Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by GIAC
Exam Format
180 min
66
70%
Practitioner
Registration
$999 USD
ProctorU (remote), PearsonVUE (onsite), or online proctoring
Validity
4 years
Submit 36 CPE credits over 4 years ($499 first renewal, $249 additional renewals); Retake the current GNFA certification exam
GNFA Exam Topics and Domains
GNFA is organized into 8 weighted domains. Expect to work with SIEM platforms, FTPS, Network monitoring tools, Wireless access points, and more.
1
Common Network Protocols
12.5%
Core Protocol Analysis
HTTP/HTTPS Protocol FundamentalsDNS Protocol AnalysisFTP Protocol SecuritySMB/CIFS AnalysisSMTP Protocol Forensics
- Demonstrate understanding of the behavior, security risks and controls of common network protocols
- Analyze protocol-specific artifacts to identify security incidents
- Reconstruct network sessions from packet captures
2
Encryption and Encoding
12.5%
SSL/TLS Analysis
SSL/TLS Protocol ProfilingEncrypted Traffic AnalysisMan-in-the-Middle Techniques
- Understand techniques and practices used to encode and encrypt common network traffic
- Identify common attacks on encryption controls
- Analyze encrypted traffic metadata for threat detection
Encoding Schemes
Data Encoding Methods
- Recognize and decode common encoding schemes in network traffic
- Identify obfuscation techniques used by attackers
3
NetFlow Analysis and Attack Visualization
12.5%
NetFlow Fundamentals
NetFlow Data CollectionFlow Data Analysis
- Demonstrate familiarity with NetFlow data and information sources
- Use NetFlow data to identify network attacks
- Visualize network traffic patterns for threat detection
Attack Visualization
Visual NetFlow AnalysisBehavioral Analysis
- Create effective visualizations of network attacks
- Use visual analysis to identify attacker tactics and techniques
- Communicate findings through visual representations
4
Network Architecture
12.5%
Network Design and Deployment
Network Topology AnalysisTransmission TechnologiesEvidence Collection Infrastructure
- Understand the process to design and deploy a network employing diverse transmission and collection technologies
- Identify optimal locations for forensic evidence collection
- Recognize network design elements that impact forensic investigations
5
Network Protocol Reverse Engineering
12.5%
Protocol Analysis and Reverse Engineering
Unknown Protocol AnalysisCustom Protocol DevelopmentMalware Protocol Analysis
- Demonstrate knowledge of tools and techniques required to analyze diverse protocols and data traversing a network environment
- Reverse engineer unknown or proprietary protocols
- Create custom tools for protocol analysis
6
Open Source Network Security Proxies
12.5%
Proxy Architecture and Analysis
Zeek (Bro) AnalysisHTTP Proxy AnalysisCommercial Proxy Solutions
- Understand architecture, deployment, benefits and weaknesses of network security proxies
- Analyze common log formats and data flows from proxy systems
- Extract forensic artifacts from proxy logs and systems
7
Security Event and Incident Logging
12.5%
Log Aggregation and Analysis
SOF-ELK PlatformDiverse Log FormatsLog Correlation and Analysis
- Demonstrate familiarity with diverse log formats, protocols and the security impact of event generating processes
- Deploy and configure logging aggregators effectively
- Correlate logs from multiple sources to reconstruct incidents
8
Wireless Network Analysis
12.5%
Wireless Forensics
802.11 Protocol AnalysisWireless Packet CaptureWireless Attack Detection
- Identify and control the risks associated with wireless technologies, protocols and infrastructure
- Capture and analyze wireless network traffic
- Detect and investigate wireless security incidents
How do I earn this certification?
Passing GNFA earns the GIAC Network Forensic Analyst certification. It sits in the Digital Forensics and Incident Response track.
Alternative Paths
- GDAT - GIAC Defending Advanced ThreatsAdvanced threat detection and response capabilities
- GRID - GIAC Response and Industrial Defense ICS/SCADA incident response specialization
- GCTI - GIAC Cyber Threat IntelligenceThreat intelligence analysis and application
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for GNFA is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2026
Updates
- Zeek (Bro) Network Security Monitor 6.x Core tool for network forensics and log analysis • Release date: 2025
- Arkime (formerly Moloch) 5.x Large-scale packet capture and analysis platform • Release date: 2025
- Wireshark 4.x Primary packet analysis tool with continuous protocol updates • Release date: 2024-2025
- SOF-ELK Latest SANS-maintained ELK distribution for security forensics • Release date: Ongoing updates
Who should take this exam?
This exam is typically taken by Incident response team members and Forensic analysts.
- Understanding of TCP/IP networking
- Experience with packet analysis tools
- Familiarity with network protocols
- Basic knowledge of network security concepts
- Recommended training: SANS FOR572