(APT19)—where students must track the attacker's movement across a compromised network. The Index Connection
The exam is based on the six books, but SANS often references tools.sans.org or specific technique papers. If your instructor mentions a "Cheat Sheet" or "Poster" during the course, index it. for508 index
SANS allows students to bring "course materials" into the open-book exam. This includes the books, your handwritten notes, and—most importantly—. However, no digital devices are allowed. You cannot Ctrl+F a PDF. Therefore, your paper index must be a masterpiece of information architecture. SANS allows students to bring "course materials" into
You cannot build this index in one day. Start on Day 1 of your course. You cannot Ctrl+F a PDF
The labs are where the exam comes to life. While performing a lab on memory analysis with Volatility, index every plugin you use.