Passed GIAC Certified Incident Handler (GCIH)

unsupported

I just got back from the testing center where I passed my GCIH certification. I got an A. I missed a few out of the 150 questions, and finished in 2 of the allotted 4 hours. Some of the questions I missed were just stupid on my part (I completely misread them), the others were educated guesses because I could not find the answer in the material.

I basically took the SANS Self Study route. My study plan was reading and indexing Counter Hack: Reloaded by Ed Skoudis. It was beneficial because some test questions were lifted directly from the book. Combined with the SANS SEC504 course material, the Counter Hack index filled in some gaps. I listened to the Ed Skoudis SANS SEC504 MP3s and read through the SANS SEC504 course ware. I also had the course CD-ROM, but I did not use it because I had good exposure to the tools when I was doing my C|EH. I indexed all the slides from the course material as well as putting page markers in the course material and in CH:R. I also had printed out all the SANS **** sheets, the wiki on NetCat, and commonly used backdoor ports. I wish I would have had commonly used port print-out, but I survived without it.

The test itself was exactly like the practice test, but more difficult. The practice test was more cut and dry, What do you use X for? While I felt the actual test was more applying the knowledge, ex. if you wanted to do x and y, what would you use? I felt my test was covered all topics evenly, and that all the tools were well represented, the IH process, and the details of each phase of IH. The testing center was annoying. In Florida we just had out first cold front of the fall and they had the HEAT ON! Luckily, I wore shorts. I wish I would have had more room to spread out my books, but I managed. Once I knew I passed, I took a break, went to the bathroom, and re-arranged my work area.

All in all, I enjoyed the experience. I am looking forward to the live training event in DC for GCIA. Then.. who knows what else I might go for. GCFA? GCFA? Maybe back to EC-Council for CFHI? Or should I go for the GOLD?! Or just focus on school until I'm done.

Paul Boz

I'm glad to hear that you enjoyed your SANS learning experience. I'm taking the GCFW on November 13th and have been blown away at the quality of the material and instruction. I haven't learned a lot of individual technologies and concepts but I have learned many new ways to apply them.

The testing center where I have to go is also cramped. I, like you, will be sweating just not having enough space to lay out my materials. I've integrated that into my practice exams though - working with a small volume of space.

When are you doing the live training for the GCIA? I blew my training budget on Cisco tests and the GCFW but in January when my $4000 resets I'm signing up for the GCIA immediately. I'd be very interested in what you think of the GCIA. I don't know anyone that has taken it so my interest in the course stems from personal interest in the material. I think GCFW and GCIA will complement each other nicely.

Is your employer paying for SANS or are you out of pocket?