GCIH Study time?

newjack

I took GCIH in person training early Feb, I had scheduled my  Exam early April, but due to covid it was cancelled. I really dont remember much. Now with Proctor u being available I can schedule till June 30th.

Will 1 month be enough to re-read through all the books, redo all the labs and create a new index?

Proctor-U wasn't made available for me till today (Not may 18th) So I am a bit upset I only have a little over 30 days to re-study everything.

Thanks.

Danielm7

I think that's reasonable, I took it with about that long worth of study after my course, but I had less gap time in between. Just Do the full index, take a practice test, tweak your index or brush up on what you need, take the 2nd test. If you're good then you should be ready to schedule right away. 

SteveLavoie

I am exactly in the same situation except my exam is GPEN. I did the SANS SEC560 class in New Orleans at the begining of Feb. I received yesterday the email to schedule with Proctor-U, and I scheduled my exam for June 29th. 
I think one month is enough to prepare if you can put some reasonable amount of time (10-15h a week) to study and redo labs. In my case, I did a major review of the 4 first book in May, I am building a small lab to redo some labs for the 5th book (AD attack), but I plan to do another review of all 5 book before the exam. First practice test is in 1 week or so. 

Alternatively, you can buy an extension... they are expensive 400$ USD for 45 days. 

newjack

SteveLavoie said:

I am exactly in the same situation except my exam is GPEN. I did the SANS SEC560 class in New Orleans at the begining of Feb. I received yesterday the email to schedule with Proctor-U, and I scheduled my exam for June 29th. 
I think one month is enough to prepare if you can put some reasonable amount of time (10-15h a week) to study and redo labs. In my case, I did a major review of the 4 first book in May, I am building a small lab to redo some labs for the 5th book (AD attack), but I plan to do another review of all 5 book before the exam. First practice test is in 1 week or so. 

Alternatively, you can buy an extension... they are expensive 400$ USD for 45 days. 

They should really cut down on the price, so many people are screwed by COVID. But hey, good luck to both of us. I think 10-15h a week is certainly enough.  Best of luck Steve!

SteveLavoie

They gave me a 15 days extension free.. I was first deadline was June 15th, it was extended to June 30th. In my case, it is more than enough. The only real delay was caused by remote proctoring not available before.. COVID-19 was disruptive for my study, but if I knew I could do the exam remotely in March, it would have written it earlier.  

I wont pay 400$ USD for an extension. They are crazy.

Which SANS class is your next one?

newjack

SteveLavoie said:

They gave me a 15 days extension free.. I was first deadline was June 15th, it was extended to June 30th. In my case, it is more than enough. The only real delay was caused by remote proctoring not available before.. COVID-19 was disruptive for my study, but if I knew I could do the exam remotely in March, it would have written it earlier.  

I wont pay 400$ USD for an extension. They are crazy.

Which SANS class is your next one?

I loved the GCIH course, and believe I will stick towards the IR/Forensics route. I still am not sure yet. I like the MacOS Incident Response course, but it seems like it is only offered in California. Too many great ones to choose from , but certainly more the Blue Team/Purple Team route.

charismaticx

Similar situation with GPEN. I went ahead and scheduled it and I’m reviewing the material again. If you review everything then you should be fine. 

Danielm7

I'm in the same with GPEN too, took 560 right before most of the lockdowns and life has been chaotic since. I'm almost done the indexing though and will be doing it via ProctorU as well. Having the OnDemand is a nice bonus so I can basically redo the entire class all over again as I index. 

SteveLavoie

My GPEN exam is on June 29th.  Last sprint of preparation. For now I will use the index at the end of book 6 and complete that with a few **** sheet for syntax.  Maybe I will change my mind after first practice test next weekend. 

newjack

charismaticx said:

Similar situation with GPEN. I went ahead and scheduled it and I’m reviewing the material again. If you review everything then you should be fine. 

I am re-creating my index in excel and hopefully will be done in about 2 weeks. I will re-read the books and do the labs.

Will proctor u have labs on the exams? From my understanding the pearson exams do have semi-labs, where you run scripts/small commands to get the answer.

Can I also bring the **** sheets provided by SANS? I feel like that should be enough for GCIH. Other than for basic tools like hashcat/john the ripper etc etc.

Danielm7

@newjack
I'm on the SANS advisory list and they had this discussion just the other day. The ProctorU exams are 100% the same as the in person, you can bring all the same things you would bring to the in person exams, books, index, etc. 

charismaticx

Do you still get the 15 minute  break? 

Danielm7

No idea, I've not used them previously in person so I didn't even consider it. 

JDMurray

Online proctored exams typically have a "take a break" feature for exams over a certain length (usually 2+ hours).

SteveLavoie

I know everyone is different, but taking a break would surely put me out of the "Zone".  I am a fast test taker so maybe it is less a concern for me. CISSP exam, the long 250 question version in a bit less than 2h30. 

charismaticx

GCIA mentally burned me out. Sometimes it’s just nice to get a quick breather and regroup. 

E Double U

charismaticx said:

GCIA mentally burned me out. 

Same here. That was a beast. 

charismaticx

Oh by the way. We are allowed to take a break as long as you tell the test proctor. I didn’t take my mine during the exam. However, once the test was over the test proctor was unresponsive. 

newjack

I just took my first practice exam. My test is this Tuesday. I got an 81% I also had an hour and a half left on my practice exam left.. I thought it was quite easy, at least 5 of the questions I got wrong because of not re-reading it and fully understanding it.

I hardly used my index, I did take notes on some of the stuff I got wrong, got 1 wrong on the lab. 

Thoughts on the practice exam vs the real exam???

iBrokeIT

newjack said:

I just took my first practice exam. My test is this Tuesday. I got an 81% I also had an hour and a half left on my practice exam left.. I thought it was quite easy, at least 5 of the questions I got wrong because of not re-reading it and fully understanding it.

I hardly used my index, I did take notes on some of the stuff I got wrong, got 1 wrong on the lab. 

Thoughts on the practice exam vs the real exam???

That's good that you were able to score in 80s with minimal index use and have that amount of time left.  I would brush up on your weak areas, slow down on the questions a bit and you should be set.  Good luck!

TechGromit

SteveLavoie said:

I wont pay 400$ USD for an extension. They are crazy.

I paid for an extension, it was worth every penny. The extra time allowed me to prep for the exam, which I passed. As for is 30 days enough time, it really depends on you, I known people who took the exam right after the minimum two week waiting period and easily passed the exam with no books to reference. Then there others that study and have a 200 page index and fail it.

As for the extension, if your not committed enough to use the time studying, then yes it's a waste of money. As can only say from myself, I used the time wisely, studied every day for at least several hours till I was analyzing Malware in my sleep.

 

TechGromit

newjack said:

I just took my first practice exam. My test is this Tuesday. I got an 81% I also had an hour and a half left on my practice exam left.. I thought it was quite easy, at least 5 of the questions I got wrong because of not re-reading it and fully understanding it.

An 81% is a respectable score for the first practice test, you should be fine, just don't get overconfident.

newjack

TechGromit said:

newjack said:

I just took my first practice exam. My test is this Tuesday. I got an 81% I also had an hour and a half left on my practice exam left.. I thought it was quite easy, at least 5 of the questions I got wrong because of not re-reading it and fully understanding it.

An 81% is a respectable score for the first practice test, you should be fine, just don't get overconfident.

Seems that my lowest were fields were (3 stars or less)

Incident Handling: Containment

Network Attacks

Hands-on Maintaining Access

Covering Tracks: Networks

Client Attacks I'll be reading up on those and taking my second test tomorrow and trying to use my index more Thanks everyone

newjack

86 on my practice exam. Will be adjusting my index tonight, there were times I was scavenging the book because my index was written poorly. 

I'm fired up and ready to go!

newjack

Passed the exam with an 80!

I am thrilled. I already want to update my LinkedIn

chapnoodle

Congrats! I am excited for you!