GNFA Certification

What the GNFA Credential Actually Certifies

GNFA stands for GIAC Network Forensic Analyst, a certification issued by GIAC Certifications and administered by GIAC, LLC. It validates that you can examine network evidence, including packet captures, flow records, proxy data, wireless traffic, and logs, and turn it into findings that support incident response and investigations. If you are new to the acronym itself, our explainers on what GNFA certification is and what GNFA stands for cover the basics before you go deeper here.

This distinction matters because the same four letters appear on other credentials in the industry. Everything on this page refers only to the GIAC credential, and its scope is defined by GIAC's published exam objectives rather than by any other body's materials.

The practical identity of the exam is simple: it tests whether you can reason about traffic. That means knowing what a protocol should look like when healthy, recognizing what it looks like when abused, and choosing the right evidence source to answer a question. A candidate who can read a packet but cannot interpret a NetFlow summary, or who understands proxy logs but fumbles wireless frames, will find the breadth of the exam uncomfortable.

Exam Format, Timing, and CyberLive

The GNFA is a single proctored, web-based exam. You get 66 questions and 3 hours for the entire sitting. The minimum passing score is 70%. The exam includes both multiple-choice questions and performance-based CyberLive tasks, and the 3-hour clock covers the complete exam, CyberLive included. There is no separate hands-on session with its own timer, so you must budget time across both question types yourself.

What CyberLive changes about your approach

CyberLive tasks are hands-on: instead of selecting an answer from a list, you perform or demonstrate a task in a live environment. For a network forensics exam, that favors people who have actually worked with capture and analysis tooling rather than those who only memorized definitions. GIAC's own write-up of a CyberLive demo describes multiple-choice items followed by CyberLive, so plan to arrive at the hands-on portion with enough clock left to work carefully.

Because submitted answers cannot be changed, speed-reading and second-guessing are both risks. Commit to an answer once you have verified it, and flag nothing you cannot revisit. For a deeper look at scoring mechanics, read our GNFA passing score breakdown.

The Eight Domains, Explained as Skills

GIAC publishes eight exam-objective headings for GNFA. The list does not include official percentage weights, so no single domain should be assumed to dominate. Prepare for all eight. Our complete guide to all 8 GNFA content areas goes deeper on each; the summaries below frame what each one demands in practice.

The scope across these headings also includes flow records, proxy evidence, logs, and wireless analysis together. The common thread is evidence literacy: every domain asks which artifact answers the question in front of you.

Fees, Registration Mechanics, and the 120-Day Window

GIAC prices are published and straightforward. A certification attempt costs $999, a retake costs $899, and the official practice exam costs $399. These prices exclude any applicable sales tax, and SANS training tuition is separate from all of them. For a full budget view, see our GNFA certification cost breakdown.

Once your attempt is activated, you have 120 days to complete it. That window is the real scheduling constraint: pick a test date that gives you enough runway to finish preparation, because the clock starts at activation rather than at the moment you feel ready. Testing is delivered through Pearson VUE onsite or ProctorU remotely, subject to eligibility for your specific attempt. Always confirm your assigned attempt's details on GIAC's attempts page, since the assigned attempt's objectives, format, and passing score take precedence over any summary, including this one. Our GNFA exam dates and scheduling guide walks through timing decisions in more detail.

Making the Open-Book Policy Work

GNFA is open book, but only in the traditional sense: hardcopy books, notes, and an index are allowed. Internet access and personal electronic references are prohibited, as are materials resembling practice or exam questions and answers. Read GIAC's candidate agreement and proctored exam reference guide before test day so nothing in your materials surprises the proctor.

The open-book rule does not make the exam easy. With 66 questions in 3 hours, you cannot look up every answer. The index is a speed tool, not a substitute for knowing the material.

• Index by concept, not by page order. You will search for a topic like a protocol behavior or a flow-analysis technique, not for a chapter number.
• Include tooling syntax. Since CyberLive involves hands-on work, an index entry pointing to command patterns and filter syntax can save minutes.
• Mark your weakest domains heavily. The index should be densest where your memory is thinnest.
• Build the index while studying, not the night before. The act of indexing is itself review.

For a compact companion to your index, our GNFA cheat sheet covers the must-know facts in one page, though remember that anything resembling actual exam questions is off limits in the exam room.

Training Path: FOR572 and Free Labs

The training associated with this certification is the SANS course FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response. It is organized into six sections. Course sections are preparation curriculum, not an official exam blueprint, so use the eight published GIAC domains as your actual coverage checklist and treat FOR572 as the vehicle for learning them.

One detail worth noting: the live FOR572 page lists 20 training labs while the linked brochure lists 18. Lab counts describe the course, not the exam, and they say nothing about how many exam items you will see. Check the current course page before you plan your lab time.

There is also a public starting point. The "SANS FOR572 Introductory Lab Workbook, Bonus Lab 1.0: tcpdump and Wireshark Hands-On" is freely available and covers packet capture and analysis. It assumes the FOR572-specific SIFT Workstation VM and warns that results may vary on other VMs, so use the intended environment if you want the exercises to match. It is an on-ramp, not the full paid workbook and not a GNFA blueprint.

Training is optional, but many candidates find the structured labs valuable precisely because CyberLive rewards hands-on fluency. More on the training side is in our GNFA training overview.

Sequencing Your Preparation by Domain

Because GIAC publishes no domain weights, the sensible approach is to build from foundations upward and reserve the final stretch for integration and index polishing. The order below follows dependency: protocols first, since nearly everything else assumes you can read traffic.

Adjust the length to your background. A practitioner who already analyzes packets daily may compress the early weeks, while someone newer to flow data or wireless should expand them. For a fuller plan, see our GNFA study guide, and for a realistic sense of workload read how hard the GNFA exam is.

Who Hires for Network Forensics Skills

Network forensics skills map to roles where someone must reconstruct what happened on a network after or during an incident. Typical homes for this skill set include incident response teams, security operations centers, threat hunting groups, digital forensics units, and consulting firms that support breach investigations. Government and defense-adjacent employers also value GIAC credentials, as do enterprises with mature detection programs.

Job postings in these areas commonly name the skills the eight domains cover: packet analysis, flow data, proxy and log investigation, and the ability to communicate findings. The certification signals that you have been tested on those skills under controlled conditions. We discuss the market in more detail in our GNFA jobs guide, and for pay expectations see the GNFA salary guide. If you are weighing the investment, our ROI analysis of the GNFA lays out the considerations. We do not quote salary figures here because they vary widely by region, employer, and experience.

Staying Certified: Four Years and 36 CPEs

A GNFA certification is valid for four years. To renew, you can earn 36 approved CPE credits during the active four-year period or pass a renewal exam, and in either case you pay the standard $499 renewal fee. CPE-based renewal rewards ongoing professional activity, which suits network forensics well since the field changes constantly, with new protocols, new evasion techniques, and new tooling.

Track your CPE activity as you go rather than scrambling near the deadline. GIAC's renewal how-to guide and CPE information pages describe what qualifies. Because the renewal fee is part of the long-term cost of holding the credential, factor it into your career budget alongside the initial $999 attempt.

Frequently Asked Questions

The GNFA rewards candidates who think like investigators: start from the question, choose the right evidence source, and read it accurately under time pressure. Pair structured preparation across all eight domains with hands-on practice and a well-built index, and the 66-question, 3-hour format becomes a manageable test of skills you have already been exercising.