thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

GIAC · Cybersecurity · Expert

GIAC Certified Forensic Analyst (GCFA) exam guide

Exam GCFA

GIAC Certified Forensic Analyst (GCFA) proves you can run enterprise incident response and forensics: memory analysis, timeline creation, Windows artifact analysis and identifying malicious activity. Aligned with SANS FOR508, it is a senior credential for DFIR teams.

Questions82
Time limit180 minutes
Passing score71%
Exam feeSee official page
Valid for4 years
DeliveryRemote proctored (ProctorU) or Pearson VUE test center

Format: Proctored CyberLive exam with hands-on lab questions plus multiple choice; open book. Fee note: GIAC shows the price at checkout; attempts bundled with SANS training cost less than standalone attempts. Includes practice tests.

Who it's for

Experienced incident responders, DFIR analysts and threat hunters.

What the exam covers

Enterprise Environment Incident Response—
Identification of Normal and Malicious System and User Activity—
Introduction to Memory Forensics—
Analyzing Volatile Windows and Malicious Event Artifacts—
Introduction to File System Timeline Forensics—
File System Timeline Artifact Analysis—
NTFS Artifact Analysis—
Windows Artifact Analysis—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Incident response experience; SANS FOR508 is the aligned course.

Keeping it active

Valid four years: earn 36 CPEs in the cycle and pay GIAC's certification maintenance fee, or renew by retaking the current exam.

Skills & careers

Skills it validates

  • Memory forensics with Volatility
  • Super-timeline creation and analysis
  • NTFS and Windows artifact analysis
  • Detecting lateral movement and persistence
  • Enterprise-scale incident response
  • Distinguishing normal from malicious activity

Job roles

DFIR AnalystDigital Forensics ExaminerIncident Response LeadThreat HunterForensic Consultant

DoD 8140

Listed in the DoD 8140 qualification matrix for cyber defense forensics and incident response work roles. Confirm on the DoD CWQ site. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Windows artifacts and normal process behaviour.
  2. Week 3: Memory forensics with Volatility.
  3. Week 4: Timeline creation and NTFS analysis.
  4. Week 5: Repeat all FOR508 labs in the SIFT workstation.
  5. Week 6: Practice tests and index, then book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • GIAC exams are open book (printed notes only); build a tabbed index of your course books before the exam.
  • CyberLive questions run in a forensic VM; be fluent with Volatility and timeline tools.
  • Know normal Windows process parent/child relationships; spotting anomalies is a recurring theme.
  • Budget extra time for lab questions, which take longer than multiple choice.

Key terms for this exam

All 49 terms Study with thinQcards™

Frequently asked questions

Is GCFA hard?

Yes, it is an advanced exam with hands-on labs.

Pass mark?

71%.

GCFA vs GCFE?

GCFE is foundational forensics; GCFA covers enterprise IR and memory forensics.

Renewal?

Every four years with 36 CPEs.

Is GCFA worth it?

It is one of the most respected DFIR credentials.

Official page: www.giac.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.