I had finally obtained the GIAC Security Expert certifications on May 17 after going through a 2 years process of preparing and taking the exam. So here I am sharing the good news with the community with my preparation without any disclosure of the exam lab content itself.
The story begins 2 years ago when I had finally decided to go for the GSE Theory exam. The journey was indeed long and difficult, but it was definitely more torturous on the mentality than the actual preparation for the exam itself. Since this is not an ordinary exam, I took quite a while preparing the index using materials from all 3 courses for the GSE Theory. In the end, I took GSEC Windows and Linux, and all 6 books for GCIA and GCIH into the exam hall. I had also brought in the book team handbook written by Don Murdoch for the theory test.
The theory exam wasn't too difficult. I felt that I had over prepared for the theory exam after finishing it. Even though the exam had a time limit of 3 hours against 150 questions, I did not really used the books that much for the exam. However, comparing to a standard SANS exams with 150 questions which had 4 hours allocated for the candidates, the GSE the exam definitely requires the candidates to know his material content well. I walked out with a passed with 84% and about 30 minutes left (can't recall).
After getting the theory exam done, the next step is to book the lab. Initially, I had intended to went for the lab the same year which i had taken my theory. But I decided not to rush and spent more time to prepare for it, which led me to postpone the GSE labs exams until SANS October Vegas last year. To prepare for the GSE labs, I had tried to walk through the practical in GIAC course materials and make the best used of it. As for the reference materials, I had also added study notes from other certified GSE as part of my exam notes. The biggest challenge when preparing for the exams is that I had no idea if I am on the right track of the preparation. I eventually give up preparing for the exam and concluded that I might as well just went for it since there isn't anything else I can work on anymore.
Lab exam day comes, I was definitely anxious. Met up with some of the candidates taking the labs and discuss about how each other was preparing for the exams. Time went by fast and we proceed to register and get seated. There was about a total of 20 candidates who sat for the exam. After finding my seat, I swear there was something wrong with my assigned laptop not being able to connect to the shared server. Tried to follow the handed out instructions twice, I eventually reach out to the lab instructor like a total noob. The lab instructor was definitely helpful and come by to work on resolving my issues. But eventually, they couldn't figure out what's wrong and shifted me to a backup machine. Luckily, I am able to connect to the shared server with the new laptop which sort of calm me down a little.
Everyone starts pouring out their exam notes. Those who live in US can easily bring in more books. I even saw some of the candidates brought in a luggage full of SANS books for the exam. Since I flown in from Asia (and got some stuff in the states to work on), I do not the luxury of space. After some consideration, I went in with printed notes, blue team handbooks, SANS **** sheets and GSEC windows and linux.
Time flies really fast while doing the lab. There are so many things to write in for submission. Since I am can't disclose anything, I am going to skip the details. But we definitely had a lunch break at the end of each morning session. During the afternoon session, they also provide some snacks for tea break. Most people won't step out for the tea break, but I figured to go and grab some anyway. While it's really better to maximise every time available for the exam, I am one of those oddballs who believes in taking a break can help to perform better.
So two days went by... sort of in a similar way. I went out with a heavy heart as I felt I can perform better in some areas. I tried not to think of it. Based on the information from GIAC, they will take a month to mark the exam. During the waiting period, it is definitely a mental journey waking up expecting to hear the news. One month went by, and I got the email morning informing me of my GSE results... I did not meet the criteria to pass the exam. I was devasted... I thought I would have nailed it. Then there is an additional paragraph which reads...
For each person just short of passing GIAC asked the subject matter experts, "Would you be comfortable with this person as the top technical security expert in your company given this body of work?" The answer in most cases was, no. However, in your case the subject matter experts felt that with just a bit more seasoning and hands-on work to address your deficient areas that you would be ready to hold the GSE credential.
The original GSEs were all required to hold at least five Gold credentials before even attempting the GSE lab. Our analysis reveals that success rates are much higher among GSE candidates who do hold multiple GIAC Gold credentials.
This being said, GIAC would like to offer you a unique opportunity to complete additional work in the specified deficient domains to then be eligible to earn your GSE credential. In order to earn the GSE credential, it is required that you complete a GIAC gold hands-on research project in the specific areas where you were deficient. The research and writing work will give you additional hands-on skills and seasoning that would have been helpful to you during the GSE lab. Completing this additional research work will compensate for the deficient domains and demonstrate to GIAC that you do have the hands-on skills necessary to earn the GSE credential. GIAC staff will work with the gold program advisors to approve your research topic, which must be technical.
Apparently, I was given another chance to supplement for the GSEC domain which I had failed. GIAC had given me an additional chance to complete a GSEC Technical White Paper as part of the unique opportunity to obtain the GSE. Without any choice, I start of working on it as soon as possible after getting the result. Luckily for me, I had some past experience before from working on my GCIA Gold Paper. However, since I am not good at writing and explaining the concept I am writing on, hence the white paper took me around 6 months to finish it. After getting the paper cleared, they evaluate the paper and updated my name to the list of professionals to hold the GSE accreditation. I am so proud of it and was extremely delighted to be able to get a huge load off my chest and be part of the selected few to be able to hold such a prestigious accreditation!
NOTES Used
For anyone who is interested in my work experience, I had about near to 8 years experience and only had experience in SOC environments.
The lab exam is not hard. It is designed in a way that anyone can complete the lab, but it is just a matter of how long it will take to finish it. The GSE labs expect the candidates to know the domain knowledge well enough to be able to complete it within a very limited allocated time. If you are looking at the GIAC Course Materials and found that you can be more efficient in every area than what the course materials suggested, then you are very likely to be ready for GSE. Based on the List of GSE Professional list and the total number of candidates that I recall during my lab exam, only 8 out of 20 candidates that went to the lab had a direct passed.
