Exam/Study tips · ECA Cyber Range

Jan 3 • Random

Exam/Study tips

For studying, I use the 25/5 method (25 minutes studying, 5-minute break) because I have a limited attention span. If I try studying for long sessions, I’ll just burn myself out. Also, getting a good night's sleep the day before an exam > cramming the night before.

Most of the certs I have are CompTIA, and they are built on each other. I spent about 4 weeks on most of those. Some questions on later exams are similar to those on earlier ones. For example, I recall during the SecurityX exam that there were topics very similar to those on the CySA+ and PenTest+. I suspect Splunk will be similar, so every exam isn’t completely new information.

In terms of retaining the information, it’s hard when you don’t use it every day. I work in a deli now, so none of the information I am studying is used at my job. I participate in CTFs on various platforms, most recently https://blueteamlabs.online/, to keep my technical skills up to date. Also, I will boot up a Kali VM and practice pentesting against my own VMs. For Splunk, I have been importing my own data and just practicing using the interface.

Sometimes you just have to brute force memorize things, like the FTP is 21, SSH is 22, etc.

For exam tips, it's not just about knowing the information on the exam; taking an exam is a skill in itself. I have to force myself to slow down because I tend to misread questions. In a multiple-choice test, there is usually one obviously wrong question. So, throw that out, and now you have a 33% chance of getting it correct randomly. There will sometimes be two questions *very* similar. Like, which one is correct: “sourcetype=wineventlog” or “Sourcetype=WinEventLog”? If you don’t know the answer, narrowing down the options gives you a better chance of getting it right. Also, look for keywords in the question, but be careful that sometimes they will put irrelevant information in a question to confuse you.

I’m old(er) so I don’t exactly trust AI tools. However, I will use Gemini to create quizzes based on the exam objectives (comptia) or blueprint (splunk). I have noticed that there is a certain point where Gemini will just start repeating questions and not creating new ones. I have found there’s probably 30ish actual questions Gemini will create from the Splunk exam blueprint. I don’t know if it’s because the Splunk blueprint is more limited compared to CompTIAs exam objectives. Also, be careful when using AI tools as they will just make up information (hallucinate) when it doesn’t know the answer.

Do you have any additional study tips or thoughts?

2 comments