Would you trust a commercial pilot to land your plane if they'd never actually flown one? A surgeon to remove a loved one's tumor if they'd never held a scalpel? An electrician to wire a nursery if they'd never picked up a wire stripper? That's the challenge GIAC's Tommy Adams, Brian O’Hara, and Jonathan Baeckel (JB) put to the room at the start of our recent “GIAC Insider” webcast, and it's the whole reason CyberLive exists. Knowing what to do isn't the same as being able to do it, and GIAC certifications need to prove both.
Instead of another slide deck about CyberLive, the team led the conversation hands-on with the mouse. They spent most of the hour driving the real exam engine live—opening virtual machines, running actual tools, even typing a live PowerShell command fast enough to draw a “YOLO, you know” from the room. Read on to learn what they demonstrated, and what it means for you if a CyberLive component is part of your next certification.
First: Does Your Exam Have CyberLive?
Not every GIAC exam does, so start here. You've got three easy ways to check:
- Head to the CyberLive page on giac.org and filter by certification — qualifying exams wear a distinct banner.
- Open the page for your specific exam. If CyberLive applies, you'll see an icon and a link to testing details.
- Run the new CyberLive System Check the moment an exam lands on your account. This is a dry run of the exam environment, purely to confirm that your machine and connection can handle it, and it actively flags problems (like bad Wi-Fi) before they cost you time on exam day. You get a limited number of these runs, so don't burn them all before test day.
One more thing worth prominently noting for yourself: use a Chromium-based browser. Brian demoed what happens if you don't: Firefox threw a hard warning requiring acknowledgment before letting him proceed. Don't find that out mid-exam.
A Quick Tour of the Exam Engine
Before touching any of the questions, Brian pointed out the tools built into the interface itself: a countdown timer with a visual gauge, a scratch notepad (nothing typed there is saved or sent anywhere), a draggable calculator, a light/dark mode toggle, and a one-click refresh if the question screen ever stalls.
The ability to skip questions also got a special callout: If you skip a multiple-choice item, you can roll straight into CyberLive content without answering it first. But once you decide to go back and tackle skipped questions, you're locked in until you finish them. And yes, CyberLive content shows up at the end of the exam (outside the newer Applied Knowledge format), after every multiple-choice question is behind you.
Refresh versus Reset: Know the Difference Before You Need It
Refresh Environment just reconnects you to your existing session—your open Wireshark window, your half-typed PowerShell command—all of it survives untouched. On the other hand, Reset Environment tears the whole VM down and rebuilds it from zero, wiping out any parsed artifacts along the way, and the clock keeps ticking while it reboots. Panic-clicking Reset because your connection feels laggy is not the right move. Remember the distinction, and try Refresh first.
Three Live Questions, Three Real Lessons
The heart of the demo was three sample items, each built on real course lab environments:
- Inside an exact replica of the FOR610 Windows REMnux box, the task was to find the last five characters of a malware sample's SHA-256 hash. Brian's fastest path was to drag the file into PE Studio. The slower but equally valid path is to type Get-FileHash straight into PowerShell. Both scored full marks—CyberLive doesn't grade your method, only your answer.
- Tasked to find a host listening on port 110, the default Zenmap “quick scan” burned nearly 28 seconds resolving hostnames nobody asked for. Add -n to skip name resolution and target the port directly, and the same scan finishes in about a second. The same answer, but with 27 seconds saved.
- The trickiest of the three: Identify which file in a downloads folder hid an NTFS alternate data stream—invisible in the GUI, and only visible via dir /r or PowerShell's Get-Item -Stream *. The puzzle was in reading comprehension, because the question asked for the file, not the stream's name. It can be easy to mistake those two under time pressure.
The through-line across all three: CyberLive isn't trying to trick you. It's testing whether you can execute exactly what your course taught, hands-on with the same tools, in an equivalent environment, and under real conditions.
How to Actually Get Ready
JB's prep philosophy came down to this principle: Know how to do it, not just how to talk about it. In practice, that means:
- Ditch the copy-paste crutch. If you can only finish a lab by pasting commands straight from the workbook, exam day is going to hurt.
- Get hands-on with the actual tools your course labs use. Whatever tool the lab teaches, expect it to show up on the exam.
- Push past the lab's exact instructions. If a lab has you run strings with one flag, try three others. That extra rep is what makes a tool feel familiar.
- Break big labs into small, digestible pieces—JB's words were “burger chunks, not a big Mac”—so you can recognize which chunk an exam question is really testing.
- Take every practice exam you're given. They won't repeat exact content, but they'll match the real difficulty and give you low-stakes practice navigating the CyberLive interface.
Have a question we didn't get to? GIAC reads and responds to exam feedback regularly, and questions like the ones from this session help shape future FAQs and blog posts—reach out at info@giac.org.