INTRODUCTION
The difficulty with security is the number of areas it touches. These days, all you have to do is turn on the news and you’ll see at least one story indicating the importance of security. Whether it’s a major company losing a lot of data that affects their customers, or a governmental agency losing sensitive information, security can have a significant impact on many people. The GIAC Security Essentials (GSEC) certification attempts to address that issue with a test that covers a number of technical areas that security impacts.
SANS offers training courses to prepare individuals for the GSEC exam, though you can take the certification exam without attending a training course. In terms of the financials, the difference is that without taking the training, you will pay more to take the exam itself. For instance, you’ll pay a few hundred dollars more for the exam without the training, but well over a thousand dollars more with the training, and that doesn’t include travel to the training location. It really comes down to how best you can learn the subject matter, and how much money you want to pay. In the end, the exam is still the exam, and you’ll have to know the same material either way. If you are motivated to do the work you need to do to absorb the lessons, you should be able to pass the exam without needing to take a week of training. If you need to be pushed and guided, you may do better doing the training before taking the exam.
Either way, this book will be a valuable asset to you. It is designed to provide you with the information you need to pass the test. Beyond the information needed to pass the test, I’ve added in some interesting and helpful text to explain concepts better and give the subjects some additional context. Sometimes, these supplemental texts will be a bit of history, to help you put things into perspective.
Registration
Once you have decided whether you want to take the SANS training course or study on your own, you can register for the exam at the GIAC website. After registering and paying your fee, you will have four months in which to take the exam. Getting registered, though, will give you access to two practice tests that should give you a sense of how prepared you are, and also provide an example of the material presented on the exam. These two timed tests are similar in tone and content to the actual exam. They are timed, just like the real test, and consist of 180 multiple choice questions (again, just as in the real test). The one difference is that when you get a question wrong on the practice tests, it provides you with the correct answer, as well as an explanation about the right answer. You can also flag questions for comment.
Taking the Test
As mentioned earlier, the certification test consists of 180 multiple choice questions. You will have five hours to complete it. Following every 20 questions, there will be a checkpoint indicating your current percentage correct. You will also be able to flag questions for follow-up. This does not mean you can go back and change your answers, but it does let you make comments about the question or answers. These comments are limited to providing feedback about typographical errors, technical inaccuracies, questions that seem to have multiple correct answers, and spelling and grammatical errors. You will not get credit for making comments, but you will be notified that your comments have been received.
Since you can’t change your answers to earlier questions, you need to spend whatever time you can trying to get the answer right on your first pass. You can bring a backpack or briefcase of books and papers into the exam to help you find the right answers. You cannot, however, bring any computers or computing devices like phones, calculators, or tablets into the room where you will take the test. Having the ability to bring books and notes may change your strategy on how you study since you won’t have to memorize everything for the exam. You should, however, carefully choose the materials you take to the exam since your resources are limited.
Proctoring
The exam is proctored, and you will take it at a Pearson VUE facility. If you can’t find a Pearson VUE facility within a reasonable driving distance of home—say, one to two hours away—SANS will try to make arrangements to find something closer for you. You will have to check in when you get to the exam room and ensure you have left everything other than your books outside. You will also need to provide two forms of identification. On questions where you need to perform calculations, you will be given an onscreen calculator. There will also be an erasable noteboard and pen provided in case you need to draw, make notes, or perform hand calculations.
You can cancel and reschedule exams within one business day (24 hours) of your exam without penalty. If you need to cancel with less than 24 hours’ notice, you will give up your seat at the exam and also be charged a $150 cancellation fee. You can cancel and reschedule your exam through the web portal on the GIAC site, using the username and password you created when you first registered.
Post-Test
A passing score is 73 percent. Anything below that fails, and so you would need to schedule and pay for another test if you still want to pursue certification. You will be charged to take a second test if you fail the first one, but the fee will be less than for the first test. Check with the GIAC site to see the current pricing. You will also have to wait 30 days before taking the follow-up exam. This is intended to prevent you from rushing back to take the test and throwing money away when you aren’t as prepared as you should be.
If you pass, you will know right away because you will be provided with your score. You will also get a summary sheet telling you how you did on each area of knowledge, just as you did on the practice tests. You will then receive your certificate in the mail. You can get your certificate framed (or not) through SANS.
Once you have the certification, you will need to maintain it with continuing professional education (CPE) credits. Every four years, you need to renew your certification and you will need to have obtained 36 CPEs in that time.
The Value of the Certification
Having the GSEC certification will prove to potential employers that you have demonstrated technical knowledge in the areas the exam covers. Many government agencies place a high value on the certifications from SANS because, unlike other certifications that cover material at a higher level, SANS ensures that the people who take the exam have a fairly deep level of technical knowledge. Once you have the certification, you can be a security analyst or a security engineer, go on to working on incident response teams, or use it as a starting point to pursue other more specific certifications. The GSEC certification is very broad, meaning you must have a solid understanding of a lot of security information. While studying for the GSEC, you may find you want to delve deeper into one particular area and pursue the knowledge needed for a certification to be an incident handler, penetration tester, or Windows security administrator. With the GSEC, you may have everything you need to pursue those jobs without additional certifications, depending on your potential employer and their requirements. You certainly have enough applied knowledge to be successful in a number of security-related jobs.
How to Use This Book
This book covers everything you need to know for the GSEC exam. Each chapter covers specific objectives and details for the exam, as defined by GIAC. I’ve done my best to arrange these objectives in a manner that makes sense to me. I hope you feel the same.
The chapters have several components designed to effectively communicate the information you’ll need for the exam:
• Sidebars are designed to point out information, tips, and stories helpful in your day-to-day responsibilities. They’re also downright fun sometimes. Please note, however, that although these entries provide real-world accounts of interesting pieces of information, they are sometimes used to reinforce testable material. Don’t just discount them as simply “neat” stories—some of the circumstances and tools described in these sidebars may prove the difference between correctly answering an exam question and answering it incorrectly.
• Exam Tips are exactly what they sound like. These are included to point out a focus area you need to concentrate on for the exam. No, they are not explicit test answers, but they will help you focus your study.
• Specially called-out Notes are interesting tidbits of information that are relevant to the discussion and point out extra information. Just as with the sidebars, don’t discount them.
• Some chapters have step-by-step exercises designed to give you hands-on experience and reinforce the chapter information. As your system and circumstances are no doubt different from mine, these may, from time to time, need a little adjustment on your end.
Exam Objective Map: GSEC Exam
The following table lists the exam certification objectives and where each is covered in the book.
