- The Exam at a Glance: Numbers to Memorize
- Registration, Fees, and Attempt Mechanics
- Domain-by-Domain Cheat Sheet
- Open-Book Rules and Index Strategy
- CyberLive Tasks: What to Expect
- Tools and Artifacts to Recognize on Sight
- Sequencing Your Preparation by Domain
- Renewal and Where the Credential Fits
- Frequently Asked Questions
- The GNFA exam is one proctored session: 66 questions, 3 hours, 70% minimum to pass, with CyberLive tasks inside that clock.
- The exam is open book with hardcopy materials only; internet access and personal electronic references are prohibited.
- Submitted answers cannot be changed, so flag and review before you submit rather than after.
- Eight published domains span protocols, encryption, NetFlow, architecture, reverse engineering, proxies, logging, and wireless.
The Exam at a Glance: Numbers to Memorize
This page condenses what a GIAC Network Forensic Analyst (GNFA) candidate needs on one screen. The GNFA is issued by GIAC Certifications and validates hands-on ability to examine network evidence: packet captures, flow records, logs, proxy data, and wireless traffic. It is not a theory-only credential. The format reflects that, mixing multiple-choice questions with performance-based CyberLive tasks.
| Item | GNFA Fact |
|---|---|
| Issuer | GIAC Certifications (administered by GIAC, LLC) |
| Total questions | 66, including multiple-choice and CyberLive tasks |
| Time limit | 3 hours, covering the complete exam including CyberLive |
| Minimum passing score | 70% |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt-specific eligibility |
| Reference rules | Open book: hardcopy books, notes, and an index only |
| Break time | 15 minutes allowed |
| Answer changes | Not permitted after submission |
| Attempt window | 120 days from activation |
| Validity | Four years |
| Prerequisites | None formal; training optional but recommended |
The exam engine provides an on-screen calculator and a scratch notepad. That detail is useful for subnet math, byte-offset arithmetic, and converting between hex and decimal. You do not need to bring a calculator, and you should not plan around a physical one.
One caution on sources: the objectives, format, and passing score shown for your assigned attempt at the GIAC attempts page take precedence over any third-party summary, including this one. Check it when you activate your attempt.
Registration, Fees, and Attempt Mechanics
GIAC prices are published separately from SANS training tuition. Training is optional, so you can sit the exam without it, but candidates who skip training should plan a deliberate substitute. Our GNFA requirements guide covers eligibility in more depth.
| Cost Item | Amount (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee (every four years) | $499 |
All prices exclude applicable sales tax, and SANS course tuition is billed separately. For a fuller breakdown of what a realistic total looks like, read the GNFA certification cost guide.
The 120-Day Clock
Once your attempt is activated, you have 120 days to complete it. Treat activation as the start of your final preparation phase, not the start of studying. Candidates who activate early "to lock in a price" and then drift often burn their window. Scheduling specifics, including testing windows and deadlines, are covered in the GNFA exam dates guide.
Onsite or Remote
You can test with Pearson VUE at a testing center or with ProctorU remotely, depending on what your attempt allows. Either way, the same rules apply: hardcopy references only, no internet, no personal electronic references, and no materials resembling practice or exam questions and answers. Read the GIAC candidate agreement before test day, because a rule violation can cost you far more than a missed question.
Domain-by-Domain Cheat Sheet
GIAC publishes eight objective headings for the GNFA. They are listed here in the published order. GIAC does not publish percentage weights for them, so do not trust any source that claims exact weighting; plan for balanced coverage. A deeper treatment lives in the GNFA exam domains guide.
Domain 1: Common Network Protocols
The foundation for everything else. You must read protocol behavior directly from captures and spot deviations.
- Know normal handshake, session, and teardown behavior for core transport protocols
- Recognize how DNS, HTTP, and other application protocols look when legitimate versus abused
- Be able to apply display and capture filters quickly from memory or your index
Domain 2: Encryption and Encoding
Analysts constantly meet data that is encoded rather than truly encrypted, and the difference matters.
- Distinguish encoding (reversible, no key) from encryption (key-dependent)
- Understand how TLS sessions appear in captures and what remains visible without decryption
- Be ready to decode common encodings found in payloads and command-and-control traffic
Domain 3: NetFlow Analysis and Attack Visualization
When full packet capture is not available, flow records are the evidence. This domain rewards analysts who can reason from metadata.
- Interpret flow fields such as endpoints, ports, protocols, volumes, and timing
- Identify scanning, beaconing, and data exfiltration patterns from flow summaries
- Use visualization to expose relationships that raw records hide
Domain 4: Network Architecture
Evidence only exists where something was positioned to collect it.
- Understand where sensors, taps, and collection points sit and what each can see
- Know how segmentation, NAT, and device placement change what an investigator observes
- Reason about evidence gaps created by architecture choices
Domain 5: Network Protocol Reverse Engineering
The most distinctive domain of the exam: working out how an unknown or custom protocol behaves.
- Infer message structure, fields, and state from captured traffic
- Identify delimiters, length fields, and encoding patterns in unfamiliar protocols
- Practice byte-level reading until hex dumps feel natural
Domain 6: Open Source Network Security Proxies
Proxy evidence records web activity in a form that is often easier to hunt than raw packets.
- Read proxy logs for suspicious destinations, user agents, and request patterns
- Understand what a proxy sees and what it cannot see
- Correlate proxy data with other network evidence sources
Domain 7: Security Event and Incident Logging
Logs tie network activity to hosts, users, and time.
- Normalize and correlate events across multiple log sources
- Know why accurate timestamps and time synchronization decide whether a timeline holds up
- Use logs to scope an incident and confirm or refute network findings
Domain 8: Wireless Network Analysis
Wireless evidence behaves differently from wired captures, and candidates who ignore this domain give away easy points.
- Understand wireless frame types and how association and authentication appear in captures
- Recognize signs of rogue access points and wireless attacks
- Know the evidence limits of capturing over the air
Open-Book Rules and Index Strategy
The GNFA is open book, but only in the physical sense. Hardcopy books, your own notes, and an index are allowed. Internet access and personal electronic references are not. Materials that resemble practice or exam questions and answers are also prohibited, so do not stuff your binder with leaked or recreated items.
What Belongs in Your Index
- Capture and display filter syntax you do not use daily
- Protocol field offsets and flag values you would otherwise have to derive
- Flow record field definitions and common query patterns
- Log field meanings for the sources your course material covers
- Wireless frame and management-type references
- Encoding and decoding quick references
Because submitted answers cannot be changed, use your allowed 15 minutes of break time intentionally and flag uncertain items for review before final submission. Once you submit an answer, it is locked.
CyberLive Tasks: What to Expect
The GNFA includes CyberLive performance-based tasks alongside multiple-choice questions. GIAC's own detailed description of its practitioner exams describes multiple-choice items followed by CyberLive. These tasks place you in a live environment and ask you to do the analysis rather than recognize the right answer from a list.
- You are working inside the 3-hour limit, not on separate time.
- Hands-on fluency with packet analysis tools matters more than memorized definitions.
- Tasks reward efficient filtering, careful reading of evidence, and accurate extraction of details.
Key Takeaway
Practice the tools, not just the concepts. If you have only read about filtering captures, you will be slow when a CyberLive task asks you to do it. Drill live analysis until you can answer a question from a capture in minutes. For a sense of how this affects difficulty, see how hard the GNFA exam is.
Tools and Artifacts to Recognize on Sight
The certification scope covers network protocols, flow records, logs, proxy evidence, wireless analysis, and protocol reverse engineering. The preparation course, SANS FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response, is built around these evidence types. Public introductory material includes the FOR572 bonus lab on tcpdump and Wireshark, which covers packet capture and analysis. That lab assumes the FOR572-specific SIFT Workstation VM and warns that results may vary on other VMs, so do not expect identical behavior on a different setup. It is also not the full paid workbook and not an exam blueprint.
| Evidence Type | What It Tells You | Main Limitation |
|---|---|---|
| Full packet capture | Complete payload and protocol detail | Volume and storage; encryption hides content |
| Flow records (NetFlow) | Who talked to whom, when, and how much | No payload content |
| Proxy logs | Web requests, destinations, user agents | Only traffic that passed through the proxy |
| Event and incident logs | Host and user context tied to time | Depends on logging coverage and clock accuracy |
| Wireless captures | Association, authentication, rogue devices | Limited to what the capture position could hear |
Course materials note that forensic technique, networking, and Linux shell experience support preparation. These are study advantages, not GIAC eligibility requirements. If your command-line comfort is weak, fix that early, since much network forensics work happens in a shell.
Sequencing Your Preparation by Domain
This is the one place for generic planning, and it is tied to the GNFA domains. FOR572 itself has six preparation sections, which are unweighted curriculum rather than an exam-domain map, so build your plan around the eight published objectives. Our full GNFA study guide expands on this.
Foundations: Domains 1, 2, and 4
- Protocols first, because every other domain assumes you can read them
- Encoding and encryption next, so payloads stop being opaque
- Architecture alongside, to understand where evidence comes from
Evidence Sources: Domains 3, 6, and 7
- Flow analysis for metadata-driven investigation
- Proxy evidence for web activity
- Logging and timeline correlation to tie sources together
Specialist Skills: Domains 5 and 8
- Protocol reverse engineering is the hardest to cram, so give it dedicated hands-on time
- Wireless analysis last, as a contained topic with its own evidence quirks
Integration and Index
- Finalize and time-test your index
- Run full timed practice, including hands-on analysis
- Use an official practice exam if budget allows, and compare against the practice test on our main site
Phase 3 deserves emphasis: reverse engineering unfamiliar protocols cannot be memorized, only practiced. Pair that with timed drills at GNFA Exam Prep to build speed under the three-hour limit.
Renewal and Where the Credential Fits
The certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year period or pass a renewal exam, and you pay the standard USD $499 renewal fee in either case. Plan CPE collection across the cycle rather than at the end.
On the career side, the GNFA targets people whose daily work is investigating network evidence: incident responders, threat hunters, SOC analysts moving into deeper investigations, and digital forensics practitioners who need network-side skill. For the roles and employers that look for it, see the GNFA jobs overview. Compensation discussion belongs in the GNFA salary guide, and the cost-benefit question is addressed in whether the GNFA is worth it. If you need a plain-language starting point, what GNFA is covers the basics, and the data side is in the GNFA pass rate article.
Frequently Asked Questions
The exam has 66 questions in a single proctored session with a 3-hour time limit. The time covers everything, including the CyberLive hands-on tasks. You may take 15 minutes of break time.
The minimum passing score is 70%. The 70% standard applies to exam versions released on or after December 24, 2016, and the details for your assigned attempt on the GIAC attempts page take precedence.
Yes, the exam is open book, but only hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
No. There are no formal certification prerequisites, and training is optional but recommended. FOR572 is the associated preparation course, and its tuition is separate from the USD $999 certification attempt fee.
A retake costs USD $899. Once earned, the certification is valid for four years and can be renewed with 36 approved CPE credits or a renewal exam, plus the USD $499 renewal fee.