- The Number: 70% and What It Means
- How the 66 Questions and 3 Hours Are Structured
- Why There Are No Published Domain Weights
- Where Points Come From: The 8 Domains
- CyberLive Tasks and the Scoring Question
- Open-Book Rules That Protect Your Score
- Fees, Retakes, and the 120-Day Window
- Sequencing Your Prep Around the Pass Line
- After You Pass: Validity and Renewal
- Frequently Asked Questions
- The GIAC Network Forensic Analyst (GNFA) minimum passing score is 70%, applied to exam versions released on or after December 24, 2016.
- The exam has 66 questions and a 3-hour limit that covers everything, including CyberLive tasks.
- GIAC publishes eight objective headings for GNFA but no official percentage weights, so balanced preparation beats guessing.
- Submitted answers cannot be changed, so commit only after verifying against your index and notes.
The Number: 70% and What It Means
The GIAC Network Forensic Analyst (GNFA) exam has a minimum passing score of 70%. That is the headline answer, and it is the figure GIAC publishes for exam versions released on or after December 24, 2016. If you are preparing in 2026, that standard applies to you.
A 70% threshold sounds forgiving until you consider the format. With 66 total questions, you cannot treat any single domain as optional, and you cannot assume that strong command of packet analysis will carry you through weak spots in wireless analysis or protocol reverse engineering. The pass line is a cumulative score, so every question matters, but the exam does not reward perfection either. Your goal is to be reliably competent across all eight areas rather than brilliant in two.
If you are still deciding whether to pursue the credential, our guides on how hard the GNFA exam is and what the pass-rate data shows put the 70% line in context. For a quick refresher on the fundamentals of the credential itself, see What Is GNFA Certification?
How the 66 Questions and 3 Hours Are Structured
The GNFA is a single proctored, web-based exam. Here is the format at a glance:
| Element | Detail |
|---|---|
| Total questions | 66 |
| Time limit | 3 hours, covering the complete exam including CyberLive |
| Question types | Multiple-choice plus performance-based CyberLive tasks |
| Minimum passing score | 70% |
| Breaks | 15 minutes of break time allowed |
| Tools in the exam engine | On-screen calculator and scratch notepad |
| Answer changes | Submitted answers cannot be changed |
| Delivery | Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
Two details deserve emphasis. First, the 3-hour clock is a single pool. CyberLive tasks are not timed separately; they draw from the same three hours as the multiple-choice items. Second, because submitted answers are final, there is no "flag and return" safety net after you commit. Your pacing plan has to account for that.
A simple budgeting approach: 3 hours divided across 66 items works out to under three minutes per question on average. Multiple-choice items that you can resolve quickly with your index should bank time for the hands-on tasks, which tend to demand more.
Why There Are No Published Domain Weights
Many candidates search for a percentage breakdown, such as "X% of the exam is wireless." For GNFA, that breakdown does not exist in the public record. GIAC's exam-objective list shows eight headings in a published order, but it does not attach official percentage weights to them. Any site that quotes precise per-domain percentages for GNFA is either guessing or borrowing from a different credential.
The practical consequence is straightforward: you cannot safely deprioritize a domain. Instead of chasing a weight table, allocate time by your own weakness and by how hands-on each topic is, since performance-based tasks reward applied skill over recognition. Our complete guide to all 8 GNFA content areas walks through each heading in more depth.
Where Points Come From: The 8 Domains
GIAC lists these eight objective headings, in this order. Since the 70% line is cumulative, here is what a candidate should be able to do in each.
Domain 1: Common Network Protocols
The foundation for everything else. You need to read protocol behavior at the packet level and recognize what normal looks like so anomalies stand out.
- Dissecting captures with tcpdump and Wireshark-style analysis
- Recognizing legitimate versus abnormal protocol use
- Knowing which fields matter when reconstructing events
Domain 2: Encryption and Encoding
Attackers hide in encoded and encrypted traffic. Expect to distinguish encoding from encryption and to reason about what an analyst can still learn when payloads are obscured.
- Identifying common encodings in captured data
- Understanding what metadata remains visible in encrypted sessions
Domain 3: NetFlow Analysis and Attack Visualization
Flow records let you investigate at scale when full packet capture is unavailable. This domain tests whether you can pull a story out of summarized traffic.
- Interpreting flow records to spot scanning, beaconing, and exfiltration patterns
- Using visualization to make large datasets legible
Domain 4: Network Architecture
Where evidence lives depends on how the network is built. Knowing architecture tells you where to collect and what each vantage point can and cannot see.
- Evidence sources across segments, gateways, and monitoring points
- Visibility gaps and how they affect an investigation
Domain 5: Network Protocol Reverse Engineering
When you meet an unfamiliar or custom protocol, you must infer structure from captured samples. This is among the more demanding applied skills in the objectives.
- Deriving message structure from raw traffic
- Recognizing command-and-control communication patterns
Domain 6: Open Source Network Security Proxies
Proxy evidence is a rich source for web-based activity. The objective is to use and interpret it as forensic material.
- Reading proxy logs to reconstruct user and malware activity
- Understanding how proxies change what the investigator observes
Domain 7: Security Event and Incident Logging
Logs corroborate what packets and flows suggest. You should be able to correlate across sources to build a defensible timeline.
- Correlating events across log and network sources
- Knowing what each log type can and cannot prove
Domain 8: Wireless Network Analysis
Wireless investigation has its own frames, handshakes, and evidence conventions that differ from wired capture.
- Interpreting wireless captures and related protocol behavior
- Understanding what wireless evidence reveals about devices and associations
CyberLive Tasks and the Scoring Question
The GNFA includes performance-based CyberLive tasks alongside multiple-choice questions. According to GIAC's detailed practitioner-exam explanation, the exam presents multiple-choice items followed by CyberLive. CyberLive puts you in a live environment where you perform work rather than select an answer.
What GIAC does not publish is a per-item scoring formula, the exact split between multiple-choice and CyberLive within the 66 questions, or how CyberLive items are weighted relative to others. Treat any claim about exact point values as unverified. What you can rely on is the structural fact: the 70% standard is the bar, the 66-question count includes both item types, and the shared 3-hour clock applies throughout.
Key Takeaway
Because CyberLive draws from the same three hours, practice hands-on tasks under time pressure. Candidates who only read about tools tend to lose time on the performance-based items, which can squeeze the multiple-choice section that follows.
Open-Book Rules That Protect Your Score
The GNFA is open book, but the rules are specific. Allowed: hardcopy books, notes, and an index. Prohibited: internet access, personal electronic references, and materials resembling practice or exam questions and answers.
That last prohibition catches people off guard. Do not bring anything that resembles actual exam content, and be careful that your own notes do not read like transcribed practice questions. Violations can jeopardize your result, and the details are laid out in the GIAC Candidate Agreement and the proctored exam reference guide.
Your index is where open-book becomes a scoring advantage. A well-built index lets you resolve a recall-style multiple-choice item in seconds, which banks minutes for CyberLive. Index by tool, protocol, and concept rather than by page order, and cross-reference where a topic spans multiple domains. Our one-page GNFA cheat sheet is useful for deciding which facts belong at the top of your own index.
Fees, Retakes, and the 120-Day Window
The 70% line has real financial stakes, so understand the attempt mechanics:
| Item | Detail |
|---|---|
| Certification attempt | USD $999 |
| Retake | USD $899 |
| Official practice exam | USD $399 |
| Completion window | 120 days from activation |
| Taxes | Prices exclude applicable sales tax |
| SANS training tuition | Separate from exam fees |
The 120-day window starts at activation, not purchase, so activate when you are close to ready rather than months early. The gap between the $999 attempt and the $899 retake is modest, but a failed first sitting still costs real money and time, which is the strongest argument for using an official practice exam before committing. For the full financial picture, see the GNFA certification cost breakdown, and for eligibility details check GNFA requirements. There are no formal certification prerequisites, and training is optional but recommended.
Sequencing Your Prep Around the Pass Line
Because the pass line is cumulative and weights are unpublished, sequence your preparation so that foundations come first and the hardest applied domains get repeated exposure. This is the one place a schedule helps, and it is tied to GNFA specifics.
Protocols and encoding foundations
- Domain 1 (Common Network Protocols) and Domain 2 (Encryption and Encoding)
- Work through the public FOR572 introductory tcpdump and Wireshark lab, noting it assumes the SIFT Workstation VM
Scale and architecture
- Domain 3 (NetFlow Analysis and Attack Visualization) and Domain 4 (Network Architecture)
- Learn why flow data matters when full capture is unavailable
Hardest applied skills
- Domain 5 (Network Protocol Reverse Engineering) and Domain 6 (Open Source Network Security Proxies)
- Schedule these when you have the most energy; they reward hands-on repetition
Correlation, wireless, and timed practice
- Domain 7 (Security Event and Incident Logging) and Domain 8 (Wireless Network Analysis)
- Finish index construction and run a timed full-length rehearsal
The public introductory lab is useful practice but is not the full paid course workbook and is not a GNFA exam blueprint. The associated SANS FOR572 course organizes its preparation into six sections, but those course sections are unweighted curriculum rather than an exhaustive statement of exam coverage. For a fuller plan, read our GNFA study guide for first-attempt success and the overview of GNFA training options.
After You Pass: Validity and Renewal
Clearing 70% earns a certification valid for four years. To renew, you need 36 approved CPE credits earned during the active four-year period, or you can take a renewal exam, plus the standard USD $499 renewal fee. Planning for CPE from day one makes renewal far less stressful.
Network forensics skills map to roles in incident response, threat hunting, and security operations. If you are weighing the payoff of the effort, our analyses of whether the certification is worth it, the GNFA salary guide, and GNFA jobs cover the career side without relying on unsourced figures. When you are ready to test yourself against realistic questions, try the practice tests on the main GNFA Exam Prep site.
Frequently Asked Questions
The minimum passing score is 70%. This standard applies to exam versions released on or after December 24, 2016. Always confirm the details for your assigned attempt at exams.giac.org, which takes precedence.
The exam has 66 total questions with a 3-hour time limit. That limit covers the complete exam, including the CyberLive performance-based tasks, with 15 minutes of break time allowed.
No. GIAC publishes eight objective headings in order but does not attach official percentage weights. Be cautious of any source that quotes precise per-domain percentages, since they are not part of the published objectives.
No. Submitted answers cannot be changed. Verify against your index and notes before committing, and use the on-screen scratch notepad and calculator to work through problems first.
You can purchase a retake for USD $899, compared with $999 for the initial attempt, subject to the eligibility rules of your attempt. Using the official $399 practice exam beforehand is a common way to gauge readiness.
Yes, with limits. Hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.