thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

GIAC · Cybersecurity · Professional

GIAC Certified Intrusion Analyst (GCIA) exam guide

Exam GCIA

GIAC Certified Intrusion Analyst (GCIA) proves deep network traffic and intrusion detection skill: TCP/IP at the packet level, IDS rules, Wireshark and tcpdump, and network forensics. Aligned with SANS SEC503, it is a respected credential for network security monitoring roles.

Questions106
Time limit240 minutes
Passing score67%
Exam feeSee official page
Valid for4 years
DeliveryRemote proctored (ProctorU) or Pearson VUE test center

Format: Proctored exam with multiple choice and CyberLive hands-on questions; open book. Fee note: GIAC shows the price at checkout; attempts bundled with SANS training cost less than standalone attempts. Includes practice tests.

Who it's for

SOC analysts, network security monitoring engineers and IDS engineers.

What the exam covers

Concepts of TCP/IP and the Link Layer—
IP Headers, IPv6 and Fragmentation—
TCP, UDP and ICMP—
Application Protocols—
Tcpdump Filters and Wireshark Fundamentals—
IDS Fundamentals and Network Architecture—
Intrusion Detection System Rules—
Network Forensics and Traffic Analysis—
SiLK and Other Traffic Analysis Tools—
Packet Engineering—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Networking experience and comfort with packet captures; SANS SEC503 is the aligned course.

Keeping it active

Valid four years: earn 36 CPEs in the cycle and pay GIAC's certification maintenance fee, or renew by retaking the current exam.

Skills & careers

Skills it validates

  • Reading packet headers in hex
  • Writing BPF/tcpdump filters
  • Writing and tuning IDS rules (Snort/Suricata)
  • Wireshark analysis
  • Network forensics and flow analysis
  • Packet crafting with Scapy

Job roles

Intrusion AnalystSOC Analyst (Tier 2/3)Network Security EngineerCyber Defense AnalystThreat Hunter

DoD 8140

Listed in the DoD 8140 qualification matrix for cyber defense analyst and infrastructure support work roles. Confirm on the DoD CWQ site. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: TCP/IP headers, fragmentation, IPv6; practise reading hex dumps.
  2. Week 3: tcpdump filters and Wireshark.
  3. Week 4: IDS rules and network architecture.
  4. Week 5: Network forensics, SiLK and Scapy.
  5. Week 6: Practice tests and index refinement.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • GIAC exams are open book (printed notes only); build a tabbed index of your course books before the exam.
  • Memorise header offsets; looking them up for every question costs too much time.
  • Practise BPF filters with bit masks; they are a classic GCIA question type.
  • 106 questions in 4 hours: keep a steady 2-minute pace.

Key terms for this exam

All 23 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

Is GCIA hard?

It is one of the more technical GIAC exams due to packet-level detail.

Pass mark?

67%.

GCIA vs GCIH?

GCIA is deep network analysis; GCIH is broader incident handling.

Renewal?

Every four years with 36 CPEs.

Is it open book?

Yes.

Official page: www.giac.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.