Finished up the GCIA

smashedpumpkins

The SANS exams are very different than the other exams I've taken. I can't say that I care for how tailored the exams are to the class material. It feels like a conflict of interest. I took the SANS 504 class back in December and created an index like most recommended. Some of the questions and samples were identical on the test compared to the books. This was the first certification where I took a class.

Regardless, the GCIA was a tough test for me. Being open book, they don't make it easy. I knew I would have to study hard and build a quality index. My index was about 20 pages. I also printed out a wireshark, tcpdump, nmap, common ports, dec to bin to hex conversion, and an ICMP sample sheet. My practice tests didn't go as well as I would have preferred. I scored in the low and mid 70's on each test. Luckily, I felt the actual exam was a little easier and scored mid 80's. I took every minute they gave me and unfortunately had to rush the last few questions. It's a little too easy to lookup answers just to verify what you already know.

I learned a lot and am planning my next exam and training. I'm debating between the GCIH and GCFA training next. I enjoyed the technical aspects of the GCIA so I'm leaning towards the GCFA. I work as an intrusion analyst for a large company. My primary roles are intrusion detection and incident response. From what I've read, the GCIH sounds a little easier than the GCFA. What are your thoughts? In the eyes of employers, what's more valuable?

Thanks!

LionelTeo

GCFA would be more useful for a higher end SOC/Intrusion Analyst work, GCIH cover a very simply incident handling (while necessary) and then lots of attack and counter measures to it, if you are are well equipped of the different type of attack, then GCIH is not really necessary except for the incident handling part. GCIH incident handling area and GCED incident handling section compliments each other, so best if your interested in IH then this two course will help a lot, this is a bit silly as both talk about different areas that is important to incident handling and you cannot find this in a single course.

My recommendation is to self study for GCIH first, since you already had GCIA, GCIH is somewhat a less as tough as GCIA, and a lot lesser in content, GCIA would somewhat require a analyst to understand how each attack vectors work before they can even analyse it, therefore I presume your experience in understanding how each attack works can help you a lot in GCIH. You can look up a book call counter hack reloaded by Ed Skoudis, which is happen to be the course author for GCIH, both the course and books explain in great details on each attack vectors, with the exception that the book did not cover the incident handling aspect, then cover the incident handling area with Hacker Techniques, Tools, And Incident Handling. However, the Incident Handling in the industry world is not the same standard as SANS, this will give you a disadvantage in the exam, luckily though, Eric Conrad from SANS wrote incident handling section in his CISSP Study Guide that is similar to what SANS follow, you can get that book and read that chapter up. Finally, google up anything that you miss out from these books and your ready to challenge your GCIH.

Since GCIH is considerably one of the easier exam for GIAC, this will give you a great deal of feel to how a GIAC Challenge would be like, this experience will help you in self study for GCFA exam, which is slightly harder, I haven't took GCFA so I can't comment, but on the first topic on the last page, I have share a link to a blog of an author who wrote about his GCFA experience.

Of course if you had the spare cash, you can simply jump straight to GCFA course materials.