My approach to Ace GIAC exams

1. Choose a SANS course that really interests you, I can only learn for stuff that I find interesting.
2. Attend the course and write minimal notes when the instructor summarises a page or explains the implications.
3. Re-read the book, highlight key words / phrases, stuff that you want to see when searching for it at exam date.
4. Also during the re-read, create your index with key words, about one key word per 3 pages for me.
5. Take a practice exam, if you are content with the result (min. 80%), you are done learning.

Example 1 - NTLM Login Flow

Highlight important words like "nonce", "challenge", "signed", etc. and create the index entry. Also, maybe the instructor mentioned Responder / Coerced Auth at this page and you created a small note. This might help too.

Example 1

Example 2 - Skeleton Key Attack

Highlight important words like "misc::skeleton", "must be done on all DCs", "one pw for all accounts"

Example 2

Create the actual printed Index

Assuming we have a finished pre-index like this:

Finished Pre-Index after reading all books

Then I create one index to sorted by topic, then keyword, and one index sorted by keyword only, like this:

Topic Sorted

Index for topic Lateral Movement

Index for topic Persistence

Keyword Sorted

Index over all keywords - sorted only by Keyword

Results