GCFA Study Resources

grahowler

Hi

I've registered to do a GCFA exam and I've got just under three months to complete the exam. I'm experienced enough to know roughly 40-50% of the content but obviously that's not good enough to go in to the exam with.

I can't do a SANS course so I started looking around for material online. It wasn't long before I discovered just how many "Pass Guarantee or Money Back!" offerings out there. I'm sceptical about this kind of stuff but, probably stupidly, I bought the *********.com testing engine, without realising that it didn't include PDFs. The testing engine is good practice, but I no know there are a heap of "pass guarantee" offers out there with PDF downloads.

I see that the GIAC exams are open book, you can take in written material. Does this mean that you can just print out these PDFs and you've basically got all the material?

Regardless, what do you think is the best study material is?

Thanks.

TechGromit

Yes, you can bring in any printed material with you, whether it be Official SANS books, other books, printed or handwritten notes, etc. Writing materials or computers are NOT allowed. My recommendation for taking the exam if you do not have the official books, is to try and get other books on the topic, and build an index of topics covered on the exam, so if you get a question like what is the FBI, and don't know what it is, you can look at your index and see that book 2, pages 104 has the exact definition of what the FBI is. Of course Computer Forensics InfoSec Pro Guide and Guide to Computer Forensics and Investigations are not going to be labeled book 1 and 2, but you can label them as such to make identifying them easier during the exam. Do not depend on the table of contents or the index in the books, your not going to have enough time to search for the answers, an index will tell you exactly what book and what page (or tab # like I use) to look up if you don't know the answer.

As for "Pass Guarantee or Money Back!" sites, usually they give you questions from the exams to study, so your "Guaranteed" to pass the exam. This is considered cheating. Generally organizations giving the exams have have wised up to this practice and it really doesn't work anymore, but good luck getting them to pay up if you don't pass. As for passing the exam using one of these sites, SANS updates there exams at least once if not several times a year, so chances are the questions you studied for will be outdated and not be on the exam. Cisco exams I believe randomly pulls the questions from a pool of 5,000 possible questions, it's probably easier to just study for the test, then memorized 5,000 possible questions.

Note: I'm not recommending the Computer Forensics InfoSec Pro Guide and/or Guide to Computer Forensics and Investigations they were just used to make my point, I'm not qualified to make any resource recommendations for the GCFA exam.