Taking For508 On Demand

Just got my order placed for For508 On Demand. I was supposed to go to the DFIR summit in Austin again this year but approvals took too long. I have never done a SANS class on demand before. Will be interesting to see how this stacks up against the classroom setting.

Find more posts tagged with

Comments

sb97

I am starting the course work next week but I already had my first bit of fun. I never received a tracking number for my books. After a few days I finally called in and was told that they would be shipped in 3-5 business days (which was a problem because I had blocked out time from work and wouldn't have had my books yet). I called back the next day to see if I could upgrade to expedited shipping. The representative had to call me back with details. They were supposed to call back in 15 minutes but it took a few hours (due to some system problems). When they called back they told me that my books had in fact been shipped but the systems problems prevented them from updating the portal with my tracking data. They emailed me the tracking number and I got my books the next day.

UnixGuy

I took the class 2 weeks and have been studying (albeit slower than I should).

Let's post our progress here in this thread?

sb97

Sounds good to me.

sb97

Finishing up the day 2 activities. I had some background in memory analysis so it wasn't so bad but I am going to have to spend some time learning more of the volatility plugins.

One admin note. I found that listening at 1.5 normal speed works pretty well. I can still pick up on everything but the lectures move a bit quicker.

UnixGuy

I'm in day 2 as well...haven't done the lab but I did them during the class....so far so good. Lot's to remember about Windows!

sb97

So one item of note about taking a class on demand. The Challenge lab is really time consuming. You basically have to do the work of a team of 3-4 people by yourself. You do get a handout with the "answers". I finished up the class but I am still going through the last host in the challenge lab. I am pretty sure I missed something in one of the other hosts so I am probably going to have to go over the whole mess again.

docrice

FOR508 (and FOR40

has lots ... and LOTS of minutia that dive into Windows. It's good stuff. I took 408 OnDemand a month before I took 508 at SANS Security West. What a terrible idea. It was like being at a buffet and unable to leave, yet the plates kept coming and you were required to keep your mouth open.

sb97

docrice wrote: »

FOR508 (and FOR40 has lots ... and LOTS of minutia that dive into Windows. It's good stuff. I took 408 OnDemand a month before I took 508 at SANS Security West. What a terrible idea. It was like being at a buffet and unable to leave, yet the plates kept coming and you were required to keep your mouth open.

I took the two classes one year apart. I am really appreciating the ability to revisit the videos in the on demand system.

sb97

Welp, I find myself putting way too much in my index again. I had to pump the brakes and go back and ensure I wasn't overdoing things.

JoJoCal19

sb97 wrote: »

Welp, I find myself putting way too much in my index again. I had to pump the brakes and go back and ensure I wasn't overdoing things.

I've never subscribed to the thought that you can put too much in an index. An index that's done right should eliminate the need to even touch the books by putting a short but detailed description for each line item.

sb97

JoJoCal19 wrote: »

I've never subscribed to the thought that you can put too much in an index. An index that's done right should eliminate the need to even touch the books by putting a short but detailed description for each line item.

I do the same. What I meant was that I was indexing terms that I was already very familiar with. The one thing I don't want to do is clutter the index up with too many entries.

UnixGuy

Noobie questions but in my dashboard it says that my OnDemand expires on 5th-October (I took the class training end of May)

Does this mean my deadline to take the exam is 5th October? Just want to know how much time I got left

sb97

UnixGuy wrote: »

Noobie questions but in my dashboard it says that my OnDemand expires on 5th-October (I took the class training end of May)

Does this mean my deadline to take the exam is 5th October? Just want to know how much time I got left

My on demand expiration and certification attempt expiration attempts are the same. You can check your test by going to the SANS account dashboard and following the certification attempts link

UnixGuy

Thanks! I didn't notice the cert attempt link! yes it's the same...relieved I have more time

sb97

After several false starts, I finally finished my ridiculously long index. I need to review some of the day 5 stuff but my planned schedule is to
take a practice test this weekend
schedule exam based on results
fix index issues and run through day 6 challenge again
print improved index and other notes to set up hard copy notebook
take practice test 2 simulating proctor conditions
Go to the real test!

UnixGuy

Good on you! you're doing a lot better than me. I'm indexing, still in book 3/4 ! exam scheduled on last possible date (which is 4 weeks from today)

I'll try and finishing my index this week and next week and hopefully get to the labs!!

The course is great but I just don't like studying from books/slides etc...I prefer more lab-based approach, but the content is great nonetheless!

sb97

I did my first practice and passed in the low 80s. It took me 2 hours and 40 minutes to finish. As expected, I struggled with the NTFS file system analysis from the day 5 activities.

sb97

I cant believe I forgot to post this but I did pass. Feels great.

Unfortunately, this means I now have to study for my CISSP (requirement for work).

UnixGuy

congrats! My exam is very soon and im freaking out! might have to extend 40 more days...lots of life crap happened thats stopping me from studying...

sb97

UnixGuy wrote: »

congrats! My exam is very soon and im freaking out! might have to extend 40 more days...lots of life crap happened thats stopping me from studying...

Good luck!