Ideas or experience indexing for GCFE and GCFA

TBRAYS

Gents or Gals,

Have any of you developed your own index's for the GCFE and GCFA exam and was successful instead of dragging the books in with you to the exam?

BillHoo

What you propose would be an index of gigantic proportions, requiring hours of cataloging if you intend to use an "index" as a replacement for the texts themselves. Such a document would be unique to what the cataloger deemed important. It would gather a life of it's own and grow to become.... a Freakazoid!

TBRAYS

Nice I guess I am asking for too much, LMAO

BillHoo

I just wanted to use the word "Freakazoid" in a post

Actually, I kinda did that for my GSLC cert.

With the pages oriented horizontally, I had plenty of room to put in as much info as I could into one line (sometimes 3 lines).

ie. ITEM VOL PAGE COMMENTS
CIA - Confidentiality, Integrity, Accessibility 512.x pg xx The CIA Triad

However, it does become tedious. Better to use your index development as a way of memorizing where certain items of info are and using the index as a memory trigger.

Also, I tabbed the index with Alphabetic letters to ease searching. I put the tabs at the top edge of the page, so I could flip through the index better.

Cheap, flimsy copy paper is hard to flip through easily. I recommend a good bond paper - pre-punched for a 3 hole binder

I had a 2800 item index and it fit in a cheap 50 cent plastic folder with 3 bendable 3 metal tabs - but I barely had enough metal to bend in the tab to hold it all in!

TBRAYS

BillHoo wrote: »

I just wanted to use the word "Freakazoid" in a post

Actually, I kinda did that for my GSLC cert.

With the pages oriented horizontally, I had plenty of room to put in as much info as I could into one line (sometimes 3 lines).

ie. ITEM VOL PAGE COMMENTS
CIA - Confidentiality, Integrity, Accessibility 512.x pg xx The CIA Triad

However, it does become tedious. Better to use your index development as a way of memorizing where certain items of info are and using the index as a memory trigger.

Also, I tabbed the index with Alphabetic letters to ease searching. I put the tabs at the top edge of the page, so I could flip through the index better.

Cheap, flimsy copy paper is hard to flip through easily. I recommend a good bond paper - pre-punched for a 3 hole binder

I had a 2800 item index and it fit in a cheap 50 cent plastic folder with 3 bendable 3 metal tabs - but I barely had enough metal to bend in the tab to hold it all in!

Yeah, I'm just dreading taking that big binder with me, well I guess off to labels then lol

BillHoo

Well, I don't know about gsec, but the gslc was 5 books (one each day of the conference course). And with cheap copy paper and printing only on one side of each sheet, the 2,800+ indexed items produced a document with a depth of maybe 1/3 of an inch.

Also, I found tabbing the books was useless beyond 7 tabs per book. More than that and the tabs just get in the way. I preferred to have a clean edge so I could flip and thumb through easily.

TBRAYS

Yeah I'm taking the GCFE next week

BillHoo

For the GSLC,
- I read through each book once.
- Made a list in an excel spreadsheet of everything the course instructor emphasized (old military trick. Instructors would stomp or rap the table if something was going to be on the test) This made up a list with 175 items
- Went through the last book and typed out all the talking points and answers into Powerpoint. Each slide is a talking point. Title is the the question, body text is the answer. Set the transition to show the Title and reveal the body when you click the mouse. This became a flashcard.
- Made my index. spent 1 day per book.
- Took Practice Test 1 with a digital camera to capture each question and answer. Took another picture with right answer if I was wrong. Placed each in powerpoint to study. Ended up reviewing just the ones I got wrong. NOTE: each photo showed a watermark number in the background of the screen. I guess it's SANS' way of tracking if someone tries to sell the questions/answers. Passed practice test in the upper 70s.
- Spent two days updating the index adding some 400 more items.
- Reviewed the test questions I got wrong and re-read books that I needed more practice.
- Took Practice Test 2. Did the same thing. got score in low 80s.
- Took a day off. I DID NOT add more items to my index after Practice Test 2. Night before test, flipped through my flashcards for several hours. And a few more hours going over all the prior test questions. Re-tabbed my index. Removed excess tabs from books.
- Morning of the test I skimmed over the emphasized topics list on the excel spreadsheet. Packed all the SANS books, my index, and a copy of Security+ Get Certified Get Ahead. (which I used for 2 questions, because I could not find them in my index.)
- Two hours before test - drank coffee and had early lunch.
- Got to test center 45 minutes early. After in-processing and photo taking, they made me take the books out of the bag and locked up the empty bag. I had to carry books by hand as they led me into testing area about 15 minutes early.

TIP: They gave me a workstation on the corner of a table with no one to left or right of me, so I had a lot of room to spread out the books!
Finished test with 10 minutes to spare. Scored 93

LDRydr

So, the million dollar question is: does anybody want to share their index? I'm currently putting mine together for GCFE.

TBRAYS

LDRydr wrote: »

So, the million dollar question is: does anybody want to share their index? I'm currently putting mine together for GCFE.

I actually put mine together, taking the practice exam tomorrow, to where I'm lacking

docrice

I've never looked at other people's indexes, but my approach to prepare for a GIAC exam is to create a custom index based on my own strengths and weaknesses, much of it being a set of short-hand reminders of bullets for a given topic if I'm not as familiar with them and the corresponding book/page numbers. This process forces me to go through the courseware again (hopefully reinforcing the material into my brain a bit more) and write down the key points. It also tends to expose where I'm weak so I can focus more time reviewing them.

At exam time, my goal is to finish in two hours or less. Once the clock runs past that point, I'm too mentally exhausted. That optional 15-minute break isn't going to help me (I almost never use it). The best way to beat this clock is to have a strong grasp of the material in the first place, thus minimizing the amount of time pondering the right answer, even if I've eliminated the potential answers down to the last two. I find the vast majority of my book look-ups tend to be to confirm my suspicions more than anything else.

Jono74

Post-it flags work well, but I would love to have a look at your index there TBRAYS & LDRydr.

LunchMoney

My first GIAC exam, I put tabs all on the edges of my books, now I have it a little more refined with an actual index file.

I use a perl script that after making my pages, puts them all together for me. I used it last test, and will use it in 10 days again. My GCFE instructor did provide an index, but i'm not sure I like it as much as mine.

While I'm taking the class and/or during study, I read the book and indicate the page and topic(s) I think are important.

For example in Book 1, I'd call my text file 508.1.txt (class, and book number)

My notes look like this:
[page number];[topic1];[topic2]


23-24;IE, WinXP session recovery data
39;Memory Acquisition, whats in it - processes, open files, encryption keys
44;EnCase user guide flags
56;Content to image;image tems;$MFT;$Logfile;$USN;$USRCLASS.DAT;sam;ntuser.dat
117;Volume Shadow Copy;VSS;Snapshot schedule

this makes it very easy to associate multiple concepts to one or more pages.
Below is what the output looks like when I run the script:

$logfile: Book1, p56
$mft: Book1, p56
$usn: Book1, p56
$usrclass.dat: Book1, p56
content to image: Book1, p56
encase user guide flags: Book1, p44
ie, winxp session recovery data: Book1, p23
image tems: Book1, p56
memory acquisition, whats in it - processes, open files, encryption keys: Book1, p39
ntuser.dat: Book1, p56
sam: Book1, p56
snapshot schedule: Book1, p117
volume shadow copy: Book1, p117
vss: Book1, p117



It's just one idea. I didn't write the script and am told I can share it if anyone is interested in it.

BillHoo

LunchMoney wrote: »

My first GIAC exam, I put tabs all on the edges of my books, now I have it a little more refined with an actual index file.

I use a perl script that after making my pages, puts them all together for me. I used it last test, and will use it in 10 days again. My GCFE instructor did provide an index, but i'm not sure I like it as much as mine.

While I'm taking the class and/or during study, I read the book and indicate the page and topic(s) I think are important.

For example in Book 1, I'd call my text file 508.1.txt (class, and book number)

My notes look like this:
[page number];[topic1];[topic2]


23-24;IE, WinXP session recovery data
39;Memory Acquisition, whats in it - processes, open files, encryption keys
44;EnCase user guide flags
56;Content to image;image tems;$MFT;$Logfile;$USN;$USRCLASS.DAT;sam;ntuser.dat
117;Volume Shadow Copy;VSS;Snapshot schedule

this makes it very easy to associate multiple concepts to one or more pages.
Below is what the output looks like when I run the script:

$logfile: Book1, p56
$mft: Book1, p56
$usn: Book1, p56
$usrclass.dat: Book1, p56
content to image: Book1, p56
encase user guide flags: Book1, p44
ie, winxp session recovery data: Book1, p23
image tems: Book1, p56
memory acquisition, whats in it - processes, open files, encryption keys: Book1, p39
ntuser.dat: Book1, p56
sam: Book1, p56
snapshot schedule: Book1, p117
volume shadow copy: Book1, p117
vss: Book1, p117



It's just one idea. I didn't write the script and am told I can share it if anyone is interested in it.

Sound pretty hi-tech. Are you saying it formats the pages for you?

I just used an excel spreasheet and then sorted the topics alphabetically before printing them out.