What Is GNFA?

What GNFA Actually Is

GNFA stands for GIAC Network Forensic Analyst. It is a practitioner-level certification that validates your ability to examine network evidence: packet captures, flow records, device and server logs, proxy data, and wireless traffic. The goal is to reconstruct what happened on a network during an intrusion, determine what an attacker did, and support incident response with defensible findings.

The acronym is shared with other credentials in unrelated fields, so it is worth being precise. Everything on this page refers only to the GIAC Network Forensic Analyst exam. If you want the short-form definitions, see our companion explainers on what GNFA stands for and what the GNFA certification is.

Where many security certifications test whether you can recognize a concept, GNFA leans toward whether you can work an investigation. You are expected to read protocol behavior at a granular level, spot anomalies in flow data, interpret logs from multiple sources, and understand how encryption and encoding affect what an investigator can see.

Who Issues It and How the Exam Works

The certification is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. Proctoring runs through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility. The structure is straightforward:

The exam engine provides an on-screen calculator and a scratch notepad. Submitted answers cannot be changed, and you are allowed 15 minutes of break time. Because the three-hour clock covers everything, including the hands-on portion, pacing matters more than many candidates expect. For a deeper look at the numbers, read our breakdown of the GNFA passing score.

The Eight Exam Domains in Detail

GIAC publishes eight objective headings for the exam. They are listed in published order and, importantly, without official percentage weights, so you should not assume any one area is lighter than another. Our complete guide to all eight GNFA content areas expands on each, but here is what each one means in practice.

Question Style: Multiple Choice Plus CyberLive

The exam combines multiple-choice questions with CyberLive, GIAC's hands-on, performance-based format. GIAC's own demo write-up describes practitioner exams as multiple-choice items followed by CyberLive tasks, so expect to finish the conceptual items and then move into practical work. Because both sections share one three-hour clock, you should decide in advance how much time you will give each portion.

What multiple-choice items test

These items check whether you understand how protocols, logs, and evidence behave. Expect scenarios that ask you to interpret a capture excerpt, identify what a flow pattern implies, or choose the correct conclusion from a set of artifacts. Strong candidates read the evidence rather than hunting for keywords.

What CyberLive tasks test

CyberLive places you in a live environment where you perform analysis tasks rather than select from options. This is where hands-on practice pays off directly. If your only preparation has been reading, the practical section will feel unfamiliar. Candidates who have spent real time in packet analysis tools and the command line have a clear advantage.

Fees, Scheduling, and Attempt Mechanics

Here are the published figures, all excluding applicable sales tax:

SANS training tuition is a separate cost and is not included in the attempt fee. For a full accounting, see our GNFA certification cost breakdown.

Once your attempt is activated, you have a 120-day completion window. That deadline is the single most important scheduling fact to internalize: activating an attempt starts a clock, so activate when you are close to ready rather than months in advance. Our GNFA exam dates guide covers scheduling in more detail, and GNFA requirements explains eligibility.

Open-Book Rules and How to Build an Index

GNFA is open book, but the definition is strict. Hardcopy books, notes, and an index are permitted. Internet access, personal electronic references, and any materials resembling practice or exam questions and answers are prohibited. That last restriction is worth taking seriously: do not bring anything that looks like a question-and-answer set.

Because you can bring a physical index, how you build it is a genuine skill. A few GNFA-specific principles:

• Index by concept and by tool. You will look things up by protocol field, flow-analysis technique, or command syntax, so organize accordingly.
• Include tcpdump and Wireshark filter syntax. Having filter patterns at hand saves valuable minutes during hands-on tasks.
• Note the pitfalls, not just the definitions. A line like "flow data shows connections, not content" can prevent a wrong conclusion under pressure.
• Make it navigable. An index you cannot search in seconds is worse than none, given the three-hour limit.

A one-page distillation can complement a full index. Our GNFA cheat sheet shows the kind of must-know facts worth capturing.

The Training Path Behind the Certification

Training is optional and recommended, not required. The training most closely associated with GNFA is SANS FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response. Its curriculum is organized into six preparation sections. Be careful not to over-interpret that structure: course sections are unweighted preparation curriculum and do not establish exhaustive exam coverage or define the eight exam domains.

A small caution on published details: the live FOR572 page lists 20 training labs, while its linked brochure lists 18. That discrepancy comes from the two sources being published at different times, and neither number tells you anything about how many exam questions you will face.

Free practice you can start today

SANS publishes a public introductory resource, the FOR572 Introductory Lab Workbook, Bonus Lab 1.0: tcpdump and Wireshark Hands-On. It covers packet capture and analysis and assumes the FOR572-specific SIFT Workstation VM, with a warning that results may vary on other VMs. It is not the full paid course workbook and is not an exam blueprint, but it is a low-cost way to test whether your command-line packet skills are where they need to be.

Helpful background, separate from eligibility, includes forensic technique, networking fundamentals, and comfort in a Linux shell. For a structured plan, see our GNFA study guide and the overview of GNFA training options.

Who Benefits From the Credential

The skills GNFA validates map naturally onto several security roles:

• Incident responders who need to scope intrusions using network evidence
• Threat hunters searching flow and proxy data for stealthy activity
• Security operations analysts who triage alerts and correlate logs
• Digital forensic examiners expanding from host forensics into network evidence
• Network security engineers who want to understand what investigators can and cannot see

Employers who run active detection and response programs, including consultancies, managed security providers, and large enterprise security teams, are the most natural audience for this credential. We deliberately avoid quoting salary numbers here because we will not invent figures; for a careful discussion, see the GNFA salary guide, the GNFA jobs overview, and our ROI analysis.

Sequencing Your Preparation by Domain

One short note on planning, tied to the actual domains. Start with the material everything else depends on, then move toward the most hands-on and abstract areas while you still have time to practice them.

Protocol fluency comes first because every later domain assumes it. Reverse engineering and wireless come later because they reward the strongest foundation and benefit from the most hands-on repetition. When you are ready to test yourself, try the GNFA practice tests to find weak areas before you activate your attempt.

Validity and Renewal

The certification is valid for four years. To renew, you can earn 36 approved CPE credits during the active period or take a renewal exam, in either case paying the standard USD $499 renewal fee. Because forensic tooling and attacker tradecraft evolve, treat the four-year cycle as a prompt to keep your skills current rather than a box to tick. For broader context, the pages on the GNFA certification and GNFA pass rate are good next reads, and you can always return to the main practice test site to keep your skills sharp.

Frequently Asked Questions