In Cybersecurity
How To Pass a Cyber Security Cert in 5 DAYS (No books…) - read the full article about Cyber security 101, Cybersecurity and Network security and pen testing from Cyberspatial on Qualified.One
Youtube Blogger
Ready to take this test.
We got our water, ID, notes stand….
Shoot where’s the books? I LEFT THE BOOKS AT HOME SANS is one of most recognized cyber education companies in the world, training over 40,000 students each year.
They have a certification arm called GIAC, which is one of the surest paths to landing a six-figure cybersecurity job.
Heck, this eBay job ad is from 2002… If I were to rank the top GIAC certifications in terms of value and prestige, they’re sitting just a notch beneath Tier-1 certs like CCIE, RHCA, or OSCE.
It’s SO… expensive.
If Whole Foods means “whole paycheck” to you then SANS might mean no paycheck at all, since it’s often just your employer that can afford to pay for the training.
Whether from popular demand or dollar inflation, the price of a SANS course has quadrupled in the past 20 years.
Priced in gold, it’s actually gotten cheaper though.
But once you do sell your car to pay for tuition, you get the privilege of drinking from the SANS firehose at an in-person training event or with the OnDemand option, which is at home and at your own pace.
This thing weighs like 20lbs.
You could probably use it to lift weights Shoot, I totally forgot about this.
Somewhere between life and work, there’s this “Implementing and Auditing Critical Security Controls” course that got lost in the closet.
Because at your own pace also means at the last minute.
I’ve only got 5 days to study for this thing.
And in those 5 days, I’ve also got to pack up the house and get ready to move over two thousand miles to Texas.
Whats so great about dumb ol Texas? You see, one of the unique things about the GIAC exam is that it’s open-book, so you can bring in notes, cheatsheets, and the books to the test.
The whole “open-book” thing is actually a curse in disguise, since it’s really easy to drain out the clock looking back and forth in the books for answers.
Being multiple choice can also get pretty confusing depending on the construction of the question So in this extreme example, “Which of the following are NOT alternate names for SANS?”, you have to know the right AND wrong answers, think in double negatives, and use elimination very carefully.
So if I don’t get super familiar with the content quick, I’m probably gonna fail.
As a natural PRE-crastinator, I really hate being under pressure and like to over-prepare for things.
That means detailed notes, repeated exposure over time to really get a solid knowledge base.
Which has been a pretty good strategy for me based on all the previous tests I’ve taken But being so short on time, and with zero progress on the books so far I’m actually kind of worried.
Even though I normally don’t care about getting certifications, in this case, if I fail the cert, I fail the course for this master’s program I’m in.
Is it possible to cram so much SANS content in just 5 days? Let’s find out.
The first thing you want to do is schedule the test so we can backwards plan from there.
GIAC has a remote testing option, but I really don’t like installing proctoring software since it just feels super dirty so I usually pick a testing facility.
Since memory consolidation happens during sleep, I need to be in bed around 10pm and wake up before 6am.
A friend recommended Andrew Huberman’s podcast on biohacking and neuroscience, so I checked it out.
He talks about setting your circadian rhythm with morning sunlight and exercise, and working in 90 minute cycles to match your body’s “ultradian” rhythm, followed by rest cycles of Yoga Nidra, Meditation, or Wim Hof breathing.
Combined with my usual habit of one meal a day, I can squeeze in 8 hours of sleep, 3 hours of fitness, 2 hours of food leaving me a total of 55 hours to study.
Minus the rest time and two practice tests, we’re looking at a total of 7.5 hours or 5 ultradian study sessions each day.
But is there a better way than reading a whole stack of trees straight through? The strategy you want to use for SANS is to quickly familiarize yourself with the topics in the books and then make it easy to reference and locate during the test.
We’re going to take what I call the “three-pass” approach, which is to read, tab, and index.
In the first pass, you’ll want to speedread everything, noting key sections and their page numbers on a piece of paper.
Reading flow is much smoother if you cover the slides, since content in the bullet points are usually repeated in the body.
You’ll want to focus your eyes on no more than two points per line, scanning the rest with your peripheral vision Covering lines as you go also helps prevent re-reading text.
After a page or chapter, close your eyes and recall what you just read which is a great way to retain information.
In the second pass, you’ll want to run through the books again, using the notes from the first pass to partition sections using tabs.
You should probably buy some plastic dividers but I’m just going to use these colored sticky notes instead, taping them down so they don’t fall out.
I also like to number the front of the books to identify them easily at a glance.
SANS provides PDFs of the books for download, but you need to enter a password each time to open, which can get kind of annoying.
Another issue is they don’t offer any tactile memory, where you’re able to remember a topics location in the books with your fingers.
This saves you lots of time during the exam and lets you practice like you test.
What digital books do help with is our third pass, building an index.
To do this, you want to open up the sections you tabbed, pulling out keywords that might appear in a test question, using the PDFs to search for any pages they show up in, and save everything in a spreadsheet.
In the index put the book and page number in one column, and the keyword and notes in the other column Then color code each cell to match the tab color for the corresponding book and page.
Index and tabs go together like almond butter and honey.
We can just find the right book, rapid flip to the right section and then get the answer.
I think we have a plan now.
These $2 milk jugs are like the best water bottles I’ve used.
No leaks, really thick, taste great, and like 20 times cheaper than brand name ones.
I wish it was really that easy.
Procrastination. Exhaustion.
There’s just so much content to get through… Instead of studying like we planned, I spent the whole afternoon listening to Andrew Huberman talking about the science of motivation and drive.
Pretty ironic, I know.
I have this idea called the “sanctity of space,” where certain rooms are for certain functions and you only perform activities in the rooms meant for them.
For instance, kitchen is for food, bathroom is for hygiene.
Cooking in the bathroom or using the bathroom in the kitchen would violate this principle.
But with all this packing and moving, I’ve been doing everything all in the same room, which is really messing up my flow.
If you’re struggling with distractions, the best remedy is elimination.
Phones and electronics are the worst space invaders because they’re multi-functional things you can bring anywhere.
When you’re studying, take your phone, silence it, airplane mode it, turn it off, put it in a box, and put the box in another room.
This creates multiple layers of actually checking your phone, since reversing the process is now much more inconvenient.
For motivation, you want to build small wins when your energy levels are high.
These small wins create enough dopamine in your brain to then take on bigger and bigger tasks.
So you can decompose the challenge of reading 5 books down to reading just one.
Before reading one book, you might commit to reading just one section first.
This way you can mentally construct a motivation ladder that carries you forward rung by rung.
But what else am I missing? There’s gotta be some other test-taking tips out there.
Since we need all the advice we can get, I decided to reach out to my friend, Jeff McJunkin, for some help.
He’s an instructor teaching the SEC560 pentesting and SEC580 Metasploit courses.
“My overall strategy tries to emphasize the value of your time as much as possible.
Look, the scores aren’t public.
If you want those letters after your name the difference between 75% and 100% is well, nothing publicly.” I guess he’s right, I don’t need to focus so much on high scores.
Some valuable advice he gave me was to build a tracker with the question numbers and desired time remaining to help maintain pace during the test, which has a countdown clock, so you can avoid spending too much time on a single question.
The ones you can’t find an answer to quickly can always be skipped, and they’ll show up at the end.
You might come across the answer somewhere during another question.
The final tip Jeff gave is to maintain a 10% margin of safety above the passing score on the practice tests before taking the real exam.
I’m feeling pretty good so far, gonna finish up my final pass, make the time tracker, and start the practice test.
Sometimes things just don’t go as planned.
Fatigue sets in, you want to give up.
You can’t fall asleep at night.
Even downloading the course MP3’s for listening gets old.
Transcribing the audio is faster than 2x listening, but then we’re just reading more stuff again.
There’s only so much your mind can absorb before zoning out.
So I just failed my first practice test and it’s super embarrassing What made it worse is I went in feeling unprepared, which is the opposite of where you want to be Fortunately at the end of an exam, SANS gives you a breakdown of the different topics for the course, which gives you an idea of which areas to study more and focus on.
For the questions, I recommend you follow a checklist approach which is to first read the question, eliminate obvious wrong choices, narrowing down to two if you can.
Read the question again and pick the right answer from the remaining choices.
Then double check in the textbooks if time allows.
Re-reading the question after elimination should help catch tricky questions and negatives.
Another thing to remember is that different exams have a different number of questions and time limits, so you’ll have to double check the course info.
For the G triple C, it’s a 2 hour test with 75 questions.
That’s about 90 seconds per question, and I need 54 questions right to pass at 71% That 10% margin of safety Jeff recommended puts me at 64 questions.
During the test, it can be valuable to tally questions you’re sure of and the ones you’re unsure about.
This can help you decide between speed and accuracy during the exam.
Between practice tests you should probably take some time off studying and let your mind relax for a day.
But I’ve got less than a day left so we’ve gotta do a second one back to back.
I don’t know how I managed to pass the second practice test, but just barely… I woke up pretty late, so feeling a bit nervous but I think we’re going to get there just in time.
Alright, so we’re here at the testing center red door that just closed.
I think we’re ready to take this test.
We got our Water, ID… Shoot… wheres the books? Oh my goodness.
I LEFT THE BOOKS AT HOME.
Wait. This is the last day I have to take it Oh man… So what do you do without books? The secret is to prep more than just a tab and index.
Along the way, you should create an outline of the book topics, including definitions, notes, and diagrams.
The process helps you learn much more than just reading, saves you time on the exam, and has been my tried and true method to every SANS cert I’ve taken.
Scored even better than I would have with the books.
This is the story of a cybersecurity student who’s won the battle but lost the war.
You see the value of a SANS course isn’t in cramming hours straight for an exam just to get a cert.
It’s in taking that new knowledge, bringing it into your workplace, and putting it to practice every single day… Even with a few extra letters behind my name, I’m no better prepared to audit companies against the 20 Critical Security Controls.
In the Know, Do, Teach progression, I’m only somewhere here.
I’d be much better off learning the controls, building a home lab, and actually implementing them by hand.
I’m interested to know your thoughts.
Especially those of you who’ve taken a SANS certification.
Is it worth cramming for SANS just to get a cert? Would people just starting in cybersecurity be better off learning on their own? Let me know in the comments below! But that’s it for this episode of Cyberpatial If you enjoyed watching this, please consider subscribing and sharing it with friends.
I’m Ricky Tan, and I’ll see you soon!
Cyberspatial: How To Pass a Cyber Security Cert in 5 DAYS (No books…) - Cybersecurity