GNFA Certification Cost 2026: Complete Pricing Breakdown

The GNFA Fee Schedule at a Glance

Budgeting for the GIAC Network Forensic Analyst credential is simpler than most people expect, because GIAC publishes a short list of fixed fees. The confusion usually comes from the fact that the largest potential expense, SANS training, is not part of the exam fee at all. Before you commit money, it helps to separate what is mandatory from what is optional.

All figures above exclude applicable sales tax. For the authoritative current schedule, GIAC maintains a pricing and fees page, and the terms attached to your specific attempt govern if anything differs. If you want the broader picture of how this fits into the credential overall, see our GNFA certification overview.

What a $999 Attempt Actually Buys

The attempt fee gets you one proctored, web-based exam sitting window. The exam contains 66 questions with a 3-hour time limit, a minimum passing score of 70%, and a mix of multiple-choice questions and performance-based CyberLive tasks. The time limit covers the complete exam, CyberLive portion included, so you are not buying extra time for the hands-on tasks.

Delivery is through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility. Understanding the mechanics matters for cost because a few rules directly affect whether you burn a $999 attempt:

• 120-day completion window. Your attempt must be completed within 120 days of activation. Activate only when your preparation is nearly finished.
• Answers are final. Submitted answers cannot be changed, which rewards careful first-pass reading.
• Open book, with limits. Hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
• Built-in tools. The exam engine provides an on-screen calculator and scratch notepad, and 15 minutes of break time are allowed.

Training Tuition Versus Exam Fees

The single biggest budgeting decision is whether to take the SANS course that maps to this certification, FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response. GIAC does not require it. The certification has no formal prerequisites, and training is described as optional and recommended. That means two very different cost paths exist.

Path A: Course plus exam

This is the path most employer-funded candidates take. FOR572 covers six preparation sections and a hands-on lab component. Note that SANS materials are not perfectly consistent on lab count: the live course page lists 20 training labs while the linked brochure lists 18. Neither figure says anything about how many items appear on the exam, so treat lab counts as a description of the course, not the test. Tuition is billed by SANS, separately from GIAC. For current tuition, check the SANS course page directly, since pricing and delivery formats change.

Path B: Self-study plus exam

Because eligibility does not depend on training, a self-directed candidate pays only GIAC's exam fees plus whatever study resources they assemble. This path leans heavily on prior experience. Forensic techniques, networking knowledge, and Linux shell comfort all support preparation, though these are preparation advantages, not eligibility requirements. SANS also publishes a free introductory resource, the FOR572 Introductory Lab Workbook (Bonus Lab 1.0: tcpdump and Wireshark Hands-On), which covers packet capture and analysis. It assumes the FOR572-specific SIFT Workstation VM and warns that results may vary on other VMs. It is not the full paid course workbook and not an exam blueprint, but it is a no-cost way to test your packet-analysis footing before spending money elsewhere.

For a closer look at course options and what they cover, see our page on GNFA training.

Retake and Practice Exam Math

Two optional line items deserve careful thought: the official practice exam at USD $399 and the retake at USD $899.

The practice exam costs less than half of a first attempt and far less than a retake. If it prevents even one failed sitting, it has paid for itself. Used well, it also tells you which domains need work before you activate your real attempt and start the 120-day clock. That sequencing is the most important cost-control habit in this whole process: take readiness measurements first, then activate.

A retake saves you USD $100 versus the original fee, but that is a small consolation compared with the total of a second sitting. The cleanest way to think about it: a first failure adds USD $899 on top of your original USD $999, bringing the exam-fee subtotal to USD $1,898 before tax. Avoiding that outcome is worth real preparation effort. For context on how demanding the exam is, our GNFA difficulty guide and the GNFA passing score explainer lay out what the 70% threshold means in practice.

Four-Year Renewal Costs

The GNFA is valid for four years. Many candidates budget for the exam and forget the maintenance. To renew, you need either 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the standard USD $499 renewal fee.

The CPE route is usually the cheaper path in practice because forensic and incident-response professionals often accumulate credits through conferences, webcasts, and work-related training. The renewal exam route trades CPE logging effort for the risk and time of another test. Either way, the USD $499 fee applies.

Spread across the four-year validity window, the renewal fee is a modest recurring cost, but it should appear in any honest total-cost-of-ownership calculation. If you are comparing this credential against others for long-term value, pair this page with our ROI analysis of the GNFA.

Total Cost Scenarios

The table below combines only GIAC-published fees. SANS tuition is excluded because it varies by delivery format and is priced by SANS, not GIAC. Add your course cost on top if you choose Path A. All amounts exclude sales tax.

Notice how the practice exam shifts the math. Spending $399 up front looks like an extra, but compared with the $899 retake it is the cheaper insurance policy.

Protecting Your Investment Before Test Day

You cannot reduce the published fees, but you can reduce the chance of paying them twice. The one place generic planning is worth doing is sequencing your preparation around the GNFA's actual content. Here is a compact timeline that front-loads the domains most likely to cause a first-attempt failure for working analysts, namely those furthest from day-to-day SOC work.

Only after your practice results look comfortable should you activate your attempt. For a fuller plan, see our GNFA study guide, and when you want realistic question practice, try the GNFA practice tests to find weak domains before you spend $999.

Scheduling logistics also affect cost indirectly. Pearson VUE onsite and ProctorU remote delivery are both available subject to attempt-specific eligibility, so check which applies to you early. Our exam dates and scheduling guide covers deadlines, and the requirements page clarifies what is and is not mandatory.

Weighing Cost Against Career Value

A price tag only makes sense next to the opportunity it unlocks. The GNFA's scope, which spans network protocols, flow records, logs, proxy evidence, wireless analysis, and protocol reverse engineering, maps to roles in digital forensics, incident response, and threat hunting. Employers in those areas value demonstrable network-evidence skills, and the hands-on CyberLive tasks signal that the holder can do more than recall facts.

We deliberately avoid quoting salary numbers here because no verified figures are available to us for this credential. If earning potential is central to your decision, read our salary guide and browse GNFA jobs to see how roles describe the skills they want. Many candidates also get employer reimbursement for both exam fees and SANS tuition, which can change the effective cost to near zero, so ask your manager before paying out of pocket.

If you are still orienting yourself, start with what GNFA certification is, and check the pass rate discussion for what is and is not publicly known about outcomes.

Frequently Asked Questions