Category Archives: certifications

How To Build a SANS GIAC Index

Over the years, my most popular article has been about how to successfully pass SANS GIAC exams.  Most people focus on my second recommendation on building an index for the course material.  Unfortunately, the index guide I linked to is no longer available.  Since I’ve received a number of requests for the Word doc, I’ve decided to write my own version of how to do this.  Enjoy!

  1. Create a spreadsheet with tabs labeled for each book in the course.  For example, “503.1”, “503.2 + 503.3”, etc.
  2. Label the first four columns with: “Page”, “Keyword 1”, “Keyword 2”, and “Keyword 3”.
  3. Read through each course book and summarize each page into three keywords or phrases (e.g. “tcpdump output overview”, “nibble definition”, etc) and note these in your spreadsheet.  Skip this for any pages with no notable information.
  4. For each tab in the spreadsheet, insert a new column before column A and title it “Book”.  For each existing row of pages, populate the book number.
  5. Copy columns A (“Book”) and B (“Page”) and insert both of them before the columns for “Keyword 2” and “Keyword 3”.
  6. Cut the “Book”, “Page”, and “Keyword 3” block and paste them below their respective columns in A, B, and C.  Repeat this for the “Book”, “Page”, and “Keyword 2” block and place these under the “Keyword 3” block you just pasted.
  7. Repeat steps 4 – 6 for each tab in your spreadsheet and remember to save your work. 🙂
  8. Create a new tab in the spreadsheet titled, “Complete”.  This will contain all the data from the previous tabs.
  9. Copy and paste columns A, B, and C from each of the previous tabs into columns A, B, and C of the “Complete” tab.  Paste each new tab’s data below the previous.
  10. In the “Complete” tab, move column C (“Keyword 1”) before column A (“Book”).
  11. Sort the new column A (“Keyword”) alphabetically and perform any edits and formatting cleanup (e.g. remove rows with column headers due to pasting and any blank rows).  Congratulations, you have an index!

Hope this helps and best of luck on the exam!  You’ll do great. 🙂

One final note.  Please don’t ask for the indexes I created, as I will not be sharing them.  The whole point in building your own index is so you’ll learn and retain the material.  Asking for mine or taking someone else’s is a shortcut that will likely lead to your own disappointment come exam time. 😛

How To Pass SANS GIAC Certification Exams

As I mentioned in a previous post, I recently took SANS SEC 504 and have since been studying for the accompanying GIAC Certified Incident Handler (GCIH) certification.  I’m happy to say that over the weekend I passed (thank you, thank you) and wanted to share my strategy on studying for GIAC certification exams.

1. Don’t put off studying.  SANS classes are intense experiences and you may feel worn out after a long week of technical material has been thrown at you.  But if you’re serious about passing the GIAC exam, don’t wait too long after class is over to start studying.  This will keep the material fresh and allow you to recall information quicker.

2. Build an index of the course material.  GIAC exams are all open book and open note — sounds easy, right?  False.  The SANS books are thick and highly detailed.  In order for the books and notes to be useful, you need to create an index that allows you to quickly find what you’re looking for.  You’ll obviously still need a good understanding of the material, but the index will help you quickly research trickier questions.  Building the index will also help you review the material since you’ll need to go through each page to determine keywords and concepts.  I usually take a highlighter and highlight key points on each page.  You can follow my guide on how to create a good index.  Finally, remember to print out the index since you can’t bring any electronics with you to the exam.

My guide to building your own SANS GIAC index.

3. Set aside about two months to study and prepare.  We’re all busy people, and depending on your situation, you may need more time.  In my experience, two months allows you to review one book a week (taking notes and building an index) and then take the practice exams.

4. Take the practice exams.  You get two practice exams and they tend to be accurate representations of the type of questions you should expect on the real exam.  You should have a “draft index” built by the time you take your first practice exam.  Treat the experience like the real exam and see how effective your index is.  If you find the practice exam difficult either because you don’t know the material or your index did not effectively help you, take notes on the questions that stumped you, study the material again, and add to your index.  Then take the second exam and repeat this process.

5. Label your books.  At first glance, each SANS book looks the same.  During the exam you want to be able to quickly grab the book you need that has the answer you’re looking for.  To help me quickly identify a book, I take a sticky note and write the number of the book on it and place it on the front cover of the book like a bookmark.  This way, I can just look at the sticky note and see the big bold number rather than having to read a monotonous book cover.  It’s a small thing but I’ve found the speed increase noticeable.  See the image below for an example.

The process is long and time consuming but in the end well worth it.  I’ve done it twice now and scored 90% on my GCIA and 98% on my GCIH.  I’m confident the process will work just as well for you as it did for me.  Best of luck!