Just passed with a 790. Let me first start off by saying this exam is not to be taken lightly. While have a technological background and the experience to go with it, you need to be able to make good decisions. I feel this exam requires tech experience, but mainly attempts to test your judgment on security.
This exam also attempts to trick you and strives for you to choose an answer without considering the rest. For example, I would receive an easy no brainer question and choose the acronym that fits the answer. After closer review, you will notice two acronyms that are the same, but the first word may be off. This is the first exam where I reviewed my questions and am thankful I did.
Basically read the requirements on which you will be tested and you will not have an issue. I think a big part of the complaints about this test come from the fact that exact terminology or technology is not used in a question, but if you know how that technology works you can answer the question (for example viruses, worms and Trojans as opposed to explicitly saying Sasser or Nessus). I finished without about 30min to spare, and now that I think of it I changed a few I should not have.
I read past reviews of this exam and people stated they received no questions on which specific ports, while I can remember about 10 questions asking to define a port number. You should make sure and know:
1) IDS – HIDS & NIDS – It felt like IDS made up about 40% of the exam. Know them inside and out, policies that go with them, various flavors offered, how you should implement them, etc. Also how to read the results obtained by and IDS. Don’t forget those honey pots!
2) Encryption and Algorithms – Know about PKI and certificates, as well as how VPN’s work and their counterparts used to secure the connection (L2TP is the tunneling protocol while IPSec secures the payload). Memorize hashing algorithms and their associated specifications, AES – 256bit and symmetric, etc.
3) Social Engineering – Know the different methods of social engineering as well as the slang names that define the different approaches. Every company needs some sort of security training and awareness, know the steps to planning them and when to put them in to practice.
4) Know the difference between Viruses, Worms, Trojans, Rootkits, etc. Know how they work and replicate.
5) Know your Access models (MAC,DAC,RBAC) and when you would implement one over the other.
6) Understand various software and freeware tools that may be used maliciously (NMap, Nessus, etc.) and what protocol analyzers do. Make sure you have a good grasp on how to check for vulnerabilities. I remember quite a few questions on this matter.
7) Read the questions thoroughly and make sure you understand what the question wants. Do not choose an answer even though you think you know it without reading the rest. A lot of times a question will give you four correct answers, however you will need to pick the one that best represents the question.
All and all I enjoyed studying for this exam. This was definitely a different experience compared to the MCSE series. Where the Microsoft exams give you paragraphs and expect technical explanations, these seemed much different and were more one and two liners. Like I said, they test your thinking more than anything on this exam.
I used the Sybex 3rd edition book and can say with that alone you will not pass the exam. The only reason I did was in my previous experience I’ve had hands on implementations in a production environment with the material being questioned. My company sent me to a CEH (Certified Ethical Hacker) bootcamp a few weeks before and during the class we used some tools discussed on the test. However, I don’t recall reading about any of them in the Sybex book.
One word of advice, when you think you’re ready; open the book or visit the website to make sure you understand the objectives on the test. A book might not cover an exam objective or give as much detail as needed. If you find a one, search the web on it and make sure you know it. If you know the exam objectives, there will be no surprises. Next is a cram session for the CEH followed by the exam.
Good luck to everyone sitting this in the future!
