Passed GCIH - My take on my first SANs exam

I passed my exam yesterday. This is the first SANs exam I have taken.

TOO LONG; DIDN'T READ statement is at the end of this post, containing the lessons learned from this experience.

First practice exam, with my index: 76%

The second one, without my index: 76%

Official score: 79%

I went to a physical class taught by John Strand. He is awesome. Anyway, here is a high-level overview of it all.

Physical class:
Was great. There is a lot of information, and this is all new to me.
Day 1. Adrenaline filled day. New experience and we dived right in. LOADS of information and this was also the longest day.
Day 2. It started getting harder to follow along because new concepts were being introduced.
Day 3 on out. I was completely lost and took more notes as the days went on.
CoreNetwars. WOW. All I can say is WOW. This was an amazing experience and I'm really looking forward to doing them more and more.
So all in all, the physical course was amazing.

The only gripe I have is the food they fed us during the mini breaks. Yes, I know we can grab our own foods and such and it's my choice on what I can do during the breaks, but it did kind of suck with the options. This doesn't take away from the value of the actual course though. Healthier options would be nice. This probably shouldn't be brought up. Don't mind it.

AFTER the classes.

I went home and read the first book, and didn't touch anything until a month and a half before my cert attempt expired. I truly procrastinated the living hell out of taking the exam.

GIAC extended the exam by 2 months because of technical difficulty, so this really saved my ass.

First go around, I watched the on-demand videos, and read the book, while taking notes and highlighting things. I would watch a slide being talked about, then I would read the corresponding page in the book and highlight things as needed. I also tossed together my index during this time. I did, however, skip all the labs, and I did not index any information from them.

After I got that done, and my index prepped, I waited a while and took the first practice exam.

After the practice exam, I didn't exactly procrastinate, but I went over the books quickly, in a slow manner (if that makes sense?). I went over the books in a skimming manner, but over a long period of time. This time around I indexed more specific details, including the information that was found in the labs.

I took the second practice exam and got a 76 on it, but I didn't use my index for more than maybe 5 questions.

My exam was the next day!


TL;DR section
Lessons learned.

Don't procrastinate.
The index should NOT be limited. If it's in the book, it should be indexed, whether it came from a lab or not.
I really need to learn Linux LOL

DO THE LABS - There was a question on the exam that completely baffled me. I had the command in my index, and when I went to the page in the book, there was no information as to the output of the command because it was in a lab, which I did not do. It was one of those lab questions that said "Type this command. Explain what you see", and there was no screenshot, only a place for me to write what the output gave me.

Most of all, never doubt yourself.


I can't wait for my next experience with GIAC. I'm going with the web app testing (SEC 542) next I think. I already chose the red team at work

If anyone has a suggestion, please, let me know!

I am completely amazed that I was surrounded by extremely intelligent people. This was an experience I absolutely loved. I love being in this field.