GIAC logoGCFA

GIAC Certified Forensic Analyst (GCFA) practice exams

Original questions written from the published objectives and cited to official documentation, never recalled exam content. How we verify, why not dumps.

Exam code
GCFA
Cost
$999USD
Questions
82questions
Duration
180minutes
Passing score
71percent
Level
Advanced
Valid for
4years
Study guide
How to prepare
Sources
128official pages
Format
1proctored exam, web-based and required to be proctored, with remote proctoring through ProctorU or onsite proctoring through PearsonVUE

GCFA practice exams

2 full-length forms, 82 questions each, apportioned to the published domain weightings.

What the exam tests

Exam domains

GIAC publishes the GCFA exam certification objectives as an unweighted list and does not publish percentages for them. The six groupings above and the percentages assigned to them are ours, built by combining GIAC's published objective titles. Treat them as a study aid for planning practice time, not as an official GIAC exam weighting.

The percentage is the exam weighting; the bar is how many verified questions we hold there, so a short bar is where our bank is thin.

6domains
  • Enterprise Incident Response15%
    24 verified
  • Memory Forensics10%
    16 verified
  • Volatile Windows Artifacts and Malware Analysis20%
    34 verified
  • File System Timeline Forensics20%
    34 verified
  • NTFS and Windows Artifact Analysis20%
    32 verified
  • Normal and Malicious Activity Identification15%
    24 verified

Where to focus: The published GCFA objectives spend as much attention on normal Windows behavior as on malicious behavior, so build a baseline first: know what ordinary processes, handles, prefetch entries, and NTFS timestamps look like before you try to spot the outliers. Because the objectives are written as things you demonstrate rather than facts you recall, practice narrating the evidence chain from a raw artifact to a conclusion, not just naming the tool that reads it.

What the exam actually asks you to do

A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.

Item formats

  • Multiple choice
  • Hands-on lab

The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCFA certification details

Between sittings

The same bank the numbered forms are assembled from.

  • Open now

    Quick Practice

    All 164 verified questions, untimed, with the explanation after each answer.

  • Open now

    Domain Drill

    Every domain on its own, for the area a score report says is weakest.

  • Fills as you go

    Review Missed

    Re-asks the questions you got wrong. Nothing to review until you miss something.

Open GCFA practice

GIAC’s free resources

Study from the source. Everything below is published by the vendor, free to read, and is what our own questions are written from:

Official GCFA exam page & objectives ↗

Keep reading

Every guide and cost breakdown, by vendor

Frequently asked questions

How much does the GCFA exam cost?

GIAC's pricing page lists the GCFA certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, certification renewal at $499, and a practice exam at $399. GIAC notes that all prices are shown in USD and exclude applicable sales tax, and that it can change pricing at any time.

How many questions are on the GCFA, and what score do I need?

GIAC publishes the GCFA format as 1 proctored exam, 82 questions, 3 hours, with a minimum passing score of 71%. GIAC adds that the 71% score was set through a psychometric standard-setting study and applies to candidates who receive the exam version released on or after March 18th, 2023, and it points candidates to the Certification Information section of their GIAC account to confirm the format and passing score for their own attempt.

Is the GCFA hands-on?

GIAC tags the GCFA certification page with CyberLive and lists the GCFA on its CyberLive page. GIAC describes CyberLive as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools, and authentic code.

How long does a GCFA stay active, and how do I renew it?

GIAC answers that a certification is active for four years and that GIAC certifications require renewal every four years, with registration enabled at the 2-year mark before the expiration date. GIAC recommends the CPE option, collecting 36 credits over four years, and states that renewing adds 4 years to the current expiration date and that the maintenance fee is a non-refundable $499 payment.

Ready to practice for GCFA?

Five questions from across every practice exam, plus 10 questions per certification in bank practice, with no account. Full explanations on every single one.