How I Study for GIAC Exams

Effective Study Techniques for GIAC Exams

Note: This is general guidance on how I study, not a discussion of specific SANS course material or GIAC exam content. Please don’t ask me for specifics about exams or courses.

I’ve taken 3 GIAC exams so far (GCIH, GSEC, GFACT) and have scored 100% on all of them.

I posted about this on LinkedIn and received many messages asking me to discuss my study strategy. Prior to starting my first SANS course, SEC275, I decided to learn how to learn, which led me to the topic of effective studying techniques. This post will be a description of what I do to study.

The first and biggest thing to discuss is that this is what works for me. If you copy what I do one-for-one you will probably not have the same results. You should tailor your study system so it works best for you.

Second, I will not go deep into the why behind specific parts of my strategy. This post would be too long and boring if I did. If you are interested in the science behind effective learning, a fantastic book is Make It Stick: The Science of Successful Learning by Henry L. Roediger III, Mark A. McDaniel, and Peter C. Brown. It breaks down the research and will allow you to better implement a strategy that works for you.

The Forgetting Curve

This is the most important concept to be aware of when studying. The forgetting curve is our main enemy when it comes to learning.

The forgetting curve (https://en.wikipedia.org/wiki/Forgetting_curve)

While the rate of memory decay varies among people and the topic being learned, we typically forget new information very quickly. The primary goal when studying is to delay and flatten this curve as much as possible through review.

Forgetting Curve with Spaced Repetition

Sources of Information

I only focus on material that will be relevant to the exam. This means I use the official SANS course material and nothing else. Supplementary material and labs may help, but so far I have not felt the need to use any. In each course, I use the following from the official SANS course:

• Books
• Quizzes
• Labs and any additional hands-on material
• Provided index, cheat sheets

I do not watch the course videos as they do not engage my brain as much as the books, which makes the material harder to recall. I also have only done courses on-demand. The in-person offerings seem like they would be too much information in too short of time, resulting in poor learning due to cognitive overload.

For the books, I use colored tabs and a felt pen to mark the book number at the top and each individual section within. This makes navigating through the book pretty fast during the exam when needed.

Tabbing the sections of the book

I begin the course as soon as I have access. This ensures I have enough time to go through the material and reinforce what is taught.

Index

I do not make an index and rely solely on the index provided with the course. Before starting my SANS courses, I read through a lot of the advice given to students on the GIAC subreddit and watched videos where people shared their techniques. The general advice given is to make an index with every potentially important word throughout the book, then use the index during the exam to find the information.

I think this is an incredibly poor way to prepare and will result in poor long-term understanding and recall of the information. The focus of many students seems to be on optimizing where to find the information in the book quickly instead of just learning the information to begin with.

For GFACT, I made an index, but wound up barely using it on the actual exam. After that, I just used the included index, which has worked out fine for the handful of times I have had to look at it during an exam.

I do think an index can be helpful, but as a complement instead of the main engine for learning and passing the exam. For making an index, most people point to Lesley Carhart’s (the GOAT) *Better GIAC Testing with Pancakes *post.

I compile the provided index and any additional material like cheat sheets into one document. I then have it printed and bound through FedEx.

Anki

Anki is spaced repetition software. If you do not already know what Anki is, they have a fantastic explanation available here: https://docs.ankiweb.net/background.html.

Spaced repetition and retrieval practice are the key to my study strategy. Anki covers both of those areas. I complete the review everyday for all of my decks, typically during my lunch break, right after waking up, or before bed.

Total review for GCIH

Total cards for GCIH

Anki ensures the material I read 2 weeks ago is as fresh as the material I read today. This is extremely powerful in combating the forgetting curve.

My Anki new card approach is fairly aggressive. I add in a max of 50 cards each day, which adds up pretty quickly in the daily review.

Anki Daily Limit and New Card settings

Reading and Creating Anki Cards

For each book in the course, I try to make Anki cards for every piece of information. I think of it like wringing out a rag, the goal is to squeeze as much information out of the books and into Anki as possible. I don’t get everything, but I’ll know the answer to most exam questions immediately, providing plenty of time to find the answers to questions I don’t know or I’m not 100% sure of.

One of the most important things I do while creating Anki cards is to explain the concept in my own words. If I can explain the concept, then I know I understand it. If I’m unable to, then I am either not understanding what I’ve read or I’m missing a foundational or background piece of information that I need to know before I can understand the material. Copying directly from the book would be a poor way to study because I would then be memorizing someone else’s understanding of the material instead of probing and developing my own understanding.

However, not everything needs to be explained in my own words. Information that is just straight memorization like names, acronyms, and definitions don’t need a thorough breakdown.

I asked ChatGPT to generate a paragraph about C that could appear in a college textbook. Let’s assume I am taking a course on C and this paragraph shows up, here are the cards I would make.

The C programming language was created in 1972 by Dennis Ritchie at Bell Laboratories during the development of the Unix operating system. C is considered a systems programming language because it allows direct access to memory through pointers. In C, arrays and pointers are closely related: when an array is used in most expressions, its name is converted to a pointer to the array’s first element, so array indexing is defined in terms of pointer arithmetic.

Card 1
Front: In what year was the C programming language created?
Back: 1972

Card 2
Front: Who created the C programming language?
Back: Dennis Ritchie

Card 3
Front: At which organization was C developed?
Back: Bell Laboratories

Card 4
Front: What operating system was C originally developed for?
Back: Unix

Card 5
Front: What makes a programming language like C a systems programming language?
Back: Systems programming languages allow direct access to memory.

Card 6
Front: What does C use to directly access memory?
Back: Pointers

Card 7
Front: In C, how are arrays and pointers related?
Back: An array's name is converted into a pointer that starts at the array's first element.

Card 8
Front: How are array indexes defined?
Back: Pointer arithmetic

In this case, cards 1 through 4 are what I call “exam trivia”. These cards are not important to my long-term knowledge, but are needed simply because it may be on the exam. After finishing the exam, I will remove these from my Anki set so they don’t take up space. This is information I am fine with forgetting after the exam.

Cards 5 and 6 are things that I understand from reading the text based on my current background knowledge of the topic. I will keep these cards after the exam and continue to review them forever.

Cards 7 and 8 are topics that I do not fully understand and would need the ideas (like pointer arithmetic) to be defined in another portion of the text or I’d have to seek out supplementary information. If the C course covered pointer arithmetic in another section, then I’d have cards related to that which would ensure I understand the concept.

I aim to create at least 50 cards per day. The earlier I begin reviewing cards in Anki, the longer I have time to reinforce and practice the ideas I’ve made cards for. I make Anki cards for everything, including commands, procedures, and concepts from the labs. I don’t tag cards or use any other card types like cloze deletion. These would add a lot of time to card creation for me, and I don’t think the return is worth it.

I try to never return to a page after reading. Re-reading content creates the illusion of competence, where familiarity with a text is mistaken for understanding of it. I trust that I’ve extracted everything necessary during the first reading and do not need to re-read it.

Distraction-Free Environment

Having a distraction-free environment is essential when I study. I achieve this by having a separate area and desk for studying. I keep any potential distractions in another room. The only things on the desk are my laptop, books, planner, desk lamp, timer, and water. Everything else is out of sight and out of mind.

I do not listen to anything while studying, the desk faces a blank wall, and I usually keep my door closed as well. This effectively eliminates all potential distractions. If I’m not feeling in the groove to begin studying, I’ll also turn the internet off on my laptop so I’m not tempted to doomscroll and procrastinate.

Avoiding Cognitive Overload

Cognitive overload occurs when too much information is attempted to be learned in too short of a period of time. We are only able to hold a small amount of information in our working memory at once, and if this becomes too saturated, we won’t be able to juggle all of the information, and we’ll forget it faster.

I use a timer to ensure I do not study for longer than 50 minutes at a time. After 50 minutes I take a short break to let my mind process through the last session and reset for the next. During each break, I typically just do a chore I need to do or respond to messages.

I also do not try to study too much during a day. Too much information in a day begins to become ineffective. Having a massive backlog of Anki cards is also bad because it means I’ll be further down the curve of forgetting before I see the card for the first time. Once I hit a backlog of about 150 cards, I take a day off of studying and just do Anki review for the day.

Integrating Labs

Labs are the first test of being able to apply what has been taught in the course. I always try to initially complete the lab without help, then work through the lab book if I cannot figure it out. Like with the regular textbooks, anything included in the lab is made into Anki cards, following the same formula that I use when making cards from the textbooks. If I find an alternative way to do something, I include that as well.

After finishing a lab, I take a mental note of what I struggled with or could have done better. This typically ends up being things that I need to make Anki cards on or ensure I take into account in future labs.

Quizzes and Practice Tests

The course quizzes and practice tests are key areas of feedback to determine where I stand with the material. I take the quizzes directly after completing the associated book. For questions I miss, I make sure I know why I missed it. This reveals misunderstandings I have with the content, allowing me to correct them.

For practice tests, there are a few different ways I’ve approached them, and I’m still trying to figure out which is most effective for me. Primarily, I’ve alternated between simulating the exam and not using any resources at all. With simulating the exam, I try to treat it like the real thing, ensuring I fully know an answer before submitting and being extra careful. I’m really bad at doing this because I end up never taking it as seriously as I take the actual exam. I submit answers I’m not 100% sure of.

When I do practice exams without any resources, I try to see what score I would get without any help. This has been a very strong way to highlight exactly what I’m slow at or need to gain a better understanding of.

For both practice tests, I choose to enable the setting that immediately provides feedback for wrong answers. This makes sure I can figure out where my understanding is weak.

Exam Strategy

I take all exams in-person at a Pearson VUE testing center. This way I don’t have to worry about power or internet issues, or anything else that could be distracting during the test.

My exam strategy is fairly simple. If I know an answer, I submit it and move on. If I don’t know or am not sure if it’s correct, I skip it and return later. I try not to pull my books out at all until the end to make sure I have more than enough time for the harder questions. I’ve found that I know so much of the information due to my preparation that I am able to answer a majority of the questions immediately. This saves a ton of time that I then spend digging on the previously skipped hard questions.

Post-Exam

After the exam I archive the course Anki deck, I then move the cards over into a large combined deck with the cards from every previous course. I review this deck every day to ensure I retain the knowledge covered in the courses I’ve taken. While doing combined deck review, I delete any cards that pop up and are exam trivia or things I don’t care to remember long term.

Card counts for my combined deck

I also take time to think through ways I can tweak how I studied to be more effective or things I’d like to experiment with next time.

Why This Strategy Works

The reason this strategy works is because it effectively fights the forgetting curve. I think the primary benefit of this strategy is that it allows me to answer most of the exam questions instantly. This ends up saving so much time that I can flip through multiple books to find the information for the difficult or nuanced questions I skipped.

So far, this study strategy has worked very well for me. At some point I will not get 100% (tragic), but I do think this strategy can pretty much guarantee a very high score for every class. I’m really looking forward to testing it against GDSA and GCIA, which I think will be a true test of how well the strategy works.

Summary

Here is a condensed version of this post.

Basic rules:

1. Begin studying the course material as soon as possible.
2. Do not study for more than 50 minutes without a break.
3. Do Anki review everyday.
4. Study in a distraction-free environment.

Studying:

1. Create Anki cards for each piece of information based on your understanding of the material.
2. Avoid studying too much in a day or creating a large backlog of Anki cards.
3. Attempt labs without help.
4. Use quizzes and practice tests to identify weak areas.
5. Use an index as a complement (optional).
6. Move course Anki cards into a combined deck after completing the exam.

Questions

If you have any questions, feel free to comment them here, email me (carson@carsonshaffer.me), or DM me on LinkedIn (https://www.linkedin.com/in/c-shaffer/). I’ll try to get back to you as soon as possible.