Studying in the Cracks
Sat for the GIAC Cloud Forensics Responder exam recently, and what I actually remember is the spider. Somewhere in the middle of filtering Microsoft O365 logs, it crawled into one of my books. I have never been more grateful for the two unscheduled breaks that GIAC allows.
That was my third SANS exam. The first was GCTI, Cyber Threat Intelligence, last year. I failed it, took it again, and passed. After three sittings for SANS exams and 5 certifications so far this year (I had to for continuing study), I have some takeaways on what actually works when preparing for an exam, as a busy adult with a life and kids to balance.
#1 - Lowering the Barrier to Entry
We build a lot of ceremony around learning. Sit at a desk. Clear block of time. Full focus, no interruptions.
For working adults and parents, that standard can be disqualifying. If learning only counts when the conditions are right, most of us will rarely learn anything, because those conditions are rare.
What worked was to stop waiting for the ideal conditions to learn. I played the video lectures like a podcast while driving, even though I couldn’t see the slides. I propped my IPad up on the treadmill at the gym and watched them during incline walks. Neither is an ideal good study environment, but it is still possible to learn there. Lectures don’t require deep focus. In my limited desk time, I focused on the work that did need it—labs, practice exams, indexing.
Progress doesn't require perfect conditions. It requires using the time and space that you have.
#2 - Trusting Yourself in the Chair
I have lost points on material I knew because I had already decided I was underprepared. On the GCTI attempt that I failed, I believed that I hadn’t studied enough. That belief is tricky because it is founded on an invisible standard of what “studied enough” looks like. Coincidentally, that invisible standard is likely an unrealistic one, too. You will almost never walk into an exam having studied to perfection; there will be a section you skimmed, a lab you meant to redo, a topic you know is thin. The temptation is to read that gap as evidence that you aren't ready.
That belief leads to self-doubt. Self-doubt makes you second-guess an answer you had right. It makes you spend a break on a question you already solved. It carries a running deficit into every section after it.
Accepting imperfect preparation isn't lowering the bar. It's deciding not to measure yourself against a bar that doesn’t actually exist. Answer what you know, flag what you don't, and keep moving. The exam scores what you get right, not how thoroughly you prepared.
#3- Non-traditional Indexing
There is a lot of guidance that exists around indexing properly and study strategies. After watching and reading the guidance, for me, indexing became a test of endurance. Now, there is real value in endurance! Flipping through every page is one way that material sinks in... but it isn't the only way to end up with an index you can use. Insisting on relentless indexing meant I spent hours on transcription that I needed for retrieval practice.
My recommendation is to use the indexing tools that exist and refocus the effort into recall practice. This looks like reorganizing it the way you reach for information, adding cross-references, and refining it against practice questions. An slim index finished early and rehearsed through practice is more effective than a robust one finished the night before.
Summary
Looking back at three exams, most of my early effort went toward feeling prepared rather than being prepared. The protected study blocks, intense indexing, and the belief that I had to earned the right to feel prepared for the exam.
Start where you are. Use the tools. Study in the cracks of life. Then trust the version of you that shows up on exam day, even if ambushed by a spider while doing the final Cyberlive questions.
