Certification guide
GCFAGIAC Certified Forensic Analyst (GCFA): the honest guide
Everything GIAC publishes about GCFA, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from GCFA’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
Practise GCFA questions in the meantimeWhat the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCFA certification details ↗
Domain breakdown
Volatile Windows Artifacts and Malware Analysis is the heaviest domain at 20 percent, followed by File System Timeline Forensics at 20 percent.
GIAC publishes the GCFA exam certification objectives as an unweighted list and does not publish percentages for them. The six groupings above and the percentages assigned to them are ours, built by combining GIAC's published objective titles. Treat them as a study aid for planning practice time, not as an official GIAC exam weighting.
- Enterprise Incident Response15%
- Memory Forensics10%
- Volatile Windows Artifacts and Malware Analysis20%
- File System Timeline Forensics20%
- NTFS and Windows Artifact Analysis20%
- Normal and Malicious Activity Identification15%
Where to focus: The published GCFA objectives spend as much attention on normal Windows behavior as on malicious behavior, so build a baseline first: know what ordinary processes, handles, prefetch entries, and NTFS timestamps look like before you try to spot the outliers. Because the objectives are written as things you demonstrate rather than facts you recall, practice narrating the evidence chain from a raw artifact to a conclusion, not just naming the tool that reads it.
What comes after passing
GCFA is valid for 4 years. GIAC states a certification is active for four years and requires renewal every four years, with renewal registration enabled at the 2-year mark before the expiration date. Renewing adds 4 years to the current expiration date rather than to the date of renewal. The CPE route asks for 36 credits over four years, and GIAC lists the certification maintenance fee as a non-refundable $499 payment due once every four years at the time of registration.
Costs across the full renewal cycle are on the GCFA cost page.
Frequently asked questions
How much does the GCFA exam cost?
GIAC's pricing page lists the GCFA certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, certification renewal at $499, and a practice exam at $399. GIAC notes that all prices are shown in USD and exclude applicable sales tax, and that it can change pricing at any time.
How many questions are on the GCFA, and what score do I need?
GIAC publishes the GCFA format as 1 proctored exam, 82 questions, 3 hours, with a minimum passing score of 71%. GIAC adds that the 71% score was set through a psychometric standard-setting study and applies to candidates who receive the exam version released on or after March 18th, 2023, and it points candidates to the Certification Information section of their GIAC account to confirm the format and passing score for their own attempt.
Is the GCFA hands-on?
GIAC tags the GCFA certification page with CyberLive and lists the GCFA on its CyberLive page. GIAC describes CyberLive as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments, using virtual machines, real security tools, and authentic code.
How long does a GCFA stay active, and how do I renew it?
GIAC answers that a certification is active for four years and that GIAC certifications require renewal every four years, with registration enabled at the 2-year mark before the expiration date. GIAC recommends the CPE option, collecting 36 credits over four years, and states that renewing adds 4 years to the current expiration date and that the maintenance fee is a non-refundable $499 payment.
Keep reading
GCFA practice questions
Free sample questions with the full explanation on every answer.
Free GCFA practice test
Ten real questions, playable now. No account, no card.
GCFA passing score
The exact cut score, what kind of number it is, and the retake terms.
How hard is GCFA?
An honest difficulty read from the format, the clock and the weights.
Practise GCFA for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free GCFA questions