Hello, everyone,
Happy to be able to
announce that I’ve successfully completed the GCFA exam with an
85%! I wanted to share my experience and hopefully help someone else
out.
I am doing it as
part of the DFIR graduate certificate program, so I have 3 months
with the OnDemand course materials, books, and labs.
Like with most of
the other certifications I’ve completed, I always make heavy use of
the MP3 files. I like to keep it playing in the background during
“free ear time”; this could be anything from doing mundane ticket
work at the office, chores around the house, or commuting. Although
I could not ingest everything, I attempted to have it playing
constantly so in that one minute of paying attention, I could learn
something new.
I did not complete
the video series/quizzes/labs, and definitely wish that I had. I’m
sure that it would have been massively helpful, especially when it
came to having to know what tools did what, and what kind of
commands/output would be seen.
Of course, I made an
index of the books. Even better, the books have their own index at
the end, and I used that really heavily. This round, I chose to do 3
different pages: theory, tools, and events. I didn’t even touch
the theory page, but made heavy use of the tools and events pages.
Basically, if there was a mention of a piece of malware or tool or
event, I annotated it no matter which book or page. There are a lot!
One thing I wish
I had done with the index was write down every single Registry
location in another page that was published in the
books. I definitely think that would have been the game-changer that
would have taken me to over a 90%.
Finally, the other
major item which helped me out tremendously was to tab places in the
books where I knew I wouldn’t be able to memorize, but would be
very important. For example, I made tabs in the books where
timestamps, artifacts, and normal processes were. Since I knew I had
those tabs and where they were, I was able to quickly flip to the
right information without having to use any part of the index.
I was definitely
stressed out because I waited until the VERY LAST DAY of the course
to sit for the exam – that is not my normal habit, but life just
hit kind of hard over the past few months. I’m just glad I was
able to adapt and pass the exam in the end 
Hope this helps!
