The questions I remember struggling with did come from the newer versions of the Knowledge Body. So if you’re going to study for the Certification Exam, even though the Certification Page still lists the old documents, you’ll want to study the new standards.
Now there is a new version of both the O-RT and the O-RA that came out this year. But after asking the member team at the FAIR Institute if I should get the new versions in case the test changed, they said I should be okay using the older material.
After taking the exam about six weeks after asking that question, I think I should have studied the new versions, even though the other study material doesn’t appear updated yet. Some of the questions on the exam didn’t make sense, and I suspect they reflected the change in the new versions of the O-RT and the O-RA. I need to check that, but I wanted a few days of downtime to read other things.
[*] I’m not teaching this term; part-time lectures are used to fill classes that the department doesn’t have Full or Part-Time professors (Ph.D.) for courses. The department has also been hiring more Ph. Ds the last few years, so there are more of them now, meaning they need fewer lectures. It also means I have more free time to work on personal things. While the job says part-time, I spent more time doing class-related administrative work than I did my Full-Time Day Job.
So that’s a thing. Second SANS class taken, second GIAC exam passed. I’d share the embedded link, but it gives too much personal information away. So all that is here is the certification badge they provide.
Next up is going to be the Open FAIR certification. I went through the training on my own dime last year, and I’ve been slowly studying for that one since last year. I’m planning to schedule the test for mid-August.
For SANS/GIAC, next on my radar will probably be Sec 504 / GCIH.
Last talk I have, I expected audience participation, because I asked for it. I failed the audience. I know how to improve the talk for last time.
What was my bias that lead to me failing the audience? I’m used to participation being part of my grade, and having to participate. Others in classes were the same way. Yes we had some that barely participated. But usually half the class did.
Because that’s what I was used to in college class setting, that’s what I expected at a conference talk. The result was I failed my audience with expectations that I shouldn’t have put on them.
Click this Panic button to reset everything. Go look at this pcap in Wireshark. Run this command in cmd.exe (and even walks the student through opening a term window by go to the start button, type cmd in the run box).
Run Snort with the test option on a pre-defined rule set using the pcap you looked at. Modify the same rule multiple times, enabling and disabling an alert each time. Run to see the difference.
Answer these 10 questions.
The last question was how to improve the class… I forgot to say use a Linux VM instead of a Windows VM. Since one of my answers did require Grep. Which means copy and paste from the VM lab to my box connected to the lab.