How I prepared myself and passed SEC504 exam
By: Ramon Martinez
Tags: Information Security, Cybersecurity, Education

Dear readers,

My first post here. This is just a brief I have created to help some of my colleagues whom is next to take the SANS SEC 504 Exam.

Intro

SANS is a global recognized institute providing infosec trainings. Very recognized due to their quality and exclusive content (up-to-date), having very good and experienced instructors. Full scope. They have tracks from Governance to Red Team. Read more: https://www.sans.org/courses/

For this article, I will talk about SEC 504 - Incident Handling and Hacking Tools which I took the exam in March 2018. Personally, I consider this course 60% Red Team / 40% Blue Team. Certainly, a nice intermediary course that teaches lot of new techniques even to the most advanced professionals.

Taking the course

For those who’s thinking on attending the course there you go some tips, I would highly recommend to take this extra packages:

2 Practice Tests (Very Helpful — Questions very similiar to the exam give real perspective of how much you are prepared before taking it)

(Very Helpful — Questions very similiar to the exam give real perspective of how much you are prepared before taking it) Read carefully and save the details. The practice tests give you insight on which subject you need to improve!

On-demand class (If you’re going to take the live class, I consider this is a must, since there are lot of labs and professional experiences shared in the live one. There’s a lot of content for few days and the on-demand class will help you a lot to fill the gaps you didn’t take it.)

(If you’re going to take the live class, I consider this is a must, since there are lot of labs and professional experiences shared in the live one. There’s a lot of content for few days and the on-demand class will help you a lot to fill the gaps you didn’t take it.) GIAC exam (obviously, being certified and depending on score eligible to Sans Advisory Board and Mentor Program I will discuss later.)

SEC 504 itself

SEC 504 is a very popular SANS Course very broad. At the moment I’ve been writing this report is a 5-day course (6 if you have the competition day) starts preparing you to handle incidents, from building a IR team up to detecting rootkits and advanced techniques.

GIAC EXAM (official source: https://www.giac.org/exams)

1 proctored exam which you can bring your hardcopies(Exclusively on-site) — I brought my sans oficial class books, cheatsheets available at https://digital-forensics.sans.org/community/cheat-sheets)

Exam Day details

100 –150 questions (I got exactly 150)

(I got exactly 150) Time limit of 4 hours (I took in 03:35 — In my case, I had an average of 1 minute and 40 seconds per questoin)

(I took in 03:35 — In my case, I had an average of 1 minute and 40 seconds per questoin) Minimum Passing Score of 73% (Sans calc based on average from the last exams, so this may change in the future)

(Sans calc based on average from the last exams, so this may change in the future) Optionally, you have the option take one break of 15 minutes . Keep in mind you are not allowed to leave the building (obviously) and your electronic belongings should be stored prior safely and locked with the school before joining the room. Use this pause wisely. I chose to do it about 60% of the exam already taken going to the bathroom. This pause doesn’t take count of your exam time.

You cannot leave the room for break before answering skipped questions!

. Keep in mind you are not allowed to leave the building (obviously) and your electronic belongings should be stored prior safely and locked with the school before joining the room. Use this pause wisely. I chose to do it about 60% of the exam already taken going to the bathroom. This pause doesn’t take count of your exam time. You cannot leave the room for break before answering skipped questions! Please, bring two personal identifications which is required.

which is required. Check the closer proctor near to you: https://www.giac.org/exams/testing-centers

Create your own index and save your precious time!

As you have about 1 and half minute. Keep in mind there is a lot of content and many pages of books and subjects. You may loose lot of your time navigating through the pages getting upset and nervous. Once you build your own Index this will guide you to fix and review the content besides save you LOT OF TIME. I would highly say the likelihood on failing the exam without a index is very high. SEC 504 gather windows, linux, hacking tools and lab skills all of them being covered on the exam. So, it’s up to you picking up your best strategy.

Put stickers on your book according to the most relevant matters (Thank you Leandro Jordino for this tip)

Believe me, you will bring a lot of contents to your table and will be hard to recognized the books which belongs the matter, since questions are mixed. Putting extra stickers into the pages of your book will help you a lot identify them fast and confirming appropriately the subject.

Managing your time:

In doubt or stucked in any question, flag as review or skip them to answer later so that you do not waste your time. The answer may appear in your mind with other question or reading the book. In my personal exam, I have skipped about 15 questions or so which I remembered later upon reading some book contents from other questions.

GIAC Benefits

Scoring at least 73% is mandatory and should be painless since you took the class, made the practice tests, built your own index, and reviewed the on-demand class. The best part I personally like on GIAC and motivated me to study hard is the additional benefits when scoring higher, there is few additional benefits as;

If you score 85% or higher you become eligible for a Mentor Program Sans class (first step of becoming Sans Instructor) https://www.sans.org/teach/faq If you score 90% or higher you become eligible for Sans Advisory Board. A very interesting community discussion board of infosec related matters. https://www.giac.org/certified-professionals/advisory-board

If you’re intested in, do your best according to your practice tests so that you will get the best grade as possible.

Additionally, my personal general tips for any exam that applies to SEC504 as well

Choose the best day and time of the week fits better for you:

I don’t recommend taking this exam very close to the weekend (e.g Friday), since your body and mind might be sick or tired from the heavy duties from the week.

Monday could be a rushed day where people will run to solve many things that accumulated from the weekend and last week, so there might be some heavy traffic in your way. Personally I like to do it from Tuesday to Thursday between 10:00 AM 11:00 AM — Enough time to run from the rush, yet still early to have the mind clear with no stress.

Check the room temp as soon as you get into it.

Make sure you feel yourself comfortable before starting the exam. Check if isn’t there any noise that could draw off your attention. Notify your proctor so that they could switch you to other room or fix the issue.

That’s it.

Thank you. Any doubts talk to me.