Looking for Tips/Advice for making a index for GCIH

Just looking for some tips or advice on how to start making an index for the GCIH.

I have watched the ondemand videos, and now reading through the books.

I have had a look at https://www.giac.org/media/exams/prep-guide.pdf, but looking for anymore tips.

Thanks

jim

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

supasecuritybro

This was helpful for me. I found that after my first practice test I needed to add a column with more details.

https://tisiphone.net/2015/08/18/giac-testing/

cyberguypr

There are several approaches. Some people like adding a thousand tabs, dividing the index per topic, etc. Find what works for you. Here's how I approached it: http://www.techexams.net/forums/sans-institute-giac-certifications/98047-passed-gcih.html

j1mgg

Thanks, Good read of both posts.

I guess it is getting the balance from having too much information, but maybe just not having book and page number. It would be really helpful to be able to answer the question from the extra snippet that could be added to the index.

kanecain

I have found, the less detail in your index, the less time you will have to use it during the test. Which is the point. Realize that you will have on average, about 1:30 minutes per question. If you are spending most of that time hunting through an index, you will notice time FLY at a very fast rate. At trust me, SANS tests are 80% knowledge, 20% race against the clock. Here are my suggestions:

1. STUDY THE MATERIAL AND DO THE LABS (if any). Knowing the material is the best way to AVOID using your index.
2. Your index should be limited to three bits of information: Book#, Page#, and Topic. People assume that you need a detailed description for each entry. The topic of the page is well enough. If you have to rely on a "Description" column, then you aren't studying the material. Your index's purpose is to help you quickly find the areas in your books where unknown information is located. It is not a quick answer guide.

On my last exam, I used my index a total of 6 times. I made a python script that can help with this philosophy. Use it to go through each book, creating an entry for relevant pages. Don't focus on the material, just complete the index for the books. The tool will generate an html file, color formatted for you to copy and paste into Word. Then convert the Word document into two-column format and send the file to Office Max/Kinkos for binding. After that, go back and actually study the material. Your index should not be too big or too small in the end. Here is the link on my github.
https://github.com/kanecain1981/SANS_Index_Helper_Tool

TechGromit

kanecain wrote: »

I have found, the less detail in your index, the less time you will have to use it during the test. Which is the point. Realize that you will have on average, about 1:30 minutes per question.

I can't say I agree. The more you have on your index, the less you will need it for the exam. The act of making a detailed index in the first place gets you to study more, so the chances are your not going to need the index in the first place to answer a question. One could argue since you didn't need to use the index as much on the exam, it was a waste of time, but I think the act of creating the detailed index is what allowed you to take the exam without leaning on it as much. As for the 90 seconds per question rule, your going to find knowledge or theory based questions that your going to be able to answer in 5 seconds flat, which will gives you more time to concentrate on questions you don't know that you have to look up (or puzzle through/analyze). It's been awhile since I took the GCIH, but I can tell you when your trying to analyze a Java script or Assembly code on the GREM, your going to need a lot more than 90 seconds for these questions, you'll be thankful you were able to answer several questions in 5 or 10 seconds giving yourself more time for more complex questions.

kanecain

TechGromit wrote: »

I can't say I agree. The more you have on your index, the less you will need it for the exam.

I do agree with some of your points, but this can be a flaw as well. If one's index is too detailed, you will become reliant on it during the test. Which is a HUGE chunk of time. At that point, its no longer an index, its a study/answer guide. The point of bringing an index into the test room is the fact that the book lacks an index to assist you with finding an answer. It is not uncommon for one to unknowingly spend 15 minutes on one question, flipping through a 50 page index for the right answer. Attending the classes, writing your own (separate) notes, and doing the labs is the proper way to study. Your index should be an emergency roadmap to areas of the material where your knowledge is weakest. Like you said, you should be spending 3-5 seconds per question. Those answers should not be in an index, but your personal notes and your in head. Your personal notes should be designed in a way where you can return to them at needed times. The material in the books will eventually become out-dated, so a note taking format that can be easily updated is best. Which a SANS index is not the proper medium for the task. You are there to take a test and pass it as quickly as you can. So your index needs to be quick and light. In my last SANS exam, I viewed my index 6 times. And thats the way its supposed to be.

cyberguypr

I fail to see who gave this guy the all mighty power to determine how exactly a SANS index should be used. Claiming to know the definitive way to study for anything is just wrong because no two people are alike and have different needs.

Indexes are PERSONAL. I know I would vomit if I color tab mine out. Others would die if they lose the tabs or they get mixed up. The takeaway here is that indexes are flexible and work different for different individuals.

OP, again, see what everyone here has done and then figure out what works for YOU.

cyberguypr

“You have GCED and GCIH. Your opinion matter little on these SANS forums buddy. CCSP and GCED should be certs that should never be mentioned! ;=)”

Feel free to sign negative rep so I know who’s providing it. If you want to stay anonymous at least explain yourself because these comments make zero sense.

Phalanx

Someone downvoted you because you have the certification being talked about? /sigh

E Double U

kanecain wrote: »

I do agree with some of your points, but this can be a flaw as well. If one's index is too detailed, you will become reliant on it during the test. Which is a HUGE chunk of time. At that point, its no longer an index, its a study/answer guide. The point of bringing an index into the test room is the fact that the book lacks an index to assist you with finding an answer. It is not uncommon for one to unknowingly spend 15 minutes on one question, flipping through a 50 page index for the right answer. Attending the classes, writing your own (separate) notes, and doing the labs is the proper way to study. Your index should be an emergency roadmap to areas of the material where your knowledge is weakest. Like you said, you should be spending 3-5 seconds per question. Those answers should not be in an index, but your personal notes and your in head. Your personal notes should be designed in a way where you can return to them at needed times. The material in the books will eventually become out-dated, so a note taking format that can be easily updated is best. Which a SANS index is not the proper medium for the task. You are there to take a test and pass it as quickly as you can. So your index needs to be quick and light. In my last SANS exam, I viewed my index 6 times. And thats the way its supposed to be.

I disagree with a few of your points:

- There is no way it is supposed to be unless I missed something during my GIAC experiences. Looking at your index six times is applause worthy indeed, but not a standard that must be followed.
- You are there to take a test, but not necessarily to pass it quickly. Completing the exam quickly is ideal for some of us, but not a requirement.
- Why can't the answers be in an index? Making a detailed index is a part of my study method and helps me to remember a lot of the material. I've found that I didn't need the books on a significant amount of questions because of the details in my index.

kanecain

cyberguypr wrote: »

I fail to see who gave this guy the all mighty power to determine how exactly a SANS index should be used. Claiming to know the definitive way to study for anything is just wrong because no two people are alike and have different needs.

Indexes are PERSONAL. I know I would vomit if I color tab mine out. Others would die if they lose the tabs or they get mixed up. The takeaway here is that indexes are flexible and work different for different individuals.

OP, again, see what everyone here has done and then figure out what works for YOU.

Apologies if my opinion is coming out in a jackass kind of way. I do not mean that MY method of completing a SANS cert is the best or only way. To some, indexes are personal. To me, my large collection of notes, scripts, and practice virtual machines are better. My SANS indexes will never replace that, hence why I will never rely on them for test taking or learning.

P.S.
And no, I didn't down vote you.

j1mgg

Thanks for all the replies, and different opinions.

I have this week off where I am going to read through the books again, tab, highlight, and create an index. Then sit the first test exam Friday or Saturday evening.

j1mgg

Created my index when transferred into word double column was 4 pages. Tabbed the books and tools some notes. Passed my first mock with 90%, so just going through the books again expanding my index and adding in stuff about questions I got wrong.
Looking to sit the second mock on Thursday, but from what I remember from GCIA, the second mock repeated a lot of the first mock questions.