, and my upcoming GCFE. See a glimpse of my index here: http://www.techexams.net/forums/sans-institute-giac-certifications/98047-passed-gcih.html.

Superpeon

I'm also currently preparing for my GSEC exam and building my index, format is exactly the same.

I'm finding that I feel more comfortable that I include EVERY single key word I come across in the books as well as double entries such as ar$sha - source hardware (arp) and source hardware (arp) - ar$sha. This way I know if I need to refer to my index during the exam, either entry I look for will be there.

I suppose there's no harm in being as granular as possible, at least all the information will be listed out

Robicus

Thanks for the awesome information, cybergypr! Good luck, Superpeon!

tumblejerm

I have taken the GCED course in San Diego in May 2016. And I have been struggling to prepare for this test. I have created an Index of all 6 books and took my first practice exam and got a 49% . I thought my index failed me and had a hard time finding the tools and attack types from within my Index and really don't know how to improve it as I spent over 8 hours creating the index.

Is there any way I could borrow your index and I could e-mail you mine as well to see if i'm doing it right etc. This has been giving me anxiety for months now and I'm not sure what else to do.

TechGromit

tumblejerm wrote: »

... really don't know how to improve it as I spent over 8 hours creating the index.

8? I put in around 60 hours building my first index. To be fair I was building my index while studying, so I was adding entries that I felt were important in drips and drabs. I think I had around 120 to 140 hours total study / preparation time.

tumblejerm wrote: »

I have created an Index of all 6 books and took my first practice exam and got a 49% . I thought my index failed me and had a hard time finding the tools and attack types from within my Index and really don't know how to improve it as I spent over 8 hours creating the index.

How big is your index? My first one was over 1500 entries. Also your index is an aid, not a replacement for good studying.

cyberguypr

Step 1 is relaxing. Panicking and cross posting in every single GCED thread will not help you. I gotta say, a 49% is pretty low. What is your security background? Did you pay attention in the class? Is this your first GIAC cert? I am trying to gain a better understanding of what is going on here. SANS courses are pretty straightforward in the sense that if you take the course and assimilate the content it's practically a guaranteed pass.

One of our members created this index guide and it's pretty similar to what I've done for my 3 GIAC certs.

TechGromit

I think he's looking for a ready made index someone created to use to pass his exam. Looking for the the easy way out. Also he's getting his 10 posts in so he can receive PM for his index.

gwood113

Your spreadsheet columns are a win. All the advice given thus far is good. Here's my two cents:

Your index should be thorough (50+ pages is not uncommon) and have recursive entries (e.g. Icmp attacks AND attacks icmp). Indexes are an aid. If you index well enough you won't have to open the course books which saves you time; giving you more time to look up other things. Time is your greatest enemy on a GIAC exam. There's not enough time to lookup/verify every answer in the course books - remember that if nothing else.

Also, a personal preference but get your index printed and spiral bound. It's cheap (~$20 from Office Depot) and it is a lot less clunky than a 3 ring binder.

E Double U

For my GCIH index, I created an Excel workbook that had 3 worksheets: Subjects, Tools, Commands.

Subject (290 rows): columns were term, book, page, description

Tools (236 rows): columns were tools, book, page, description

Commands (168 rows): columns were commands, book, page, OS, description

I also created an outline on the topics which included subtopics.

kiki162

Here's another tip for all your first timers!

Once you have created your initial index, read all of the material (yes ALL OF THE BOOKS) again, update your index, and repeat. Going through the material at least 3 times over should be sufficient enough to get a quality index together.

Most of us read through the material, and miss important areas. Some ppl also may not review links posted within the books, which could could have important info you can use/bring to the actual exam.

E Double U

kiki162 wrote: »

Once you have created your initial index, read all of the material (yes ALL OF THE BOOKS) again, update your index, and repeat. Going through the material at least 3 times over should be sufficient enough to get a quality index together.

I did the same thing. I actually went through the index after each practice exam because I obviously missed things. Then one last time the day before the exam.

2.3%Neanderthal

Good afternoon all. I just finished the FOR408: Windows Forensic Analysis class in VA Beach so I figured I would chime in as I am working on my index for the exam. SANS now gives it's students an index in the back of book #5. It is ok, but it needs to be refined a bit. I will attach a picture of what that looks like as well as how I am building my index.

https://drive.google.com/open?id=0B_XohpDP-aGFcXBJeWJiY0YxZ2M

https://drive.google.com/open?id=0B_XohpDP-aGFaTZldWtiWlBuQk0


I am going to put a good bit of info on mine as I wanted to build my index as well as use the time to study. I learn best by reading and writing the material. Just how my brain works. Hope this helps.

gwood113

2.3%Neanderthal wrote: »

SANS now gives it's students an index in the back of book #5.

That sort of thing varies by course and author: FOR508 has an index in the last book, like FOR408, but FOR572 and FOR610 do not; SEC505 even has a table of contents in each book.

Included indexes/tables of content are not definitive however; use them to guide your index creation and study but don't limit yourself to them.

jackveneno

@2.3%Neanderthal, I really like and think that is the way to go for the index. I have a similar one but if possible would like to compare it with your and make mine a better index. If possible can you please share it with me. Also did you take/pass the cert?

TechGromit

2.3%Neanderthal wrote: »

SANS now gives it's students an index in the back of book #5. It is ok, but it needs to be refined a bit.

I've seen a co-workers set of SANS 401 books that were a couple years old, there was an glossary in one of the books, but it wasn't in the newer books. I tried to use it for my first practice test along with my index, it was next to worthless. If the first photo was the index from the book 5, looks like they are telling you every place the key word appears in the books, many of them had multiple entries across several books. It looks like it be a real disadvantage to try to use it for an exam, you spend too much time trying to look up an answer from six different reference pages.

sb97

One thing I have done for the For408 exam is transcribe one of the posters to excel (The Windows artifact evidence of poster). I know you get a PDF copy of the posters. I am hoping that the act of transcribing it really drives home the data on there. Even if it doesn't, it will still be a bit easier (for me) to reference my sheet in a pinch.