Passed GSEC. Here is My Advice and Experience

thelumberjack

I took the SANS 401 class in June. My instructor was Dr. Eric Cole. Very good teacher and I did learn a lot from this class. I'm not an infosec rainman by any means, so here is my experience.

I haven't been an infosec professional for that long. Less than three years. knowing this going in, and knowing that I would be attempting a cert, i really made myself prepared to pay close attention throughout the entire class. Now, with any bootcamp style class, this wasn't always easy, but i found it easier than expected as the material and the manner in which it was taught was really engaging for me. The class by itself is worth the price of admission. I took notes where I could, but found myself doing this mostly in the books themselves, and highlighting items that i wanted to go over later.

Once back home, I knew that in order to pass this exam, i needed to work hard. So i studied pretty much every day. My regimen was to go through the books once, highlighting key material as i went. I dedicated myself to atleast 25 pages a day and 50 on the weekends. I gave myself one day off per week.

Once I was through the books once, I read through them again, mainly focusing on the highlighted items. My next task was to build my index.

I have read on here many stories of people using indexes. I haven't seen one person not use one. Where it differs from person to person is the length of the index. After reading through other people's experiences, I came to the conclusion that as long as your index is well organized, it can be as long as needed. With that said, my index ended up being 55 pages long. I then took it to kinkos to have it printed and bound, this was a great move. As my index was lengthy, it was organized and bound so I didn't have a bunch of papers to shuffle around.

Once this was done, i took my first practice test. I made an 85. I looked over the material that I was weak on, and then attempted another practice test. I made an 88 on the second one. Once this was done, I was about 1 week before i had to take the real test. I did not study anymore. At that point, I either knew it or I didn't.

I took the test, and was stoked that I crushed it and made a 93. The test is technical in many aspects. And I found that knowing the concepts was the key. having a good index was another key. this raised my score dramatically I'm sure. But you need to know the concepts. In a lot of cases, you can't just turn to page X and see the answer. The test is given in a way that you must be able to identify and understand the concept of the topic.

The bottom line is this. Do the work. Don't expect to bring a copy of your practice test in and nail it. I think there was maybe one question from the practice test on the real test. but they were very similar in style. Do the work. Study. and I really advise you to do an index. Don't be afraid to make it a big index. Just make it organized.

Hope this helps!

wolf9081

First congrats on the pass.

I agree the index is key. I just passed mine yesterday and I think I learned as much creating the index as I did setting through the class. I added a lot of information and description to my index and did not have to reference my books very often. My index ended up being about 130 pages. But that included the standard keywords with description of concepts etc. Screen shots of various tools TCPdump, breaking down ip headers etc. various **** sheets for HEX to Decimal and binary conversions. I created all the **** sheets myself which helped reinforce the concepts and memorize the content and common ports, protocols etc.