GICH next Thursday

Jinverar

Hello group.

It has been a while since I posted on tech exams. Recently I did my CDFE from Mile 2 last year. I'm now prepping for the GCIH Sans 504 exam. I've done the entire on demand course twice. I have passed the course completing all labs and practice quiz's. It has been challenging for me and ed is such a fast talker. I'm fairly confident in my ability to pass this exam, although it will be a close one. Is there a lab phase of the exam? From what I understand it is 150 Questions multiple choice with no lab. Any advice would be helpful. Anything to point out that could help would be great.

My spelling of the course in the subject is wrong. LMAO sorry about that. The Sans 504 exam next Thursday. not the gich exam!

docrice

Ed is a fast talker for a good reason - he needs to get a lot of information relayed in the class which makes the course in itself worth it. There's no lab portion of the (GCIH) exam. I know some of the newer GIAC exams are 75 questions rather than 150 with a 2-hour time limit instead of 4. The questions might also be packaged with more difficulty (in other words, you can't simply look up the answer from a sentence remark in the books) so there's a bit thinking and / or analysis involved. This requires you to actually know the material pretty decently. I'm not sure if the GCIH exam has adopted the new format yet though.

Jinverar

I've been led to believe that the test on thurday will be 150 questions and 4 hours long. I also read that it's open book. Is that true? open book seems a bit easier. The following quote was sent to me. Does this mean I can use any notes I want from previous courses like Net + and Sec +?

"GIAC exams are open-book/open-notes. You are allowed to use hard copy reference materials such as books and paper materials during the exam. You must be able to carry these into the testing room, leaving your backpack or briefcase outside of the testing room."

docrice

Yes, any printed materials including the books from the course are allowed. What you can't bring in are electronic notes on your smartphone, tablets, computers, etc..

JDMurray

Open book exams are more difficult. This may seem counter-intuitive, but if you think about it, if they wanted to make the exam easier they'd just make the questions easier. Allowing you to have all of your books and notes right there in front of you is a reason to make the exam even harder than it would be otherwise.

ChooseLife

JDMurray wrote: »

Open book exams are more difficult. This may seem counter-intuitive, but if you think about it, if they wanted to make the exam easier they'd just make the questions easier. Allowing you to have all of your books and notes right there in front of you is a reason to make the exam even harder than it would be otherwise.

There are different axes of mental activities and the overall "score" of a task's difficulty depends on one's cognitive skills. Analytical skill is one axis, ability to remember facts is another. So I think we need to be cautious in defining difficulty of an exercise on a linear scale.

I think it would be fair to say that technical open-book exams tend to focus on measuring understanding of principles and analytical skills, while placing less emphasis on factual knowledge and memorization of facts

JDMurray

ChooseLife wrote: »

I think it would be fair to say that technical open-book exams tend to focus on measuring understanding of principles and analytical skills, while placing less emphasis on factual knowledge and memorization of facts

Maybe it's a fair statement, but hardly accurate. Drawing a correct conclusion from a complex set of factual knowledge is also a way to increase the difficultly of an open book exam. The idea is to force the exam candidate to memorize as much as possible to answer the questions more quickly, because it's faster to use facts that are in your head than it is to look them up in a book.

Jinverar

On the first practice exam I got 68% without using any books or notes. I took the second test today and scored 78% using the books and my notes. I am really suffering in web application attacks and covering tracks. On both exams that was one of my weakest points.

docrice

I recommend studying those ares some more as it may cost you a passing score on the real exam. I've heard from different people that the real exam is harder or easier compared to the practice exam. For me it's always been somewhat the same. Everyone's experiences differ apparently.

ChooseLife

JDMurray wrote: »

Maybe it's a fair statement, but hardly accurate.

I would like to understand which part of the statement you find inaccurate and why.

JDMurray wrote: »

Drawing a correct conclusion from a complex set of factual knowledge is also a way to increase the difficultly of an open book exam.

I referred to this process as analytical skill in the previous post.

JDMurray wrote: »

The idea is to force the exam candidate to memorize as much as possible to answer the questions more quickly, because it's faster to use facts that are in your head than it is to look them up in a book.

This is achieved by placing a time constraint which is a dimension separate from open vs closed-book format. An open-book exam without a time constraint does not force candidates to memorize/retrieve facts quickly.

Jinverar

Quick question did everyone complete the capture the flag event before doing the exam?

Jinverar

I think I've had a education headake for the past week. I did enjoy the course. I've got 4 more days to practice and study. I've put in 110% effort on this course.

Jinverar

The Exam is tomorrow at 1300. I am pretty much done with the Ondemad. I've completed it a few times and ed's voice is so repetative now it's like "I hope it's over" Great course, and no matter what I learned way more than anyone at my level in my job right now. It also helped me discover some huge risks and actually save managment money, as well get me major points from the boss. I have been an incident handler for the past two years and that exp should help. I managed to capture flag 1 last night in the CTF event. I will get flag 2 tonight and study a few more hours. Last minute advice on watching logs and thinking like a hacker would be great!

Bert Bondy

Good luck on the exam! I am taking 504 at SANS Boston this August. Let us know your thoughts.

Jinverar

Thanks for the reply. I just barely passed today. I will write more in another reply shortly, after I'm done puking my volatile memory all over the second brain I had to image with DD. The exam was bloody hard. sniffing all the answers out from the books was impossible. In the first 30 questions I was at 90 percent. Then every 15 questions my mark kept dropping lower and lower ever so slowly. I hated that counter with a vengeance like no other. It never went up again after the 90. I passed it with at 73.3 % and passing is like 72.7 %. I worked my ass of to pass to. It came down to minutes for me after 4 hours the last few minutes ticked by as I answered the last few questions. My notes and books saved my bacon. I will write more on the weekend like I said after I capture some more CTF flags from capture the flag. I got two now! Don't go into this course with little life experience. It could make a person miserable in the end.

ChooseLife

Congrats on the pass!

docrice

This is why some open-book exams should not be taken lightly. You should know the material well enough that book-references are kept to a minimum as possible. The score counter used to refresh after every question in the older exams, but now it's done after every 15 questions. But at least you made it over the passing mark. I've been there where I've barely skimmed by.

laughing_man

Pass is a pass. Congrats

Open book is harder IMHO

Bert Bondy

Congrats dude!