Skip to main content

GCIH & GWAPT Review - Talk or Walk?

I currently have 7 certifications combined from both organizations. I have received certifications from in class boot-camps from both as well as on-demand. The following information is my opinion alone.

So, the GCIH and GWAPT,

Better than CeH & Net Defender? More relevant than Sec+ & Net+? My opinion is BOTH.

First things that stood out to me:

  • CeH & Practical exam had a SHOCKING amount of grammar errors, syntax, and all around cohesiveness that really demonstrated they don't have a capable or in-tune US market team. 
    • This is a well establish issue with CeH, and CompTIA has acknowledged this and taken advantage of it by adding Pen+ and highlighting US based customer service.
  • GCIH & GWAPT -- I get it, it is pricey, and I get it now. The labs they "ship" with, albeit just custom VULNHUB VMs (now owned by OFFSEC, so we will see how that pans out...), they make it "easy" to learn the basics.
    • Point of interest: I am currently in GPEN, and the dynamic Wiki and lab update syntax might be a game changer...unless they license the VMs and previous students can no longer access the labs AFTER the class time expires.
    • As of this article, Fall 2020, this is a new feature and they instructors are all but saying this will change who takes control of the infosec certification market.
    • Yes, Index, …you will likely struggle the "stump the dummy" without it.
I was not intimidated by GCIH & GWAPT at first...open book... four hour exam...OK, I got this. Although I did in the end, I was surprised how much they do challenge you to apply the learning concepts at the end with hands-on VMs. Now here is the curve, the VMs are a teeny-tiny VM with a truly barebones functionality that screams, PLACE COMMANDS HERE. OSCP and CeH labs let you improvise, GCIH commands you know the...exact command?

GWAPT:
I was also not impressed with the (in my opinion) "stump the dummy" questions. In one particular question was the specific syntax of a certain XSS testing tool. I am not sure if I got it correct or not, but I went back to find it in the lesson to confirm I was "taught" it. I was happy to confirm it was briefly passed over as one of three tools over a period 23 seconds. The answer was in the course material, not the lesson. Yet I was to know it's specific syntax of one of those tools. This is why they allow open-book, it appears to be a catch all between the hundreds of instructor pre-recorded videos.  

I will not blame the specific instructor for this, as they likely do not make the questions for the exam, but my instructor even said in the first lesson that, "the book is for the exam only, do not read it to follow along, use it for the exam only". This led me to miss multiple issues on the practice exams as I took their word for it.

Recommendation (from a hiring official and instructor):

BLUF: SANS> CompTIA for advancement. CompTIA>SANS to enter the field. Neither will be seen as a "walk the walk".

Sec+ (+) CeH + Specialty Cert (CCNA, Reverse Engineering, etc.)  = solid start!

CompTIA will ensure you meet DoD 8570.01 requirements and enough to "talk the talk". SANS will help you "crawl the walk".

Yes, SANS is enough to start walking. You WILL LEARN A LOT. However, many organizations had leaned to CompTIA for introductory level knowledge because they do not "stump the dummy" or have inconsistent instructorship. I am also an Adjunct Professor at two major online universities (I say this because the sheer number of certification attempts are adult learners), and they BOTH do not align to SANS because SANS is "too advanced" for the beginner and does not directly align with NIST standards and focus on too many different concepts.

Hope this helps you decide!

Comments