Overview
GCFA: Certified Forensic Analyst is a GIAC credential. Prep for GIAC GCFA. Enterprise incident response, memory forensics, timeline analysis, NTFS artifacts and threat hunting. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the GIAC exam. GIAC sets exam content, fees, and policies.
Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the GIAC exam. GIAC sets exam content, fees, and policies.
Who it is for
- Incident response team members and threat hunters.
- SOC analysts moving into investigation work.
- Experienced digital forensic analysts and CHFI holders who want an advanced credential.
Exam domains
Weights follow the official outline.
- 01
Enterprise Incident Response
Incident response steps, attack progression and adversary basics, and Scaling triage and analysis across a large environment.
- 02
Introduction to Memory Forensics
When and how to collect volatile data, and Documenting and preserving memory evidence.
- 03
Normal Windows Memory Activity
Network connections, command line artifacts, processes, handles and threads.
- 04
Malicious Memory Artifacts
Malicious processes and suspicious drivers, and Code injection and rootkits.
- 05
Normal and Malicious System and User Activity
Separating normal from abnormal activity on disk and in memory, and Indicators of compromise, attacker tools and anti-forensics.
- 06
File System Timeline Forensics
Collecting and processing Windows timeline data, and How system and user activity changes timestamps.
- 07
NTFS Artifact Analysis
Data, metadata and filename layers, and Recovering and analyzing evidence at each layer.
- 08
Windows Artifact Analysis
Backup and restore data, and Evidence of program execution.
Exam format and cost
- Questions
- 82
- Duration
- Confirm on the vendor site
- Format
- Confirm question format on the vendor outline
- Passing score
- 71
- Cost
- Confirm the current exam fee on the vendor site before you register
- Delivery
- Vendor-approved test center or online proctoring (confirm on the vendor site)
- Languages
- Confirm available languages on the vendor site
Experience and eligibility
There are no enrollment prerequisites and GIAC doesn't require any to sit GCFA. This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
Renewal
Renewal rules for GCFA: Certified Forensic Analyst are set by GIAC. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.
Roles this credential fits
- Enterprise incident response, memory forensics, normal versus malicious system activity, file system timelines, NTFS and Windows artifact analysis and anti-forensics detection, aligned with GIAC's published GCFA objectives.
- Forensics
- Teams standardizing on this credential for hiring or compliance
GCFA questions
Is GCFA worth it?
GCFA is worth it when employers or contracts in your market ask for GIAC proof, or when the domains match work you already do or want next. Common roles include Enterprise incident response, memory forensics, normal versus malicious system activity, file system timelines, NTFS and Windows artifact analysis and anti-forensics detection, aligned with GIAC's published GCFA objectives., Forensics, and Teams standardizing on this credential for hiring or compliance. Read the roles and domains on this page, then decide against your timeline and budget.
How hard is GCFA?
You get 82 questions in Confirm on the vendor site. Format: Confirm question format on the vendor outline. Passing score: 71. There are no enrollment prerequisites and GIAC doesn't require any to sit GCFA. People who pass usually mix domain study with timed practice, not reading alone.
Does GCFA expire?
Renewal rules for GCFA: Certified Forensic Analyst are set by GIAC. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.
How does Accumentum help with GCFA?
We offer Expert-led training mapped to the GCFA domains, PathPay® payment options, PathPass™ practice where the exam is in our catalog, and military funding support where you qualify. We are an Army CA and Air Force COOL Approved Vendor. Our pass rate across Accumentum certification attempts since August 2022 is 98.8% (2,412 certified of about 2,441 attempts).
How much does the GCFA exam cost?
Published pricing for GCFA: Confirm the current exam fee on the vendor site before you register. Vendors change voucher prices without notice, so confirm on the official store before you buy. PathPay® can spread Accumentum course tuition when you train with us.
What are the GCFA prerequisites?
There are no enrollment prerequisites and GIAC doesn't require any to sit GCFA. This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
What should I take after GCFA?
After GCFA, pick the next credential that matches the job you want, not a generic ladder. Use the roles on this page and neighboring PathKey™ guides from the same vendor to plan the sequence. If you need a readiness check first, start with ReadyScore™ when we offer one for this exam.
Official sources
Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.