GSEC Experience

laughing_man

Sitting for my GSEC on Friday. Just wanted to create this thread as a placeholder for my review.

Quick question though first:
I have read all the coursebooks that came from SANS backwards and forwards. I have my exhaustive index all ready to go. I also made hand notes for each module, more as a refresher tool and a good way to absorb the material (I figure writing things down helps me learn). I also sat for a practice exam last Saturday. I took it cold after a few days of no study and got an 85%, which is not as good as I had hoped. I am fairly weak in Windows security and my practice test reflected that. I am going to sit for my next practice test on Wednesday and take my final exam Friday.

I feel pretty good, but I have heard differing things on how reflective the practice tests are, some say dead easy compared to the real thing, others say similar. I figure a practice test is somewhat easier anyway. A lot of the questions I missed were sort of "D'oh" moments where I did not fully read the question. Only like 1 or 2 where completely out of left field for me.

For those that took GSEC, how would you compare the practice test to the real deal? Do I sound ready?

reppgoa

You'll be fine. For me, they didn't really compare that well. I found the actual exam to be much more technical than the practice tests led me to expect. Having a comprehensive index is the main tool. I forgot half of my index at home test day and still did fine. You'll get it

docrice

For all my GIAC exams, I found the practice versions in the ballpark (that is, pretty similar) to the ones asked on the real test in terms of overall difficulty. Others have stated the exact opposite though, so your experience may differ.

As for being prepared, you should be at the point where the vast majority of the questions should be relatively easy to narrow down to one or two answer options, and if you need to occasionally reference materials then you can do so within a minute or two and figure it out.

laughing_man

Docrice - that was pretty much my experience with the practice test: the possible answers jumped out from the filler. I only used my reference materials if I really did not know the answer (only a few) or to confirm an answer,a nd again those were quick lookups.

Thanks, I feel better. Can't wait to finish this thing and look to other certs.

ipchain

Think you'll be OK. Ensure to get a good night sleep / breakfast and be there on time. Look forward to congratulating you soon!

reppgoa

Last piece of advice. Do NOT study the entire day prior to to the test. Don't even think about the test or the material. You know what you know, nothing you learn in that last day will help you. Let your brain rest and process what it knows. This has worked for me so far as I have a 100% pass rate on all certs I've taken. I go watch a movie, or play video games, or just sleep the day prior. You would be amazed at what your brain processes in the background while you concentrate on something else. Also, take a snack and water with you. Just a protein bar or something should do.

JDMurray

I'm in SANS 401 at this very moment. The instructor advised us to immediately take one of the two practice exam to determine what your weakest areas are and study based on that assessment. He also mentioned that having the books/notes with you in the testing center won't help you with answering many of the exam's items. I'll blog more about it one day after I take the exam.

laughing_man

Agreed. The books only help if you have done the work to know generally what the answer is. You can't cold lookup stuff (or at least not much). In my practice test I just used the books to rule out a possible answer. I would say you have to know the concepts, how protocols work, what a system does, etc. If you don't know, you could look it up, but you will spend precious minutes trying to grasp a concept instead of answering the questions.

I found many of the practice questions required putting concepts together from various sections. You could have a question that appears to be about IDS signatures, but really you need to know how a particular protocol works in order to answer it. You can't look that up, and if you needed to, you would need to have the background knowledge to know what the question is asking.

JDMurray, who is your instructor?

JDMurray

laughing_man wrote: »

I found many of the practice questions required putting concepts together from various sections. You could have a question that appears to be about IDS signatures, but really you need to know how a particular protocol works in order to answer it.

That would be like the CISSP exam items containing information from multiple domains. For example, an item might look as though it's asking you a crypto question, but it's really an understand of risk management that you need to choose the correct answer option.

laughing_man wrote: »

JDMurray, who is your instructor?

Dr. Eric Cole, the author of SANS 401 and the most awesome SANS instructor in the universe! I can't imagine taking 401 with anyone but him. (Sorry Gene.)

laughing_man

Eric Cole is a very good instructor. Knows his stuff and is very chill.

rwmidl

Seth Misenar was my instructor, and very awesome!

JDMurray

More about the GIAC GSEC hot off the press from SANS training:

• The GSEC exam is 180 items; the typical GIAC exam is 75-125 items.
• You are given 5 hours with two, 10 minute breaks.
• The exam is CBT at Pearson Vue, open book, open note, no electronics.
• Many of the questions are scenario-based and require analysis to answer, not just looking up facts.
• If an exam items requires math to answer, a calculator is shown on screen.
• Tool-specific questions are few because such information does not stay relevant.
• Getting 90%+ on any exam gets you a seat on the GIAC advisory board.
• The most common reason people fail GIAC exams is that they run out of time during the exam.

Here's some information given about studying:

• The typical after-course study time for most GIAC exams is 50 hours; for GSEC it is 75 hours.
• Take detailed notes during the course.
• Review all course objectives in the course books
• Re-read the slides and notes from the SANS courseware
• Create indices, TOC, and notes from the books
• Build hands-on skills using the labs int he books
• Listen to course MP3 files or OnDemand modules
• Use the practice exams as a pre- and post-assessment for your studying.
• Score at least 80% on practice exams and at least a 3-star rating on each category.

More information in the GIAC Program Overview (PDF).

One thing that surprised me is the exam pricing. On the GIAC web site, the price is $549 if you take the corresponding SANS training course. What I had not realized is that the $549 is the cost only if you purchase the exam during the SANS training. If you purchase the exam after the training, it is $799.

reppgoa

JD, you have a small window after the training ends in which to purchase. From that point you have 90 days to take the test with extensions costing 250 for an additional 75 days.

laughing_man

I should also point out the proctored exam option, which is what I am doing. We have an HR representative who is an authorized SANS proctor. I simply show up to work on Friday and take the exam in a conference room with the proctor. No having to go to a Pearson Vue testing center. Very convienent.

AlexNguyen

laughing_man wrote: »

I simply show up to work on Friday and take the exam in a conference room with the proctor. No having to go to a Pearson Vue testing center.

Is it still a computer base exam or with paper and pencil ?

RomBUS

Curious...are these SANS training courses are physical or virtual classes?

laughing_man

AlexNguyen wrote: »

Is it still a computer base exam or with paper and pencil ?

Computer based. The proctor has a unique ID number which needs to entered in order to unlock the exam. Not sure if this is still true or not, but the proctor also had to physically call SANS to initiate the test. I will let everyone know on Friday when I find out first hand.

RomBUS:

SANS has both a boot camp style and two online variants: VLive is basically an online, interactive bootcamp spread out over 6 weeks and then OnDemand which has the same boot camp material, but is at the student's pace.

AlexNguyen

laughing_man wrote: »

SANS has both a boot camp style and two online variants: VLive is basically an online, interactive bootcamp spread out over 6 weeks and then OnDemand which has the same boot camp material, but is at the student's pace.

They also have "Simulcast" classes.

JDMurray

reppgoa wrote: »

JD, you have a small window after the training ends in which to purchase. From that point you have 90 days to take the test with extensions costing 250 for an additional 75 days.

Actually, it's 120 days after the exam is purchased and the extension is for an additional 45 days.

Also, you can buy an additional attempt 30 days after failing for $549 and have 30 days to retake. After three attempts you must wait one year to retake.

laughing_man

Just finished my last practice exam with a 90%. Gonna take a break tomorrow to relax and then my real exam Friday.

ChooseLife

laughing_man wrote: »

I should also point out the proctored exam option, which is what I am doing. We have an HR representative who is an authorized SANS proctor. I simply show up to work on Friday and take the exam in a conference room with the proctor. No having to go to a Pearson Vue testing center. Very convienent.

Very convenient indeed. Do you know how this person got to be an authorized SANS proctor? Also, the SANS site wording seems to suggest that they discourage exam proctoring unless there are no regular exam centres in the area... Did you have to convince anyone to use a proctor over an exam centre?

P.S. Good luck with the exam!

reppgoa

JDMurray wrote: »

Actually, it's 120 days after the exam is purchased and the extension is for an additional 45 days.

Also, you can buy an additional attempt 30 days after failing for $549 and have 30 days to retake. After three attempts you must wait one year to retake.

Indeed! Not sure where I got those numbers -_- *Goes to look through email hoping to find evidence that I am not crazy

laughing_man

Just finished. Scored a 93%. I will post my comprehensive review tonight. Just glad it is done.:D

timrvt

congrats!

docrice

93% is the same score that I achieved when I took the GSEC. Good job. Welcome to the Advisory Board.

laughing_man

docrice wrote: »

93% is the same score that I achieved when I took the GSEC. Good job. Welcome to the Advisory Board.

What does being on the advisory board entail?

So GSEC was an excellent cert. This is the first cert I have ever taken, though I did take an A+ class years ago. I just never bothered to sit for the test as my employer did not require it. Anyway this test is quite broad in terms of what it covers, I believe 64 topic areas over 6 books. All the material is covered in depth, so expect to read packets in hex, know the outputs of tools, crypto fundamentals, security practices in Windows and *Nix.

So my study method started with the VLive course back in October. I then went through the OnDemand lectures and assessments. I also made a point to read all the books, cover to cover, making my index as I went. When I was going through each module, I made notes, jotting down the key points and concepts. I mainly used the notes for quick refreshers later. After that I took my first practice test, scored an 85%, studied the areas where I was weak, and then took the next practice test. I will say that there is a little overlap in questions in the practice tests, so the question pool is evidently not very big. Keep that in mind if you plan on doing practice test in quick succession.

The final test was very similar to the practice tests in my opinion. Some of the questions on the final exam had to be "unpacked" a little bit more than the practice test questions, in order to get at what the question is really asking. It is because of this that you can't blindly look something up in the book when you take the exam. There were very few questions that asked straight forward stuff.

Honestly, for those contemplating this cert, it is very comprehensive. If you have some background in networking or security, you should find a lot of stuff familiar, but with the exam being so broad, I think you will walk away having learned something.

So from here I am thinking either CEH, SSCP or GCIH.

docrice

laughing_man wrote: »

What does being on the advisory board entail?

http://www.giac.org/certified-professionals/advisory-board

It's mostly about a mailing for me, at least. Lots of good discussion on all areas infosec from other GIAC alumni. Sometimes the conversation can get pretty lively.

YYZ

did you create an index? if you did can you share some or all of it so that I can create my own index as I am preparing for the exam. thanks

JDMurray

You can find an example of a SANS course index in my GSEC study prep blog article at My Study Plan for the GIAC GSEC Exam - TechExams.net IT Certification Blogs

ITforyears

Yes, an index is important when you create a notebook. That helped me immensely.

Earned thus far.

A+, N+, Sec+, CCNA, CASP, GSEC, MCSA - BS & MS in IT.

ITforyears

BTW, JDMurray, your blog helped me a lot in passing. Thank you.

Earned thus far.

A+, N+, Sec+, CCNA, CASP, GSEC, MCSA - BS & MS in IT.