GCFA certification: cost, exam format and training

What is the GCFA certification?

The GIAC Certified Forensic Analyst (GCFA) certification is issued by GIAC, the certification body that works alongside SANS training. GIAC says GCFA validates a practitioner’s command of core forensic skills to collect and analyse data in computer systems, and that holders can run formal incident investigations and handle advanced incident handling scenarios.

GIAC groups the content into three areas: advanced incident response and digital forensics; memory forensics, timeline analysis and anti-forensics detection; and threat hunting and incident response to APT intrusions. In other words, GCFA is about finding out what an attacker did on a compromised Windows estate, not about building defences.

GIAC lists who the GCFA cert is aimed at: incident response team members, threat hunters, SOC analysts, experienced digital forensic analysts, information security professionals, federal agents and law enforcement professionals, and red team members, penetration testers and exploit developers who want to understand what defenders see.

Source: GIAC — GIAC Certified Forensic Analyst (GCFA). Checked 10 October 2026.

How much does the GCFA certification cost?

GIAC publishes its prices in US dollars. A standalone GCFA certification attempt costs US$999. If you do not pass, an exam retake costs US$899. If you run out of time before sitting the exam, an attempt extension costs US$479. A GCFA practice exam bought separately costs US$399.

Missing a proctored appointment is not free either: GIAC charges a US$175 reseating fee for a missed proctored exam appointment, which comes with a seven-day extension of your deadline.

The attempt alone does not include training. If you take the attempt as part of a SANS course bundle, the price is set on the SANS course page instead; the FOR508 OnDemand listing on SANS showed US$8,780 for the course, before any certification attempt add-on.

• Certification attempt: US$999
• Exam retake: US$899
• Attempt extension: US$479
• Practice exam: US$399
• Renewal every four years: US$499

Source: GIAC — Certification pricing and fees. Checked 10 October 2026.

GCFA exam format: questions, time and passing score

The GCFA exam is one proctored exam with 82 questions and a 3-hour time limit. The minimum passing score is 71% for exam versions released on or after 18 March 2023; GIAC tells candidates to check their own GIAC account for the specifics of their attempt.

GCFA uses CyberLive. GIAC describes it as replacing traditional multiple-choice testing with performance-based challenges in realistic lab environments, with virtual machines, real security tools and authentic code. GIAC does not publish how many of the 82 questions are CyberLive tasks, so prepare to work hands-on rather than only recognise answers.

All GIAC exams are web-based and must be proctored, either remotely through ProctorU or onsite at a Pearson VUE test centre. A standalone attempt gives you 120 days from activation to sit the exam.

Source: GIAC — GIAC Certified Forensic Analyst (GCFA). Checked 10 October 2026.

Is the GCFA exam open book?

Yes. GIAC states that its exams are open book, but they are not open internet or open computer. You may bring printed books, the original course material from training you attended, and handwritten or printed notes, including an index. Anything stored electronically — PDFs, Word files, a second laptop or a USB stick — is not allowed.

One restriction is easy to miss: printed material that looks like practice test or exam questions is prohibited. GIAC also notes that workstation space is limited, so bring an index and a few well-marked books rather than a crate of paper.

Source: GIAC — Proctor program overview. Checked 10 October 2026.

What is on the GCFA exam?

GIAC publishes ten exam certification objectives for GCFA. They move from the basics of Windows artefacts and file system timelines to memory analysis and enterprise-wide response. GIAC does not publish a weighting for the objectives, so treat them as equally important when you plan your study.

• Analyzing Volatile Malicious Event Artifacts
• Analyzing Volatile Windows Event Artifacts
• Enterprise Environment Incident Response
• File System Timeline Artifact Analysis
• Identification of Malicious System and User Activity
• Identification of Normal System and User Activity
• Introduction to File System Timeline Forensics
• Introduction to Memory Forensics
• NTFS Artifact Analysis
• Windows Artifact Analysis

Source: GIAC — GIAC Certified Forensic Analyst (GCFA). Checked 10 October 2026.

GCFA training and course: SANS FOR508

GIAC does not require any course before you buy a GCFA attempt — the GCFA page lists no prerequisites. The official training that maps to the certification is SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics, which SANS lists with the GIAC Certified Forensic Analyst certification.

SANS lists FOR508 as six days instructor-led or 36 hours self-paced, worth 36 CPEs, and delivers it in person, virtually or self-paced with four months of OnDemand access. The OnDemand price shown on the SANS page was US$8,780; live sessions are priced per location and currency.

FOR508 is not a beginner course. SANS rates it intermediate, says it does not cover the basics of incident response policies or digital forensics, and recommends a background in FOR500: Windows Forensics first. Its lab laptop requirements are strict as well, including an Intel or AMD 64-bit processor and at least 16GB of RAM.

Source: SANS Institute — FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics. Checked 10 October 2026.

How to study for the GCFA exam

Because the exam is open book, GIAC’s own study advice centres on the index: a systematic, colour-coded guide you build from your course books so you can find a topic in seconds. GIAC says the process of building it is itself a way to learn the material.

GIAC suggests taking a first practice test after your first in-depth pass through the course material, using its report to see which objectives to revisit, and a second one once you feel ready for the real exam. GIAC notes that practice exams never include actual exam questions and that the practice pool is limited, so repeated questions are possible.

For GCFA specifically, plan time on a lab. CyberLive tasks expect you to run tools against real evidence, so reading about memory analysis or timeline creation is not enough — practise doing it.

Source: GIAC — Best practices for practitioner exam preparation. Checked 10 October 2026.

GCFA dumps and exam integrity

GCFA dumps are not a shortcut GIAC tolerates. GIAC’s exam integrity policy lists any use of or reference to exam dump sites containing actual or possible GIAC questions and answers as a violation, and says candidates must not share or accept knowledge of test content, including questions, answers or scenarios.

The sanctions are serious: GIAC can revoke previously issued GIAC certifications back to the date they were issued and ban a candidate from future GIAC programmes and certification attempts. With CyberLive tasks in the exam, memorised answers would not help much anyway.

Source: GIAC — Exam integrity policy. Checked 10 October 2026.

How do you renew GCFA?

GIAC certifications are kept active by collecting 36 credits over four years. The renewal fee listed for GCFA is US$499, and GIAC states that additional renewals within two years of paying a full-price renewal cost US$249.

Many training and work activities can count, so log credits as you earn them rather than at the end of the four-year cycle.

Source: GIAC — Certification renewal. Checked 10 October 2026.

GCFA practice questions

Certsqill’s GCFA practice questions are expert-developed: every question explains each answer option, and a readiness score for each objective area helps when GIAC publishes no weighting and you need to know which of the ten objectives is still weak.

GCFA questions people ask

What is the GCFA certification?

The GIAC Certified Forensic Analyst, GIAC’s certification for advanced incident response, memory and timeline forensics and threat hunting. Source: GIAC, checked 10 October 2026.

How much does the GCFA certification cost?

A standalone certification attempt costs US$999; a retake is US$899 and an extension US$479. Source: GIAC pricing page, checked 10 October 2026.

How many questions are on the GCFA exam?

82 questions in 3 hours, including CyberLive hands-on tasks. Source: GIAC GCFA page, checked 10 October 2026.

What is the GCFA passing score?

71% for exam versions released on or after 18 March 2023. Source: GIAC GCFA page, checked 10 October 2026.

Is the GCFA exam open book?

Yes, for printed books and notes. It is not open internet or open computer. Source: GIAC proctor overview, checked 10 October 2026.

Do I need SANS FOR508 to take GCFA?

No. GIAC lists no prerequisites, but FOR508 is the SANS course aligned with GCFA. Sources: GIAC and SANS, checked 10 October 2026.

How long do I have to take the GCFA exam?

120 days from activation of a standalone attempt. Source: GIAC certification attempt delivery policy, checked 10 October 2026.

How do I renew GCFA?

Collect 36 credits over four years and pay the US$499 renewal fee. Source: GIAC, checked 10 October 2026.

What GCFA salary can I expect?

GIAC does not publish salary figures for GCFA holders, so this page does not quote any.