GNFA exam preparation works best when you start from evidence, not from reading. The GIAC Network Forensic Analyst exam is one proctored test of 66 questions in 3 hours, and you need 70% to pass. It is open book, but the book only helps if you already know how a packet capture, a NetFlow record and a proxy log look when something has gone wrong.
That is the idea behind this plan: spend most of your hours inside real network data, and use reading to explain what you found. Below you will find what the exam checks, how the eight GIAC objectives group into study blocks, a six-week schedule, a worked investigation, the mistakes that cost candidates time, and the cost of each attempt. Every exam figure was read on GIAC's own pages on 12 November 2026.
What does the GNFA exam actually check?
The GNFA checks whether you can read network evidence and explain what happened. GIAC says holders can process and interpret normal and abnormal network activity, and analyze application activity through system logs, network traffic captures and network metadata.
That is a practical skill, not a list of definitions. The questions reward someone who knows what normal DNS, HTTP or SMB traffic looks like, so the abnormal case stands out. If your background is disk forensics, the biggest shift is that the network rarely gives you a whole file or a whole story. You work from fragments: a flow record here, a proxy line there, a partial capture somewhere else.
GIAC lists the people the certification is meant for: incident response team members, forensic analysts, threat hunters, law enforcement and federal agents, SOC staff, security practitioners and managers, network defenders and engineers, and IT professionals. In practice, most candidates sit somewhere between incident response and network operations.
What is the GNFA exam format?
The format, as published on the official GIAC GNFA certification page, is:
- 1 proctored exam
- 66 questions
- 3 hours
- Minimum passing score: 70%
GIAC set the 70% mark through a psychometric standard-setting study, and it applies to every candidate who receives the exam version released on or after 24 December 2016. GIAC also says to confirm the format and passing score for your own attempt in the Certification Information section of your GIAC account, so check that page before exam day.
Once your attempt is activated, you have 120 days to sit it. The exam is web-based and always proctored, either remotely through ProctorU or onsite at a Pearson VUE center. The GNFA page also carries a CyberLive section, GIAC's hands-on format that uses virtual machines and real tools, but it does not say how many CyberLive items the GNFA exam holds. Plan for hands-on work either way.
A quick piece of arithmetic of our own: 180 minutes for 66 questions is about 2 minutes 44 seconds per question. That is enough time to look something up in your index, but not enough to read a chapter. Your notes have to point you to the answer in seconds.
What are the eight GNFA objectives?
GIAC lists eight objectives for the exam and publishes no weight for any of them. Here they are in GIAC's order, with what each one means in practice:
- Common Network Protocols: how everyday protocols behave, where their security risks are, and which controls apply.
- Encryption and Encoding: how network traffic gets encoded or encrypted, and the common attacks on those controls.
- NetFlow Analysis and Attack Visualization: using flow data to spot attacks when you have no full packets.
- Network Architecture: designing and deploying a network with the right mix of transmission and collection points.
- Network Protocol Reverse Engineering: tools and techniques for working out what an unfamiliar protocol is doing.
- Open Source Network Security Proxies: how proxies are built and deployed, their strengths and weaknesses, and their log formats.
- Security Event and Incident Logging: log formats and protocols, and where to place log aggregators and collectors.
- Wireless Network Analysis: finding and controlling the risks in wireless technologies, protocols and infrastructure.
Because there are no weights, the safe reading is that every objective can appear. Protocols, though, run through almost all of the others, which is why the plan below starts there.
How do the GNFA objectives line up with SANS FOR572?
GNFA is the certification linked to SANS FOR572, Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response. The SANS FOR572 course page lists six days of instructor-led training (or 36 hours self-paced), 36 CPEs and 20 hands-on labs, and maps each section to the exam objectives:
- Section 1, Off the Disk and Onto the Wire: Network Architecture and Open Source Network Security Proxies, through proxy logs and evidence acquisition with tools such as tcpdump and Wireshark.
- Section 2, Core Protocols and Log Aggregation: Common Network Protocols and Security Event and Incident Logging, through HTTP and DNS profiling, syslog, Windows Event Forwarding and SOF-ELK.
- Section 3, NetFlow and File Access Protocols: NetFlow Analysis and Attack Visualization, plus FTP reconstruction and SMB session analysis.
- Section 4, Commercial Tools, Wireless, and Full-Packet Hunting: Wireless Network Analysis, plus SMTP and full-packet hunting with NetworkMiner and Arkime.
- Section 5, Encryption, Protocol Reversing, OPSEC, and Intel: Encryption and Encoding and Network Protocol Reverse Engineering, through TLS profiling and undocumented protocols.
- Section 6, Capstone: every objective in one case, using network evidence only.
You do not need the course to sit the exam; GIAC also mentions college courses, self-study and work experience. But if you have the course books, this mapping tells you which book answers which objective, and that is the backbone of a good index.
What does a lab-first six-week GNFA plan look like?
GIAC's own preparation page says certification holders report 55+ hours of study on average, and it suggests about four months of study after training. The six weeks below are the core block inside that window: roughly 9 hours a week (our arithmetic), with at least two-thirds of each week spent in captures, flow data and logs rather than in reading.
- Week 1, protocols as a baseline: capture your own normal traffic and walk through DNS, HTTP, TLS handshakes and SMB until you can describe each one without notes. Write one index line for every field you had to look up.
- Week 2, logs and proxies: read proxy and syslog entries for the same sessions you captured. Practice matching one web request across a packet capture and a proxy log. This covers the proxies and logging objectives together.
- Week 3, NetFlow: work from flow records alone. Find the long-lived connection, the odd port, the host that suddenly talks to many others. Then check your guess against the full capture to see what flow data can and cannot tell you.
- Week 4, encryption, encoding and unknown protocols: look at what you can still learn from encrypted sessions (certificates, timing, sizes, endpoints), decode common encodings by hand, and pick apart one protocol you have never seen.
- Week 5, architecture and wireless: sketch where you would place collection points in a small network, then study the wireless objective's risks and controls. Finish the first full pass of your index.
- Week 6, practice and timing: take a practice exam under real time limits, note every question where your index was slow, fix those entries, and then take a second one.
If you have more than six weeks, stretch weeks 1 to 3. They carry the skills that every other objective leans on.
How should you use the open-book rule for GNFA?
GIAC exams are open book: all printed books, notes and study guides are allowed, but nothing digital. The GIAC practitioner exam preparation guide describes the index as a systematic, color-coded guide you build yourself, and it is the single most useful thing you can bring.
A few habits help on a network forensics exam in particular:
- Index by artifact, not only by topic. Entries such as "DNS TXT record," "NetFlow byte count," or "proxy status code" find answers faster than "Chapter 2."
- Keep a one-page protocol sheet. Default ports, key header fields and common status codes on a single printed page save many look-ups.
- Note the tool, not just the theory. If a lab used a filter or a command to answer a question, write that filter into your notes.
- Do not bring anything that looks like exam questions. GIAC's proctoring rules forbid printed material that has the look of practice-test questions and answers.
Remember too that GIAC does not let you go back and change an answer once it is submitted. You can skip a limited number of questions (GIAC says 10 to 15, depending on the exam) and return to them at the end, so save your skips for the long look-ups.
What does a GNFA-style investigation look like?
Here is a short worked case, written by us, to show the kind of thinking the exam rewards. It is not a test question.
A workstation's antivirus alert fired once and then went quiet. You have three sources: NetFlow from the core switch, the web proxy log, and a 20-minute packet capture from the internet edge taken the next morning.
- Start with flow data. It shows the workstation opening a connection to one external address every few minutes, each with a very similar byte count. Regular timing with similar sizes points to automated check-ins, not a person browsing.
- Move to the proxy log. The same address appears as a request to a plain-looking domain, always with the same user-agent string and a short response. The proxy gives you the domain name and the user-agent that flow data never had.
- Finish in the capture. The traffic is encrypted, so you cannot read the content. You can still read the certificate details, the timing and the size pattern, and confirm it matches the flow records.
The conclusion is not "we decrypted the payload." It is "three independent sources show the same host beaconing to the same destination on a schedule." That habit of joining sources is what the protocols, logging, proxies and NetFlow objectives test together.
What mistakes slow candidates down on the GNFA?
Most of the time lost on this exam comes from preparation choices, not from hard questions:
- Reading without labs. Knowing that NetFlow has no payload is not the same as knowing what you can still learn from it. Do the exercise.
- Treating encrypted traffic as a dead end. Endpoints, certificates, timing and size often tell you enough. Practice what is left when content is hidden.
- An index built from chapter titles. Under a 2 minute 44 second average, you need entries for the exact field or artifact.
- Skipping wireless and architecture. They feel like side topics, but they are two of eight objectives with no published weights.
- No timed practice. GIAC's practice exams copy the real test engine. Take at least one under the full three-hour limit.
If you have read our notes on why the GREM exam feels harder than its numbers suggest, the pattern is the same: GIAC rewards hands-on fluency more than memory.
How much does the GNFA cost?
GIAC lists one price table for all its practitioner certifications. The GIAC certification pricing page shows these GNFA fees:
- Certification attempt: $999
- Exam retake: $899
- Attempt extension: $479
- Certification renewal: $499
- Practice exam: $399
- Demo questions: not offered for GNFA
Money is also a reason to take the practice exam seriously. A retake costs $899, and a practice test that shows you a weak objective before exam day costs far less. Read the full price table yourself before you buy, as GIAC can change it.
How do you know you are ready for the GNFA?
You are ready when you can take any one network artifact and say what it shows, what it cannot show, and which other source would confirm it. A practical check before you book the exam:
- You can describe normal DNS, HTTP, TLS and SMB sessions from memory.
- You can find a beaconing host in flow data and confirm it in a second source.
- Your index takes you to any protocol field in under a minute.
- You have scored comfortably above 70% on a timed practice exam, and you fixed the topics where you were slow.
For a topic-by-topic outline to check your plan against, see EduSum's GNFA syllabus overview, which lists the exam details and objectives in one place.
Is there a video on GNFA preparation?
EduSum's YouTube channel has no GNFA or network forensics video yet. The closest one is its exam-tips video for CREST CPSA, another practitioner-level security analyst exam, and its advice on practical, hands-on preparation carries over to GNFA.
For another GIAC exam where analysis matters more than recall, see our earlier entry on the nine objectives behind the GCTI test.
Frequently asked questions
1. How many questions are on the GNFA exam?
The GNFA exam has 66 questions in one proctored sitting of 3 hours. GIAC says to confirm the format for your own attempt in the Certification Information section of your GIAC account.
2. What is the GNFA passing score?
The minimum passing score is 70%. GIAC set it through a psychometric standard-setting study for every candidate who receives the exam version released on or after 24 December 2016.
3. Is the GNFA exam open book?
Yes. All printed books, notes and study guides are allowed, but no digital items. A self-made, color-coded index is the most useful thing to bring.
4. How long should GNFA exam preparation take?
GIAC reports that certification holders study 55+ hours on average and suggests about four months after training. A focused six-week lab-first block of about 9 hours a week covers the core work inside that window.
5. How much does the GNFA certification cost?
GIAC lists $999 for a certification attempt, $899 for a retake, $479 for an attempt extension, $499 for renewal and $399 for a practice exam. Demo questions are not offered for GNFA.