Fail GCIH

methylmethyl Registered Users Posts: 3 ■□□□□□□□□□
Hi guys,

I took two exams and failed both of them. the first score is 67% and the second is 70%. This would be the last time I can take before I can take again (provided I failed again the third time round). I took the practice test and pass with a score of 80%. The practice test and the exam is doesn't seem much related to the exam.

Here's what I've done so far
1) Create index
2) Went thru ondemand course twice
3) Flip the book (Just digusting important key words but not reading)
4) Didn't listen to the mp3s

How can I improve my scores? I know I had to read the book sooner or later. Any tips and advise, please? Thank you

Comments

  • al88al88 GCIH, GCFA, GNFA, GCTI, GASF, GISP, Sec+ Dallas, TXMember Posts: 62 ■■■□□□□□□□
    You have said it, read the book! I'm not sure how you created the index without reading it? If you using SANS index or someone's else then you doing it wrong.

    Plain and simple really. Good luck on the next one!
  • methylmethyl Registered Users Posts: 3 ■□□□□□□□□□
    Lol. Well, I actually scan and read the top part of the section of the book and ignore those at the bottom details area and flip thru to create the index.

    Anyway thanks!
  • GirlyGirlGirlyGirl Member Posts: 219
    methyl wrote: »
    Hi guys,

    I took two exams and failed both of them. the first score is 67% and the second is 70%. This would be the last time I can take before I can take again (provided I failed again the third time round). I took the practice test and pass with a score of 80%. The practice test and the exam is doesn't seem much related to the exam.

    Here's what I've done so far
    1) Create index
    2) Went thru ondemand course twice
    3) Flip the book (Just digusting important key words but not reading)
    4) Didn't listen to the mp3s

    How can I improve my scores? I know I had to read the book sooner or later. Any tips and advise, please? Thank you

    icon_scratch.gif
  • GirlyGirlGirlyGirl Member Posts: 219
    methyl wrote: »
    Lol. Well, I actually icon_arrow.gif scan confused.png and read the top part of the section of the book and ignore those at the bottom details area and flip thru to create the index.

    Anyway thanks!

    icon_eek.gif

    I see the problem. No response needed ..

    I would highly suggest doing the opposite of what you mentioned Sir/Ma'am. That is my advice from multiple GIAC experiences.

    If not, you have 365 days to study for attempt number four.

    Good Luck!
  • cyberguyprcyberguypr Senior Member Mod Posts: 6,917 Mod
    This makes zero sense: "This would be the last time I can take before I can take again".

    But anyway, as others said above, read the books!!! That's it. You need to make sure you understand every concept in detail. If something doesn't click go and research it. Care to post a pic/screenshot on the index you created? I have a feeling that could also be improved.
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    All the answers are in the books and honestly there isn't that much material to read compared to almost every other cert exam. Not to mention it is open book exam. If someone fails this they know they didn't try very hard. Like you said, you didn't even read the material and got 80% on the practice test. They need to get rid of the "open book" part of this IMO.
  • TechGromitTechGromit GSEC, GCIH, GREM, Ontario, NY Member Posts: 2,042 ■■■■■■■■□□
    methyl wrote: »
    2) Went thru ondemand course twice

    Just exactly what do you mean you "went thru" the course material twice? Did you follow along in the book and do the labs as the instructor lectured? Or did you stare glassed eyes as the instructor lectured, not paying attention? I can tell you from the Mp3's, it requires a lot of concentration to keep focus and absorb the material as the instructor is lectures. I sometimes have to stop, stand up, take an energy drink and repeat a section to make sure I fully absorbed the material, understood and completed the labs. In some ways the MP3's are better than when I took the course. I can pause the lecture, take my time doing the labs and try other approaches the instructor mentions. As well as explore some of the labs where there was not enough time to class to complete them. You obviously are not doing something right, if you properly prepare, I don't think the GIAC exams are too hard, but if you do not do the study and do what's required to learn the material, your going to fail.
    methyl wrote: »
    The practice test and the exam is doesn't seem much related to the exam.

    That hasn't been my experience, I scored a 80% on my second practice exam and got a 78% on the GCIH Certification exam.
    Still searching for the corner in a round room.
  • yoba222yoba222 Senior Member Member Posts: 1,230 ■■■■■■■■□□
    methyl wrote: »
    How can I improve my scores? I know I had to read the book sooner or later. Any tips and advise, please? Thank you

    1) Read the book
    2) Listen to the MP3s.

    I didn't make an index or even bring the books to the exam. But I read the books, cover-to-cover, twice. I also installed/played with every tool mentioned to the point where I could recognize a tool by its screen shot. I spent about 100 hours preparing for that exam.
    A+, Network+, CCNA, LFCS,
    Security+, eJPT, CySA+, PenTest+,
    Cisco CyberOps, GCIH, VHL,
    In progress: OSCP
  • yomistayomista Member Posts: 23 ■■□□□□□□□□
    Please read the books and not just flipping through. The OnDemand videos has better explanation by the author so you can focus on your weaknesses.

    Lastly, understanding the concept is key. It's not enough to memorize without understanding the content. I really hope you pass on your last attempt.
  • UnixGuyUnixGuy Are we having fun yet? Mod Posts: 4,280 Mod
    reiterating what everyone says...READ the books...

    not just read, but understand 100% of the topics. Don't skip a single topic

    Read something you understood 90% ..not enough..it has to be 100% understanding..if a topic sounds vague, read about it online...google it, ask questions in this forum


    Scanning and reading alone aren't enough, you need full understanding of each topic, only then you can make useful index and look for command options in books etc AFTER you understand what each topic really about
    Certs: GPEN, GCFA, CISM, CRISC, RHCE
    In Progress: MBA
  • LWB250LWB250 Member Posts: 59 ■■■□□□□□□□
    All the answers are in the books and honestly there isn't that much material to read compared to almost every other cert exam. Not to mention it is open book exam. If someone fails this they know they didn't try very hard. Like you said, you didn't even read the material and got 80% on the practice test. They need to get rid of the "open book" part of this IMO.

    I disagree with this mindset strongly.

    I can't count the number of potential GIAC certification applicants who have asked me about the open book aspect of the certification exams. This is often a veiled effort on their part to determine if they can just go into an exam with the books and pass it.

    As a multiple GIAC certificate holder, I assure them that attempting to pass a GIAC certification exam by just using the books is an exercise in futility, and a very expensive one at that. I think we all know that even with a good handle on the material that the ability to reference it or looking for confirmation of terms/concepts by looking at the books is a necessity for passing the exams. I also emphasize that you must have an understanding of the concepts and how to apply them. You can't just read the material, walk into the test center and sit for the exam and expect to pass.
  • docricedocrice Member Posts: 1,706 ■■■■■■■■■■
    GIAC tests are about methodology, data interpretation, using tools accordingly, and knowing how to apply skills in different respects for different situations. Unlike most vendor-centric exams, it's not just about tools. You need to fundamentally understand the material. You will not have enough time in the exam to flip through the books to figure out the right answer for every question.

    If you're solely relying on the books and/or an index to save you, you will fail ... and deservedly so.

    SANS courses are structured so you essentially go through the material several times, each time reinforcing it more. There's the first run through the class, then creating an index by reading through the books, then listening to the MP3s. If, after putting an honest effort into that routine, you're still not comfortable with the nuances of what's in the course, the material is either too advanced for your level of experience or you rushed through the course.

    The whole point of the exam is to test your comprehension of the material (and in theory being able to apply it in the real world), not just being awarded a four-letter badge. I sometimes see too much emphasis on the certification and less on building the skill.
    Hopefully-useful stuff I've written: http://kimiushida.com/bitsandpieces/articles/
  • E Double UE Double U Member Posts: 1,879 ■■■■■■■■■□
    methyl wrote: »
    I know I had to read the book sooner or later.

    LOL better sooner than later
    Alphabet soup from (ISC)2, ISACA, GIAC, EC-Council, Microsoft, ITIL, Cisco, Scrum, and more.

    2021 goals: AZ-303, AZ-304, maybe TOGAF and more ISACA

    "You tried your best and you failed miserably. The lesson is, never try." - Homer Simpson
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    LWB250 wrote: »
    You can't just read the material, walk into the test center and sit for the exam and expect to pass.

    I'll agree to disagree with this. If someone read the books and created their own index I find it would be hard to fail the test. At least the GCIH one... I admittedly looked up ALOT of the questions when I took my exam. It was a total crutch when I didn't know something. With a good index you can find things very quickly. And I don't think exams should take into account someone's ability to look things up at all. Just my 2 cents from my experience.
  • kiki162kiki162 Member Posts: 635 ■■■■■□□□□□
    Best thing I can recommend is having some experience with the material going into it. Create your own index as the material in the course index doesn't include ALL of the material that could potentially be on the exam. GIAC exams are REALLY GOOD for spreading topics out across multiple books, so it's not all going to be in one place. Another tip... Read through ALL of the books 3x times over. You will miss a lot of stuff just going through it once.

    Personally, GIAC exams are great if you soak up the material, have your employer pay for it, and have some knowledge of the material ahead of time. I think the price alone is a bit of a turn off. If you can get in on Work Study, do that!
  • TechGromitTechGromit GSEC, GCIH, GREM, Ontario, NY Member Posts: 2,042 ■■■■■■■■□□
    kiki162 wrote: »
    I think the price alone is a bit of a turn off. If you can get in on Work Study, do that!

    While I'm not fan of the price, I think it prices out a lot of your competition in the marketplace. There's 150K Security+ certification holders and only around 35k GSEC certification and 30k GCIH certification holders.
    Still searching for the corner in a round room.
  • Randy_RandersonRandy_Randerson CFE, GASF, GAWN, GCFA, GCFE, GCIH, GLEG, GMOB, GNFA, GPEN, GSEC, GWAPT, DFCP, ACE, CompTIA A/N/S+ Member Posts: 115 ■■■□□□□□□□
    I'll agree to disagree with this. If someone read the books and created their own index I find it would be hard to fail the test. At least the GCIH one... I admittedly looked up ALOT of the questions when I took my exam. It was a total crutch when I didn't know something. With a good index you can find things very quickly. And I don't think exams should take into account someone's ability to look things up at all. Just my 2 cents from my experience.

    I will apologize if this comes off terse, I do not mean any direct response to you in general. I think you have some very valid points that are up for discussion! But as you just said, the GCIH one...a course that is based on extremely broad material over the course of multiple facets of Incident Response -- which is having background in Pen Testing, Forensics and Reporting. For some, that material is HARD to know...but it is designed to be the baby steps into the realm of Purple Teams and helping the student decide if they want to do Red/Blue Team or DFIR. But if you think you can learn the material in like SEC660 (GXPN) or FOR610 (GREM) and go take that test without the books, you are sorely mistaken. Even OSCP and OSCE allow cert takers to use materials they have been provided. Teaching people to cram for a test (much like CompTIA or ISC2) does nothing to actually teach a candidate the material. it merely teaches them to regurgitate an answer, regardless of why that is. At the very least, a candidate who is taking GIAC has actually used hands on labs and understand what they are looking at.

    I've seen prospective new hires who have CompTIA's Trifecta of intro certs and CCENT and not even know how the interpret a tcpdump of a pcap file and tell me what is actually going on with the IPv4 or IPv6 traffic. That is a massive problem in this field right now. Get the certs you feel you need to succeed, but I hope you are actually learning what that cert is trying to hold you to, too.
  • johndoeejohndoee Member Posts: 152 ■■■□□□□□□□
    TechGromit wrote: »
    While I'm not fan of the price, I think it prices out a lot of your competition in the marketplace. There's 150K Security+ certification holders and only around 35k GSEC certification and 30k GCIH certification holders.


    I can't give you positive rep at this moment. I need 10 people to give TechGromit positive rep for me.

    Thanks in advance.

    Mr. John Doee (don't forget the e)
  • cisco_troopercisco_trooper Too many Member Posts: 1,442 ■■■■□□□□□□
    ...but I hope you are actually learning what that cert is trying to hold you to, too.

    ^^THIS is what you SHOULD be after.
  • _nessie__nessie_ Member Posts: 39 ■■■□□□□□□□
    Seems like you lot scared the OP off ...
    Or he/she's finally reading the 'small prints' in the books and recreating the index ...
  • _nessie__nessie_ Member Posts: 39 ■■■□□□□□□□
    TechGromit wrote: »
    While I'm not fan of the price, I think it prices out a lot of your competition in the marketplace. There's 150K Security+ certification holders and only around 35k GSEC certification and 30k GCIH certification holders.

    Agreed, but as long there are HR-filters that require a (Comptia, anything you want)+ and don't know about G(IAC, anything else you want), people will acquire these certs and may stop there .. unfortunatly
  • TechGromitTechGromit GSEC, GCIH, GREM, Ontario, NY Member Posts: 2,042 ■■■■■■■■□□
    cyberguypr wrote: »
    This makes zero sense: "This would be the last time I can take before I can take again".

    I believe GIAC only allows you to retake the exam three times, before you have to repeat the course before making another exam attempt.
    _nessie_ wrote: »
    Agreed, but as long there are HR-filters that require a (Comptia, anything you want)+ and don't know about G(IAC, anything else you want), people will acquire these certs and may stop there .. unfortunatly

    If a companies Cyber Security organization never heard of GIAC's, it's probably not an organization I'm interested in working for in the first place. :)
    Still searching for the corner in a round room.
  • HiggsxHiggsx Member Posts: 72 ■■□□□□□□□□
    I passed GCIH almost 2 years ago.

    YOU HAVE TO READ BOOK slowly.
    YOU HAVE TO WATCH AND TAKE NOTES WHILE LISTENING TO VIDEOS.

    combine above two. take notes,read book slowly and watch videos. But take notes! do practical exercises. There is no other way :)

    Sorry, I'm honest but failing at GCIH is shame. It is an easy exam. Nothing crazy stuff like OSCP for example. Just A,B,C,D,E answers(sometimes less)
  • _nessie__nessie_ Member Posts: 39 ■■■□□□□□□□
    Higgsx wrote: »
    It is an easy exam.
    I kind of agree with you, *IF* you do what you mentioned :)
    What I usually do: read book slowly, read again build index, don't forget the labs, do research on the tools that are mentioned (output they provide, possibilities and limitations of the tools ..)
    I usually fall asleep when watching videos .. happens to me when I'm in class as well .. icon_redface.gif
  • franziskanerfranziskaner Member Posts: 20 ■□□□□□□□□□
    I think the index tactic is somewhat over played with this exam. My study routine was something like:

    Listen to MP3 while driving
    Read the books cover to cover at least 2 times, then skim reading few times after that
    Made detailed index
    Repeated labs at home once
    Practice exams

    By the time it came to the real thing, I had a very detailed index with every term in but didn't need it that much as I knew the material. Most answers I looked up I already knew but just did so for checking as might of been unsure. I think I only changed a few after checking the books.
  • ErtazErtaz Member Posts: 934 ■■■■■□□□□□
    Congrats! Thread title appears to indicate you failed though.
  • franziskanerfranziskaner Member Posts: 20 ■□□□□□□□□□
    Ertaz wrote: »
    Congrats! Thread title appears to indicate you failed though.

    I passed with a near perfect score first time. Was just giving some tips for the OP on what I found worked, and the index played only a small part.
  • ErtazErtaz Member Posts: 934 ■■■■■□□□□□
    I passed with a near perfect score first time. Was just giving some tips for the OP on what I found worked, and the index played only a small part.

    DOH. Entirely my bad. I came in on the second page and thought you were OP.
Sign In or Register to comment.