GIAC Network Forensic Analyst (GNFA) Practice Test

Substantial practical experience is strongly recommended. You should be thoroughly comfortable with TCP/IP fundamentals, reading and interpreting packet headers in Wireshark/TShark, and understanding common network architectures. Experience from roles in network administration, security operations, or incident response is highly beneficial. The exam tests applied skills, not just theoretical knowledge.

While not a formal requirement, the FOR572: Advanced Network Forensics and Analysis course is the official training vehicle for the GNFA. The exam blueprint aligns directly with its content. Self-study is possible for exceptionally experienced practitioners, but the course provides the structured curriculum, curated evidence files, and expert instruction that most candidates find essential for success.

The GNFA is a proctored, 2-hour exam consisting of 65-75 questions. A significant portion involves performance-based questions (PBQs) where you must analyze provided evidence files (e.g., PCAPs, logs) within a virtual lab environment to answer specific investigative questions. This format directly tests your ability to perform tasks, not just recall information.

Wireshark (and its command-line counterpart TShark) is the cornerstone tool. You must also be proficient with tools for NetFlow analysis (like SiLK or NFDUMP), log analysis, and timeline creation. The exam focuses on the analytical process and tool-agnostic concepts, but fluency in these primary applications is necessary to complete the practical tasks efficiently.

The GIAC Certified Intrusion Analyst (GCIA) focuses on network monitoring, intrusion detection, and the real-time signature/ anomaly-based analysis of traffic to identify attacks. The GNFA focuses on post-incident forensics: the in-depth examination of captured network evidence to reconstruct events, prove malicious activity, and determine scope and impact. GCIA is about finding the needle in the haystack; GNFA is about dissecting the needle to understand its entire history.