GNFA certification: the GIAC Network Forensic Analyst exam

What is the GNFA certification?

GNFA stands for GIAC Network Forensic Analyst. GIAC says the certification validates a practitioner’s ability to process and interpret normal and abnormal network activity, and to analyse application activity through system logs, network traffic captures and network metadata.

It is a network-side forensics credential. Where host forensics looks at disks and memory, GNFA is about what the network recorded: packet captures, NetFlow, proxy logs and event logs. GIAC lists incident responders, forensic analysts, threat hunters, SOC staff, law enforcement and network defenders among the people it is aimed at.

Source: GIAC — GNFA certification. Checked 10 October 2026.

How much does the GNFA certification cost?

GIAC lists a GNFA certification attempt at $999. A practice exam costs $399, a retake $899, an attempt extension $479 and a renewal $499. All prices are in US dollars and exclude applicable sales tax.

If you register through a SANS training bundle, GIAC points to the SANS affiliate pricing page instead of its own table, so this page does not quote a bundle figure.

Source: GIAC — Pricing. Checked 10 October 2026.

GNFA exam format

The GNFA exam is one proctored exam with 66 questions and a 3-hour time limit. You can sit it remotely, proctored through ProctorU, or onsite at a Pearson VUE test center.

GIAC labels GNFA as a CyberLive certification. CyberLive is GIAC’s hands-on format, which replaces traditional multiple-choice testing with performance-based challenges. The GNFA page does not state how many of the 66 items are CyberLive tasks, so plan for both question types.

GIAC certification attempts have a time limit of four months (120 days). If you need more time, GIAC sells a 45-day extension.

Source: GIAC — GNFA certification. Checked 10 October 2026.

GNFA passing score

The minimum passing score is 70%. GIAC notes that this 70% threshold applies to exam versions released on or after 24 December 2016, which covers the current exam.

If you fail, GIAC imposes a 30-day waiting period before you can sit the exam again. Buying a retake also extends your final deadline by 60 days, including that wait.

Source: GIAC — Retakes and Extensions. Checked 10 October 2026.

What is on the GNFA exam?

GIAC publishes eight exam certification objectives. They range from protocol behaviour and encryption to logging infrastructure and wireless, so a candidate who is strong in packet analysis alone still has ground to cover.

• Common Network Protocols — behaviour, security risks and controls
• Encryption and Encoding — how traffic is encoded or encrypted, and attacks on those controls
• NetFlow Analysis and Attack Visualization — finding attacks in flow data
• Network Architecture — networks built from diverse transmission and collection technologies
• Network Protocol Reverse Engineering — tools and techniques for unknown protocols and data
• Open Source Network Security Proxies — architecture, deployment, weaknesses and log formats
• Security Event and Incident Logging — log formats, protocols and positioning log collectors
• Wireless Network Analysis — risks and controls in wireless technologies

Source: GIAC — GNFA certification. Checked 10 October 2026.

GNFA prerequisites

GIAC does not set a formal prerequisite for GNFA. It does say that practical work experience can help ensure you have mastered the skills the certification requires — and for an exam built around reading real network evidence, that is a realistic warning rather than boilerplate.

Source: GIAC — GNFA certification. Checked 10 October 2026.

GNFA study plan: training, index and practice tests

The SANS course GIAC links to for GNFA is Advanced Network Forensics, Threat Hunting, Incident Response. Training is not mandatory; you can buy a certification attempt on its own.

GIAC exams are open book: all printed books, notes and study guides are allowed, with no digital items. GIAC calls creating your index an essential part of studying. An index that maps protocols, log fields and tool output to page numbers is what lets you use the open-book rule under a 3-hour clock instead of leafing through binders.

GIAC sells GNFA practice tests separately; the price table lists a practice exam at $399. Its preparation guide recommends taking another practice test once you feel ready for the real exam, which makes the practice test a useful final check of both your knowledge and your index.

Source: GIAC — How to prepare (Practitioner). Checked 10 October 2026.

How long is the GNFA certification valid?

GIAC certifications are kept active by collecting 36 CPE credits over four years. The renewal fee in the GIAC price table is $499; additional renewals within two years of paying a full-price renewal are $249.

Source: GIAC — Renewal. Checked 10 October 2026.

GNFA vs other GIAC forensics certifications

GNFA is GIAC’s network forensics credential. Its objectives centre on traffic, flow data, proxies and logs; file systems and memory images do not appear in its objective list.

If your daily work is in a SOC or on an incident response team that lives in packet captures and log data, GNFA maps directly to that work. If you mainly image disks and analyse endpoints, compare the objective lists of GIAC’s other forensics certifications before you choose.

Source: GIAC — GNFA certification. Checked 10 October 2026.

GNFA practice questions

Certsqill’s GNFA practice questions come with an explanation for every answer option and a readiness score per domain, so you can see which of the eight objectives still needs work before you spend a $999 attempt.

GNFA questions people ask

How many questions are on the GNFA exam?

66 questions in 3 hours. Source: GIAC GNFA page, checked 10 October 2026.

What is the GNFA passing score?

70% minimum. Source: GIAC GNFA page, checked 10 October 2026.

How much does the GNFA certification cost?

$999 per certification attempt, excluding tax; a practice test is $399. Source: GIAC pricing, checked 10 October 2026.

Is the GNFA exam open book?

Yes. GIAC allows printed books, notes and study guides, but no digital items. Checked 10 October 2026.

Can I take the GNFA exam online?

Yes, with remote proctoring through ProctorU, or onsite through Pearson VUE. Source: GIAC, checked 10 October 2026.

How long do I have to take the exam?

GIAC certification attempts have a time limit of 4 months (120 days); a 45-day extension can be bought. Checked 10 October 2026.

What happens if I fail the GNFA exam?

There is a 30-day waiting period before you can retake; a retake costs $899. Source: GIAC, checked 10 October 2026.

How do I renew GNFA?

Collect 36 CPE credits over four years and pay the renewal fee ($499). Source: GIAC, checked 10 October 2026.