Introduction 🔗

What are the Applied Knowledge Certifications? 🔗

The Short Version 🔗

The GIAC Applied Knowledge Certifications are 4-hour mega CyberLive exams (with no internet access) based on a specific course (SEC504, SEC560, etc) where every minute counts and where you won’t simply repeat a pre-prepared lab (as with the GIAC Practitioner Certifications CyberLive).
These certifications are really tough but also fun and incredibly rewarding!

The Long Version 🔗

This is a general presentation of GX certifications from GIAC. If you already know what GX certifications are, feel free to skip this section.

Since mid 2023, in addition to the classic Practitioner Certifications, there is a new type of certification: the Applied Knowledge Certifications.
According to GIAC, the Applied Knowledge Certifications truly test your mettle and set you apart from your peers. Designed to be challenging, these new certification exams require you to apply your technical expertise and hands-on experience to solve complex security scenarios. They are designed to provide a more comprehensive and rigorous assessment of knowledge and skills. GIAC Applied Knowledge Certifications take testing to the next level.

Again from GIAC, these certifications are:

  • 100% CyberLive, designed to push beyond individual technical skills. CyberLive questions require candidates to synthesize their skills and use them to solve real-world challenges in a virtual machine environment.
  • Intended to provide candidates with a more thorough understanding of a wide range of topics and subject matter.
  • Ideal for professionals who wish to challenge themselves and demonstrate their mastery of a subject.

There are currently 6 certifications, each with a primary fit course:

  • GX-CS - Cybersecurity Specialist : SEC401 (GSEC);
  • GX-IH - Incident Handler : SEC504 (GCIH);
  • GX-IA - Intrusion Analyst : SEC503 (GCIA);
  • GX-FA - Forensic Analyst : FOR508 (GCFA);
  • GX-PT - Penetration Tester : SEC560 (GPEN);
  • GX-FE - Forensics Examiner : FOR500 (GCFE).

The primary fit course has the most closely aligned content but does not include all of the content, tools, and platforms that could be included in testing on the Applied Knowledge exam. In addition to the primary fit course, other related courses are also listed for each certification. For example, for the GX-IA, the primary fit course is SEC503 and related courses are FOR572, SEC530, SEC450, SEC511, SEC573.

For each certification, you will find:

  • a short description with objectives & outcome statements;
  • the 5 available Demo Questions.

And, for each certification, you can buy a set of 3 Demo Questions at $39. These Demo Questions are taken at random from the 5 available Demo Questions. They are presented in the same environment as the real exam and you have 45 minutes to complete them. You can find these Demo Questions at the bottom of the page Applied Knowledge Exam Readiness.

The price for each certification is $499 if you hold the active related GIAC certification (GSEC for GX-CS, GPEN for GX-PT, etc), or $1,299 if you don’t.
You only pay for the certification exam itself, there is no additional support or training included.

These certifications are stackable with GIAC Practitioner Certifications, enabling candidates to build their portfolio to become a GIAC Security Professional (GSP) and a GIAC Security Expert (GSE).

stack

GSP = 3 Practitioner + 2 Applied Knowledge
GSE = 6 Practitioner + 4 Applied Knowledge

Since 2023, this has been the new way to achieve GSE. An interesting comparison from GIAC between pre-2020 and post-2023 is available here.

Why Am I Writing This? 🔗

I’ve seen a lot of questions about the GX-** and that’s understandable, because, although you can find information, it’s hard to get a concrete idea of what the exam is really like. I hesitated a lot before taking these exams for that reason, and I’m not sure I would have done it if I hadn’t benefited from the beta versions (GX-PT and GX-FA) and the introductory prices.
But finally, I went further than I ever planned and ended up passing all 6 GX certifications, even though my initial goal was just to pass 2 and earn the GSP! After completing 2 GIAC Applied Knowledge exams, I thought I’d take on 2 more, and then - why not, a crazy idea - aim for what I thought was unattainable: the GSE. And once I had 4, just for the challenge and fun, I thought I’d give the 6 a try.

I felt a bit lost when I started, but I really enjoyed preparing for these certifications and learned a lot. So I wanted to share some general tips, while respecting the GIAC’s Code of Ethics and the Exam Integrity Policy, to help others prepare for and pass these certifications. I hope this will be useful to some people.

My goal is not to share details about a specific GX exam, but rather to provide general advice on how to approach these certifications and succeed.

Anything I say can be wrong; it’s all subjective advice! It’s what has worked for me, but some of it might not apply to you.

Apart from this lengthy introduction, I’ve divided this text into 2 main parts: Preparation and Exam. Let’s get started!

Preparation 🔗

Best Order to Take the Exams 🔗

If there is a best order…
I found GX-CS, GX-IA and GX-IH easier than GX-PT, GX-FA and GX-FE. This should be adapted according to your goals (GSP, GSE, or the full Grand Slam), the Practitioner Certifications you already hold and your experience, but I think it’s best to start with GX-CS, GX-IH or GX-IA and if you hesitate between the three, I’d even recommend starting with GX-CS. For me, it was GX-CS, GX-IA, GX-IH, GX-FA, GX-PT and GX-FE. But before that, I was lucky enough to take part in the GX-PT and GX-FA betas so when I went for the GX-CS, I had some idea of what to expect.

I prepared for the GX-CS, GX-IA and GX-IH more or less at the same time and took them all in one month (the GX-CS on September 18th 2023, the GX-IA on October 2nd and the GX-IH on October 18th), it’s been a long and intense, but really fun, month! For me, it made sense to prepare for them partly at the same time because it seemed to me that some of the topics covered for one certification were also relevant to another (and I had signed up for all three at the same time when there was an introductory price, so I didn’t really have a choice).

For the next two, which became available a bit later, I gave myself a little more time to prepare them (one and a half months after the GX-IH for GX-FA, and two months after that for GX-PT). I guess it depends on the person, but for me it worked well to do them all in a fairly short period of time, so I stayed in that mindset for a few months.
The GX-FE was available much later, so I passed it in January 2025.

It’s hard to say how much time I spent on these exams. I started by taking the time to clarify the objectives, but once I really started preparing, I’d say it was pretty much all my free time outside of work (and a few extra days off) for the first three, and a good chunk of my free time for the next two. Of course, it depends on your experience, the related certifications you already hold, your way of working, etc. But it definitely takes time!

What to Prepare 🔗

Exam Certification Objectives & Outcome Statements 🔗

It seems obvious but the first step is to read every official peace of information about the certification. Especially the Exam Certification Objectives & Outcome Statements and example questions (Demo Questions). It doesn’t matter if the objectives are not clearly understood at the beginning but each objective must be understood afterwards. It is also very important to read the information about the primary fit course and try to link the different objectives to the different parts of the primary fit course. It’s not easy at the beginning but by the end of your preparation, the objectives (Exam Certification Objectives & Outcome Statements) and the linked parts of the primary fit course must be very clear for you.

For me, the GX-IA’s objectives were the blurriest at first, but the further I progressed in my preparation, the more understandable they became, and in the end, they were obvious and corresponded very well to what you needed to know.

Here are the GX-IA’s objectives I am talking about:

gxia

In my opinion, it’s not worth going beyond the scope of the objectives, you really need to stay focused on them. For example, if you did the SEC660, it’s a good thing, it will help you to pass the GX-PT, but there’s no point in working on buffer overflows, since that’s not one of the GX-PT’s objectives.

Tools to Know 🔗

The second step is very different depending on whether or not you have taken the primary fit course before. I passed 4 GX without the active related GIAC certification and 2 with it, both work!

Although it’s necessary to have a good understanding of the objectives, all my notes and preparation are really focused on the tools. For me, it’s not really a step in the preparation, but rather the general way in which the preparation is organized. That’s why it’s possible to pass these certifications without taking the primary fit course (more than for the Practitioner Certifications).

With the Course 🔗

You quickly read through the entire course to list all the tools used. After that, you should have 2 lists of tools: tools that are mentioned and hardly used, and tools that are intensively used. For the tools only mentioned, it’s interesting to list them and note the few essential commands, but I don’t think it’s necessary to do much more. For the second list: cheat sheets and labs/exercises!

Provided you have a good general understanding, there’s no need to dwell too much on theoretical notions, as this is a 100% practical certification.

Without the Course 🔗

Read the primary fit course description in detail and note all the tools mentioned (don’t forget the syllabus/pdf version). The cheat sheets and posters associated with courses are also an important source of information and it is possible to find tools mentioned in reviews too. For example, I think that the best sources of information for the GX-FE are the posters and cheat sheets from SANS. Without the course, you will not have 2 lists of tools, you probably have only the intensively used. So for each tool found: cheat sheets and labs/exercises!

Not really knowing if a tool is used or a topic is covered, you’ll end up having to prepare more documentation, just to be safe. While this is perfectly feasible, the preparation is less obvious and more time-consuming without the primary fit course, since you’ll never be sure whether this or that information is necessary, and you risk overdoing it.
It depends on the person, but I really enjoyed building up what I imagined to be the scope of the certification from almost nothing. So I don’t see it as a problem.

With or without the primary fit course, don’t forget to install and use the OS mentioned in the description of the certification. And take the time to list, test, and document the available tools.

Practitioner Certifications vs Applied Knowledge Certifications 🔗

In short, when you prepare a Practitioner Certification, for a tool, you need to know every parameter covered in the course, but when you prepare an Applied Knowledge Certification, for a tool, you need to know every parameter (not just the ones covered in the course) so you can use the tool effectively in all applicable situations.

That’s why Practitioner exam preparation is based entirely on the course material, whereas Applied Knowledge exam preparation uses the primary fit course as only a starting point for exploring the various topics outlined in the Exam Certification Objectives & Outcome Statements.

Cheat Sheets 🔗

For every tool, you need to write a cheat sheet.

I have 3 types of cheat sheet:

  • general (linux, windows, tcp, powershell, etc);
  • procedures (especially for gx-fa and gx-fe (browser-forensics-edge, email-forensics, etc));
  • tools.

For the 6 exams, I have just over 100 cheat sheets (plus some handwritten ones). Most of them are cheat sheets focused on tools. After the exams, these cheat sheets aren’t wasted; I use and update the digital version regularly.
It’s personal and maybe not the best option for you but I’ve written my cheat sheets with lines of 80 characters so that I could print them horizontally on 2 pages per sheet.
For example, the first lines of my linux cheat sheet are:

-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
- LINUX -----------------------------------------------------------------------
-------------------------------------------------------------------------------
grep -E "ssid|psk" /data/misc/wifi/wpa_supplicant.conf
grep -Inri passw /etc/* 2>/dev/null
-------------------------------------------------------------------------------
whoami | id
sudo -l -U bat                                      
usermod -aG sudo bat                                    
echo "bat ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
echo "bat sha=(root) NOPASSWD: /usr/sbin/bla" >> /etc/sudoers
-------------------------------------------------------------------------------
ss/netstat -nap |grep 'LISTEN '                          # all listen processes 
netstat -tunlp                 # tcp & udp listening ports with process name&id
netstat -antp                                       # all states tcp only ports
netstat -lntp                                        # tcp only listening ports
netstat -pelt|grep <user>   # extended infos (socket details) for tcp listening
ss -o state established '( dport = :22 or sport = :22 )'
fuser -k 445/tcp                               # kill process using port tcp445
lsof -i -P|grep <program>                           # network files/connections
lsof -p <pid>                      # show all files associated with the process
ps -ef --forest                      # show processes by tree (& detailed info)
ps -fu <user>                                          # show processes by user
ps -fC <processname>                                   # show processes by name
ps -fp 3150,7298                                 # show processes by process ID

Some cheat sheets are a few lines long (it’s particularly true for tools barely mentioned in the course, you just need the few most important commands, just in case), others are one or two pages long.
And, for some commands (basic shell commands like cut, awk, grep, sort, etc), I wrote a single cheat sheet entirely by hand.

The following picture shows my printed and annotated security windows event cheat sheet, for example.

cheat sheet

The time is really important for the exam so I’ve sorted the cheat sheets by categories (linux, windows, web, etc) and I didn’t take them all for all the exams. Some cheat sheets are exclusive to one or other certification, while others are common to some or all. It’s obvious but for example, I have a Windows CLI cheat sheet that I took for all certifications whereas the Zeek cheat sheet only makes sense for the GX-IA. The idea is to have all the information you need, while wasting as little time as possible looking for it.

And for example, to carry out a network scan, I know that this is an objective, I know the different types scan and the different tools used for this, so I’m not going to have a ‘network scan’ cheat sheet, but rather a cheat sheet for nmap, for masscan, for hping3 and so on. That said, sometimes it makes sense to create a more general cheat sheet covering a whole topic, for instance, regarding SMB, I’ve made cheat sheets on individual tools but also a more general SMB cheat sheet on a small page with the key commands, since it seemed an important subject to me.
It’s up to you, the idea is always to access the right information quickly during the exam.

For me, it’s not a good idea to take books or SANS courses, if you do this, you either know how to do everything without a note and take the courses with you just in case to check one thing or another (bravo!) or you haven’t prepared your notes well enough.

On my notes, without overloading, I wrote down everything that could save me time. Of course you can convert from hexadecimal to decimal, but if one tool gives you a result in hexa, another in decimal, it’s always a good idea to write down that 500 is 1F4. This can save you having to redo the calculation 3 times under stress to be sure of your answer and lose one or two minutes.

Exercises & Labs 🔗

You need to do exercises and labs for all the tools listed (not necessarily those barely mentioned in the primary fit course).

TryHackMe 🔗

I never used too much TryHackMe before but it was perfect for preparing the GX. I’ve done a number of labs, specific courses for each GX and I’ve often done quick exercises on a specific tool (like snort, zeek or velociraptor) to check my understanding and my cheat sheets and, if necessary, complete them. Honestly, I don’t think I would have succeeded without a subscription while preparing for the GX exams.

If you have the primary fit course, you can save time here by narrowing the scope. Without having access to the primary fit course, you need to go a little further than the list of tools (which is probably not complete) and test other tools related to the objectives.
For me, it’s a nice part of the preparation, so I didn’t mind going a little further just in case.

Primary Fit Course Labs 🔗

For GX-FA, I’ve redone a few exercises but it’s marginal. The first 3 GX I took were GX-CS, GX-IA and GX-IH and I didn’t take the primary fit course, so I prepared them without and followed much the same method for those I had taken the primary fit course.

But you need to install and use the OS or distributions mentioned in the description of each certification (such as Slingshot, Linux SIFT, etc).

CLI 🔗

You’ll need to be comfortable with the command line, both in Windows and Linux. In my opinion, it’s a prerequisite for preparing for these certifications, I think it’s going to be tricky to pass these certifications without that.

More generally, these are advanced certifications which require a certain amount of experience and knowledge to pass. I’m talking about cheat sheets and exercises for the various tools, but if you’ve never worked with them before and are discovering them for the first time during your preparation, it’s likely to be quite challenging.

Demo Questions 🔗

You don’t need to pay for the Demo Questions to read the questions, they can be viewed directly on the GIAC website. But if you take that set of questions, you will access the same environment as during the exam with all the information to really answer the questions (unlike with the questions on the website).

So you have to buy these Demo Questions, it’s an important step.
I think the best time to take them is 3-4 days before the exam. If it’s a disaster, you can still postpone the exam, and if not, you can improve your cheat sheets and your knowledge on specific points. You have more time than during the exam, and above all, it’s much shorter and less stressful but if you have at least 2 correct answers and have finished in 30-35 minutes, I think it’s a good sign. You don’t necessarily have to get easily the 3 answers in 30 minutes to consider yourself ready! Of course, if you don’t get any answers right, or if you only get one right and you’re struggling for 45 minutes, maybe it’s better to postpone (or the following 3 days can also be 3 very very intense days).

When you take the test, it’s a good idea to look at the general organization of the virtual machine. It can give you an idea about which tools you might be using and ensure that all the names mean something to you. If not, you’re missing a few cheat sheets…

I think it’s ideal to take these questions 3-4 days before the exam, but generally speaking, for the first GX, when you start preparing, it might be a good idea to take these Demo questions to see what to expect, and what type of questions are asked. Even if it means taking these Demo Questions twice.

Readiness Indicators 🔗

It’s not easy to know when you’re ready, and then it depends on each individual, personally, I rarely feel like I’m 100% ready.

But for what it’s worth :

  • If you think two objectives from Exam Certification Objectives & Outcome Statements are the same, that’s a bad sign.
    However, that doesn’t necessarily mean you’re ready if you’re well aware of the differences between the objectives and the tools linked to each of them.

  • If you don’t have specific tools for each objective and a specific cheat sheet for each tool, that’s a bad sign too.

  • If you have notes about attacks like DCSync or Kerberoasting because you don’t know when to use them, that’s also a bad sign.
    Documentation is about tools, you must know when to use each one. If a tool enables a specific attack, you need to understand when that attack is appropriate, and your notes should help you quickly find the options needed to run the tool. You should know exactly what DCSync and Kerberoasting are, that you can use Impacket to perform these attacks, and have an Impacket cheat sheet with all the required options.

  • When you take the Demo Questions, if you answer at least two questions correctly without spending half your time wondering what to do, it can be a good sign.

Exam 🔗

Mega CyberLive 🔗

It’s a 4-hour mega (giga?) CyberLive of 25 questions! When the exam starts, it takes a minute or two to launch the environment, and then it begins!

If you’ve already taken a Practitioner exam with CyberLive, the kind of question is very different (no questions similar to exercises from a course), but the general interface is the same.
You either type the answer directly or select one from a list (at least 8 choices in my memory). It’s not an exam that you can just answer at random.
You can skip 10 out of 25 questions, it’s more than enough.
And you can take one or two short breaks. Four hours of exercises is a long time.

I could be wrong, but in my recollection, for GX-FE (and maybe GX-FA), you have access to your working machine (the same one throughout the exam) with a whole bunch of data to work on, while for the others, you have to use different machines in different environments. For each environment, you’ll be asked at least 2 or 3 questions. In some cases, the tools you can use may be limited.

I’m not being creative when I say this, but the biggest difficulty is managing the time available. The second biggest difficulty is working solely with information on paper.

It’s important to realize that the goal is not to answer 100% of the questions calmly throughout the day, but the goal is to answer as many questions as possible in 4 hours in order to pass the exam. This implies quite a few things in the way you take the exam.

At the end, you will not get a score, you’ll know whether you’ve succeeded or not (yes, the beautifull sentence in grey on grey), and a summary with 0 to 5 stars for each Exam Certification Objective.

Take it Remotely 🔗

If it’s a possibility for you with the GIAC Candidate Agreement, take it remotely.
Knowing the space available in the test centers, I took the exams remotely and I don’t see how I could do otherwise. As you can see, I need space!

desk

I said I categorized cheat sheets, it was a bit different from one GX to another, but the general idea is to have one color per category (it’s not really necessary, but it’s nicer). Red is for offensive, green for OS, blue for network, etc. Each group of cheat sheets in a colored plastic sleeve and the summary on the first page.

I had connection problems and VM crashes on the GX-PT beta, it was awful. During the GX-FA, I had a connection issue at the very end, normally I should have recovered the lost time but as it was longer than the remaining time, it closed the exam and I couldn’t answer the last 2-3 questions left out but it passed, and my dismay was immediately replaced by joy.
Apart from that, I haven’t encountered any significant connection problems.

Time per Question 🔗

I’ve read many times that we have about 9.5 minutes per question (~240/25). I think that’s a bit exaggerated. You have to be a little pragmatic, there’s no question of targeting 100%. We don’t know what the minimum score is, but most GIAC Practitioner Certifications have a passing score of around 70%… Perhaps the threshold for Applied Knowledge Certifications is lower (or higher), but taking 70% of 25, it’s 17.5. Adding a small safety margin, we’re talking about passing 18-19 out of 25 questions. So it’s 12.5 minutes per question (~240/19)! For me, in practice, it’s more like 11.5 minutes per question than 9.5. I think it makes a huge difference!

This also means that there may be 2-3 questions (at least) that you have no idea how to answer. That’s all right, just don’t waste time on those, and spend it on the others.

Read Every Question 🔗

Be sure to read every question. You can skip 10 questions on 25, that’s a lot. It’s not too bad if you don’t have time to answer all the questions, but you must at least read them all. Maybe the last two questions will be very easy for you.

Avoid Guessing 🔗

If you don’t know the answer, skip the question. Don’t just answer anything. If you have properly prepared for the exam, you should be comfortable enough to pass 10 out of 25 questions.
Some questions are linked so if you skip one you will maybe get a hint or something in a following question. Or maybe you’ll simply be in a better condition to answer an hour later.

It’s a detail but if you’re pressed for time (you will be), you can run a time-consuming command, skip the question and retrieve the result of your command when you return to the question.

Not All Questions Are Equal 🔗

Some questions can be completed in 2 minutes, others in 20. I may exaggerate but you can really sometimes answer a question very quickly in one or two steps, and sometimes take five or six or more steps before you reach the answer.

I might be saying something a bit different from some others here, but I don’t believe the rule “if you haven’t found the answer in 10 minutes, move on to the next question” is a good one.

For me, you need to know in 2-3 minutes if you think you have a good chance of answering the question, if yes, you take the time to answer it (maybe 6 minutes, maybe 14 minutes), if not, you skip it and try again at the end depending on the time available.
Sometimes it’s also pleasant and rewarding to spend a little more time on a question.

That said, depending on the time available, it may be more efficient to skip a question you think you can answer, but which would take you a long time to answer, in order to answer two (or three?) other questions. I remember a multi-stage question, I started and then I realized that I wasn’t sure I’d find the solution and that in any case, it was going to take me at least 10-15 minutes. Given the time remaining, I preferred to skip the question and come back to it if I had enough time.

And if you’re short in time and reading a question, you detect a series of steps and immediately one or other seems totally unfamiliar to you, again, it might be better to skip the question altogether. A few times I’ve spent almost 10 minutes on a question, only to get stuck at the (supposedly) last step, and then it’s hard not to get bogged down and waste even more time… Again, you come back to it if you have enough time.

I might be wrong, but I don’t think there’s any weight to the questions.

General Time Management 🔗

It’s only the tenth time I’ve said it but GX is all about time management! During the exam, it’s important to situate yourself in time and accelerate if necessary. It’s up to you, but I used to try to do ~8 questions an hour. In other words, all 25 questions in ~3 hours, so that I’d have a whole hour for the questions I’d passed (knowing that I usually passed 7 or 8 questions at each exam).
The rules changed between the first GX I passed and the last one, and it’s now possible to take a break with questions left unanswered. Frankly, it makes a big difference and means you’re not bouncing around like a madman with no way of concentrating for the last hour because you can’t get to the toilet. So, I think the best time to take that break is about 3 hours (this should more or less correspond to the time to start answering skipped questions). Remotely, on your break time, you need to keep a bit of a margin, because the time needed to quickly double-check the room is taken from the break time.

Finally, to sum it up, the best-case scenario:
In one hour, you answer 5 questions and skip 3: 5 minutes to skip the 3 questions and 55 minutes to answer the other 5 questions. That gives 11 minutes for each question (and without exaggerating, some questions can be answered in 3-4 minutes).
So after 3 hours, you’ll read the last question, you’ve answered 15 questions and you passed 9. You take 10 minutes for that last question and you have 16 answered questions!
If that’s where you are, that’s cool! Normally you only answer when you’re sure of your response, so you need 3 more correct answers in 50 minutes to reach the 19 correct answers.
Take a break and then start the skipped questions. Choose wisely the questions you want to spend time on to ensure 3-4 right answers out of 9 (only now you can answer anything to others).
And that’s all, you did it! Congratulations, you are officially GX-** certified!

More Information 🔗

From SANS & GIAC 🔗

General 🔗

Specific 🔗

From others 🔗

If you detect an error, if you have something to add or comment, you can contact me. If that page helps you to pass any GX certification, I’d be glad to know it too!