GCFAGIAC Certified Forensic Analyst (GCFA) practice exams
Original questions written from the published objectives and cited to official documentation, never recalled exam content. How we verify, why not dumps.
- Exam code
- GCFA
- Cost
- $999USD
- Questions
- 82questions
- Duration
- 180minutes
- Passing score
- 71percent
- Level
- Advanced
- Valid for
- 4years
- Study guide
- How to prepare
- Sources
- 128official pages
- Format
- 1proctored exam, web-based and required to be proctored, with remote proctoring through ProctorU or onsite proctoring through PearsonVUE
GCFA practice exams
2 full-length forms, 82 questions each, apportioned to the published domain weightings.
A memory capture from a live host shows unbacked executable pages inside a signed, running browser process. Which adversary behavior best explains that?
The answer
Code executing in the address space of another live process
Checked against
attack.mitre.org, checked August 2026Process injection is a method of executing arbitrary code in the address space of a separate live process.
What the exam tests
Exam domains
GIAC publishes the GCFA exam certification objectives as an unweighted list and does not publish percentages for them. The six groupings above and the percentages assigned to them are ours, built by combining GIAC's published objective titles. Treat them as a study aid for planning practice time, not as an official GIAC exam weighting.
The percentage is the exam weighting; the bar is how many verified questions we hold there, so a short bar is where our bank is thin.
- Enterprise Incident Response15%24 verified
- Memory Forensics10%16 verified
- Volatile Windows Artifacts and Malware Analysis20%34 verified
- File System Timeline Forensics20%34 verified
- NTFS and Windows Artifact Analysis20%32 verified
- Normal and Malicious Activity Identification15%24 verified
Where to focus: The published GCFA objectives spend as much attention on normal Windows behavior as on malicious behavior, so build a baseline first: know what ordinary processes, handles, prefetch entries, and NTFS timestamps look like before you try to spot the outliers. Because the objectives are written as things you demonstrate rather than facts you recall, practice narrating the evidence chain from a raw artifact to a conclusion, not just naming the tool that reads it.
What the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCFA certification details ↗
Between sittings
The same bank the numbered forms are assembled from.
Quick Practice
Open now
All 164 verified questions, untimed, with the explanation after each answer.
Domain Drill
Open now
Every domain on its own, for the area a score report says is weakest.
Review Missed
Fills as you go
Re-asks the questions you got wrong. Nothing to review until you miss something.
GIAC’s free resources
Study from the source. The page below is free to read, and it is what our own questions are written from.
Official GCFA exam page & objectives ↗Keep reading
- Free GCFA practice test
10 original questions, playable now. No account, no card.
- GCFA exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GCFA passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCFA?
An honest difficulty read from the format, the clock and the weights.
- What GCFA costs
The voucher price, the retake, and what renewal costs across the cycle.
- GCFA guide
Who it is for, study plans by experience level, and whether it is worth it.
Frequently asked questions
How much does the GCFA exam cost?
GIAC's pricing page lists the GCFA certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, certification renewal at $499, and a practice exam at $399. GIAC notes that all prices are shown in USD and exclude applicable sales tax, and that it can change pricing at any time.
How many questions are on the GCFA, and what score do I need?
GIAC publishes the GCFA format as 1 proctored exam, 82 questions, 3 hours, with a minimum passing score of 71%. GIAC adds that the 71% score was set through a psychometric standard-setting study and applies to candidates who receive the exam version released on or after March 18th, 2023, and it points candidates to the Certification Information section of their GIAC account to confirm the format and passing score for their own attempt.
Is the GCFA hands-on?
GIAC tags the GCFA certification page with CyberLive and lists the GCFA on its CyberLive page. GIAC describes CyberLive as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools, and authentic code.
How long does a GCFA stay active, and how do I renew it?
GIAC answers that a certification is active for four years and that GIAC certifications require renewal every four years, with registration enabled at the 2-year mark before the expiration date. GIAC recommends the CPE option, collecting 36 credits over four years, and states that renewing adds 4 years to the current expiration date and that the maintenance fee is a non-refundable $499 payment.