GCIH Exam Fail :( - Assistance/Help/Review of my material?

Greetings Community,

I hope everyone is staying safe during these unprecedented times we are experiencing!

I am reaching out to the community for some assistance, help, and/or review of my GCIH material to see what I am doing wrong and where to improve (within the rules and regulations of GIAC/SANS). I recently took my GCIH test and failed. To be honest, I am super bummed and not sure what to do or how to improve. I thought my index was very thorough (over 200 pages bound and tabbed). After each practice exam I made changes to information I missed or reword. After the my second practice test, I overhauled the index to get as thorough as I could. This sucks, because I now have to pay $800 out of pocket to retest (which since I failed, the next test will be based on new material changes) and it doesn't even come with another practice exam! After paying $7K for a class, you would think they might give you a break on the exam price, maybe $200! I digress and no, I am not looking for or want a pity party (I guess I needed to vent some)!

To those that have recently taken the training and passed the exam between July 2019 and June 2020, would you mind lending out a hand to help? Maybe review my index to give me some feedback on where I could improve (i.e. formatting, structure, missing info, etc) and possibly share your index so I could compare with mine?

Is it possible that someone in the community has an extra GCIH practice test that they don't need and would be willing to give it away? I will even give you a donation for coffee or other activities, as long as it is not against the rules and regulations of GIAC/SANS!

Thanks in advance for taking the time to read my post!

Chap

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

charismaticx

I wouldn’t go as far as destroying the index, but I would seriously go back and review you’re weak areas. The index is just a tool that helps steer you in the right direction. At the end of the day it’s you’re understanding of the material that will come a long way. You also want to pace yourself for the labs. The labs do take some time to complete. Tabbing our the lab book really helps.

chapnoodle

TechGromit said:

Since your test scores didn't improve between the practice exams, I believe it's a question of study habits not the size of your index. My index was 36 pages, printed landscaped, and I think I only referring to it maybe 10 times during the exam. Building an index is suppose to be a method of studying, not to rush to build the index. If you took the time to study and build a solid index, chances are you will not need to refer to it more than a few times during the exam, ideally not at all. As for your time remaining after completing the exam, your time management needs work, you shouldn't have so much time left after completing the exam. You should split the exam into check points so you should be on question 37 at the 1 hour mark, 75 at the two hour mark and so on, if your ahead, force yourself to slow down, if behind, pick up the pace. the Exam appears to be different not, I say 100 to 150 questions, when i took it it was a set number of questions, it may be reactive now where if you get an answer wrong it gives you more questions about that topic to probe your knowledge on it. I wouldn't rush to retake the exam soon as your 30 days waiting period expires, your obviously not ready. Rushing to retake the exam is only going to result in another failure. From my own experience on the GREM, I knew I was not ready for to take the exam and paid for an extension, it was money well spent, I squeezed out a pass.

My recommendation would be to burn your current index and start over, you need to read all the books, study them as you build a new index. Even a Great index isn't going to help you pass the exam if you do not know the material.

I think I was given wrong advice for co-workers who have multiple SANS certification. Everyone told me to focus on the index as it is my "key" to passing. Without a good index you will fail. I have come to realization that this is incorrect!

I think you may have misunderstood the time piece. That was the amount of time I had left when I got to the hands-on portion. I took the who 4 hours to complete the exam. I know part of the problem was blanking out on some of the JtR questions. I knew what steps to perform and had the index to reference, I just kind of went brain dead. I will say, the hands-on portion was a bit laggy. I need to make sure to take my time and type slowly!

I am currently reading each book again (also performing the labs as I reach them) and marking areas with sticky notes from stuff I saw on the exam. Once I am done, I plan on making an index of that information an pull some of the stuff from my main index.

chapnoodle

yoba222 said:

Passed the GCIH with no index. Or reference books with me*. They weren't available to me at the time and I knew that while studying for it. I think knowing of the burned bridge forced me to study carefully and really know the material. That's all the index really is -- an activity to force you to digest the material carefully.
One very helpful thing was carefully reviewing each question of the practice exam, several days later, over and over until I could "take" it again and get 100%. I mean the practice exam is given in a web browser after all.

*Probably couldn't do that on something more intense, like the 503, from what I've heard, but very doable on the 504.

Thanks for the info. I am in the process of reading the books again now and will read them a couple more times. I noticed a few things in the book that I didn't highlight the first time that was asked on the exam.

chapnoodle

scasc said:

Some excellent advise here from folks who are pretty experienced GIAC exam takers. I fell into this trap about 4/5 years back when I sat my first GIAC exam - GSNA. I was so naive at the time, I just created notes with no real index and used the notes + books for the exam. It was when I kept my eye on the score after every 10/15 questions I knew this was a terrible tactic. Cut a long story short, pass mark was 71, I got 73 but realized the key thing is to really understand the material properly. Index is a supplement to point you to where you have seen something.

I too have a habit of making too many notes and I have always done this. But when I did GCCC - I simply created an index of the index just to point me in the right direction.

What you can do is perhaps go over the material and make a short index of the index you have - what I mean is perhaps a few pages just to highlight key aspects so you can be pointed to the right direction when needed.

Best of luck.

Thanks for the info. I know part of the problem was not fully understanding the material and relying on my index. I am hoping once I read the books again a couple times and modify my index, I will be in a much better position.

chapnoodle

charismaticx said:

I wouldn’t go as far as destroying the index, but I would seriously go back and review you’re weak areas. The index is just a tool that helps steer you in the right direction. At the end of the day it’s you’re understanding of the material that will come a long way. You also want to pace yourself for the labs. The labs do take some time to complete. Tabbing our the lab book really helps.

Agree and I am working on it. The only book I didn't tab out was the lab book, which I will make sure to do. I felt a little rushed when I reached the hands-on section. I am thinking a good time left to complete would be 1hr - 1hr15min. I need to pace myself better and not spend so much time on a question. I know, one of the questions, I spent 5 or 10 minutes!

charismaticx

You can make a table of contents for all the labs and tab out the lab book. It just makes easier to find the particular lab. Time is of the essence when you’re doing the labs. They’ve come a long way when with all the questions are shown, but it’s still a pain to flip back and forth between the question and the VM.

chapnoodle

charismaticx said:

You can make a table of contents for all the labs and tab out the lab book. It just makes easier to find the particular lab. Time is of the essence when you’re doing the labs. They’ve come a long way when with all the questions are shown, but it’s still a pain to flip back and forth between the question and the VM.

Completely agree! I hate the fact when you click on the question it provides an overlay on the VM and you can't see what you are doing while looking at the question. It's very annoying, but we have to work with what we have.

TechGromit

I just want to stress my recommendation again of burning your existing index. If you keep it, the temptation will be to somehow "fix" it, but it's in the creation of a good index the key to studying for the exam. If you really want to pass the exam, scrap what you got and start over, otherwise your wasting another $800 in my opinion.

Another thing I noticed is the index you show above, it looks verbatim from the book. Try to understand the concept putting notes for each keyword in your own words so you understand it.

On my index,
DLL injection
I have
Force an unsuspecting running EXE process to accept DLL it never requested
yours looks like it's taken right out of the book.

There's just too many words in your index. I tried to restrict notes on a keywords to one line on the index. There are a few exceptions, such as Nmap Flags / options, i used four lines. When you index, if you need to refer to it during the exam, you want to minimize the time takes to get the answer. Seconds Count! Your is way too busy, I can only imagine what your books look like, if you also highlighted them. Most of the page is probably highlighted, which really defeats the purpose of high lighting in the first place.

Kasor

Index is helpful if you wasn't sure the answer. However, I think we depending on the index too much. If you only getting 60 to 70% on the practice, then this mean you were not fully understanding all the materials or missing some minor detail. After two on demand SANS courses, and I started to figure out that many of the questions that I always got wrong or not sure, are those questions that I overlooked from the book or the lesson. Good Luck.