Certification guide
GCIAGIAC Certified Intrusion Analyst (GCIA): the honest guide
Everything GIAC publishes about GCIA, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from GCIA’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
See everything published on GCIAWhat the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 106 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCIA certification details ↗
Domain breakdown
Traffic Analysis Tools is the heaviest domain at 20 percent, followed by Intrusion Detection Systems at 19 percent.
GIAC publishes the GCIA objectives as an unweighted list of outcome statements covering TCP/IP and the link layer, IP headers, fragmentation, IPv6, UDP and ICMP, application protocols, tcpdump filters, Wireshark, SiLK, packet engineering, IDS fundamentals and rules, advanced IDS concepts, and network forensics. It attaches no percentages. The six groupings above and their percentages are ours, built by clustering GIAC's published objective titles so the material can be studied in blocks. They are a study aid, not an official GIAC weighting, and GIAC does not endorse them.
- Concepts of TCP/IP and the Link Layer18%
- IP Headers, Fragmentation, and IPv616%
- UDP, ICMP, and Application Protocols15%
- Traffic Analysis Tools20%
- Intrusion Detection Systems19%
- Network Forensics and Traffic Analysis12%
Where to focus: GIAC allows 4 hours for 106 questions on GCIA, so read packets faster than you read notes: the exam rewards recognising a protocol anomaly in a capture more than reciting a header layout. Practice in tcpdump and Wireshark against real traffic rather than only reading about the fields.
What comes after passing
GCIA is valid for 4 years. GIAC certifications last four years. GIAC lists two renewal routes: collect 36 CPE credits over the four year cycle and pay the renewal fee, or retake the current exam. Additional renewals within two years of a full price renewal are charged at a reduced rate.
Costs across the full renewal cycle are on the GCIA cost page.
Frequently asked questions
What does the GCIA exam cost?
GIAC's pricing page lists a GIAC certification attempt at $999. The certification attempt can be bought on its own, without a training course.
Is the GCIA exam hands-on?
GIAC tags GCIA as a CyberLive certification. GIAC describes CyberLive as a hands-on format that replaces multiple choice with performance-based challenges in lab environments using virtual machines and real tools. The exam format section lists 1 proctored exam, 106 questions, 4 hours, and a minimum passing score of 67%.
Are there prerequisites for GCIA?
GIAC's GCIA page lists no prerequisite. Under How To Prepare it points to training in a variety of modalities, practical work experience, and college level courses or self study.
Keep reading
- GCIA exam overview
The format, the domain weights and the renewal terms, sourced line by line.
- GCIA passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCIA?
An honest difficulty read from the format, the clock and the weights.