After giving a talk at SANS CDI Dec 2022 with Brian Corcoran, I figured I should put together a blog post on hints and tips around prepping for GIAC exams, and the things I've found useful, so here it is...
0. Initial notes
After sitting a class, take a break of a week or two before launching into prep. SANS classes are intense, and trust me, you need some down time!
Do your prep well in advance of your exam so you're not rushed and have plenty of time to do everything you want to do
While you're going back through all of the content to form your index and do your tabbing, when you get to a lab, DO THE LAB. This will help to cement those topics in your head
Use the printed materials, PDFs, and MP3s when going back through the content - whatever works best for you
Read other posts and articles on how others have prepper for GIAC exams and use anything you think might be useful for you
1. Indexing
Index all of your books, including the Workbook (labs)
Use a spreadsheet and pick the main keywords for each topic that you would use to search for content - think about good textbook indexes; you need to be able to find the information as quickly as possible
Colour code it - give each theme a colour. For example: tools and how to use them can be in blue, Cloud can be in yellow, Registry can be in red
Don't be afraid to add terms in twice if you're not sure which way to write it - better to have something in twice than not be able to find it in the exam
Make sure you include the book number and page number so you know which book the topic is in (may sound obvious, but may be easy to forget too)
Index cheatsheets and any other content you think is also relevant
Do your own index
There are two primary objectives here: 1. have a way to find information as quickly and efficiently as possible in the exam, but also 2. filter all of the course content through your head in order to create the index. Do not underestimate the importance of the second objective
Be wary of using automated tools to create this index - they may not create the index in a way that makes sense to your brain, so they won't make the content easy to find
Don't rely on indexes created by others
As above - they may not have been created in a way that makes sense to your brain, and you've skipped the process of going through the material to help it sink in
Your books may have an index at the back - don't rely on this either. It's great to have it, but rely on the one you've created
Binding it in a better way than a single staple in the corner is probably a good idea - along the entire long edge makes it easier to turn pages
TOP TIP: If you use Excel, make sure to print the title row on every page, not just the first one:
Page Layout -> Print Titles -> Rows to Repeat At Top -> $1:$1 -> OK
2. Tabbing & colouring
Get coloured sticky note tabs, and add them to the pages of all of your books (long non-spiral-bound side)
Match the colours to your index so you can easily identify topics
Write 1-3 words on each, with the topic name or keyword(s) so it's clearly visible
Don't miss out the Workbook!
Brian Corcoran's idea, from someone else who had the idea... get different coloured marker pens and colour in one edge of each page in each book in a different colour (e.g. so looking at the top of the book, you see all page edges are coloured). This allows you to easily differentiate between each book when they're all in a pile in front of you in the exam i.e. which is book one (the green one), book two (the orange one), etc.
3. Pacing - 100% Brian Corcoran's idea that I'm stealing moving forwards
Create a pacing guide
Find out the length of your exam and the number of questions you will be given (on your GIAC portal)
Note that some exams have variable numbers of questions. The total number you actually get will depend on which questions you get from the wider pool on the day (some don't count towards your score). For these, I tend to pick the maximum number of questions you'll get to do the pacing document.
Write out a table with time left (counting down from the exam length) and the number of questions left, and completed, which correspond to the average for that percentage of exam time elapsed...
Example, for a 2hr exam, with 100 questions to answer:
Time Elapsed Questions Left Questions Answered
02:00 100 0
01:45 87 13
01:30 75 25
01:15 62 38
01:00 50 50
etc.
However, acknowledge that not all questions are created equal, so don't panic if you're not EXACTLY on pace!
4. Practice Exams
Use BOTH practice exams
These show you exactly how the exam will work and give you a feel for the environment & questions
My approach is to do my index and my tabbing, and then do my first practice exam
Turn on the option at the top to give the detailed answer whether you get the answer correct or not (by default this will only give you the answer if you get it wrong). I do this so that for any questions that come up where I don't know the answer but happen to guess it correctly, it will still tell me the right answer, and why
For any questions I don't know or that I get wrong, I read the provided detailed answer and in my own separate notes document, I type a (very short!) overview of the main points
Important point here: DO NOT copy out the questions or answers - when you go into the exam, they will check for this and you can be banned or have GIACs taken away - it's not worth it!
After the first practice exam, I then:
Update my index if I found anything confusing or couldn't find something during the practice exam - if I couldn't find it then, it wasn't a good enough index!
Properly organise those notes that I took during the exam, of topics I didn't know well enough. This starts to then become an alphabetised cheatsheet of topics I'm less confident in
Take the second practice exam & repeat the above steps to further refine your index and notes
You won't get the same questions in the real exam that you had in the practice exams, but they're all based on the same topics, so the cheatsheet can come in handy
5. Exam itself & final notes
You should then be taking into the exam itself:
Printed course books, covered in annotated sticky note tabs
Course cheatsheets
Printed index
Printed notes from your practice exams and any other topics you wanted to add in for quick reference
Any other printed or handwritten notes you think might be useful
As an example, for my GCFE exam, I printed out the table of logon IDs for event 4624, to use as a cheatsheet. It is in the books, but it felt much easier for me to find if I know it's printed as a cheatsheet
Manual pages for using commands and their parameters are also good examples
Don't forget to read the instruction email carefully before going to the exam centre
I also print this out & highlight the line that says it's an open book exam with a highlighter, just in case the staff question whether you can take materials in
Put everything out that you need to take the night before - ID, printed materials
Plan your route to the test centre the day before, check timings, and check on any potential travel disruptions (strikes, engineering works etc.), so you don't need to panic on the day to get to the location
Arrive early - provides contingency time, some centres can be REALLY hard to find, and they may let you start early anyway as you're there
FINALLY... AND MOST IMPORTANTLY - Find your methods: do what works for you
Everyone learns differently, and everyone recalls or finds information in a different way. This is all stuff that has worked for me (or Brian!), but you need to find what works for you, and only you can do that. A lot of it is trial and error with different approaches, but ultimately, you won't have time to look-up every single answer in an exam and for those questions you do need to check, you're just trying to make it as easy and fast as possible to get to the answer
Good Luck!