SANS FOR572 and GNFA Review

I completed SANS FOR572 with Phil Hagen on-demand from May to September of this year. Today I passed the GIAC GNFA certification. This was my first SANS course and I plan to take more in the future.

First things first - how did I study and pass? My course completion was strung out far longer than I recommend. Life got busy, my homelab hardware crashed a few times, and all of the sudden I got the email that 60 days remained on my GIAC attempt. I focused on listening to lectures on my train rides and taking notes on the written material. I cramped my hand writing Lesley Carhart’s indexing method. Nerves were high as I sat for my first practice test. I’d quickly find out that my strategy worked:

• First practice exam: 85%
• Second practice exam: 99%
• Final certification exam: 92%

I’m chaulking up the certification exam’s score to a groggy morning. The exam is extremely fair and representative of the course material. As most would say, I appreciate that the exam covers hands-on interactions with the tools. You’ve got total freedom to answer the exam questions. I’ll note that I did not complete the capstone project and I survived. I plan to revisit the project in the future.

I felt obligated to complete the certification, but I do feel I could have skipped it and been equally satisified with the course. This is less of an indictment of the exam and more of a reflection of the quality of the course. My favorite moments with the course were spent implementing the showcased tooling in my homelab or converting VMDKs.

I do recommend the course to fellow PCAP enthusiasts. If computers didn’t network, we wouldn’t have a need for the InfoSec field. I’ve never regretted learning more about the wire, and this course was no exception.