- The TCP/IP model
- Link layer operations
GIAC Certification Training Course
GIAC Certified Intrusion Analyst (GCIA) Certification Training Course
Prepare for the GIAC Certified Intrusion Analyst (GCIA) exam by learning to read traffic at the packet level, write IDS rules and find the attack in the noise.
Course focus: TCP/IP and the link layer, IP, TCP, UDP, ICMP and IPv6, fragmentation, tcpdump and Wireshark, application protocols, IDS architecture, rules and tuning, packet engineering and network forensics, aligned with GIAC's published GCIA objectives.
Course Overview
What the GCIA course covers and who it's for.
Accumentum's GCIA prep course is for SOC analysts, intrusion detection staff and network engineers who watch traffic for a living. GIAC says GCIA validates knowledge of network and host monitoring, traffic analysis and intrusion detection, including configuring and monitoring IDS and reading network traffic.
The course follows GIAC's published GCIA objectives. You'll dissect TCP/IP, IP headers, TCP, UDP, ICMP and IPv6, work with tcpdump filters and Wireshark, write and tune Snort and Zeek style IDS rules, and analyze packet capture, flow and log data with tools like SiLK. GCIA includes CyberLive hands-on questions, so you'll spend real time in packet captures.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GCIA the way the exam actually tests.
01
Cover Every GCIA Objective
Work through each certification objective GIAC publishes for GCIA, in an order that builds on itself.
02
Practice Hands-On
GCIA includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GCIA is 106 questions in 4 hours with a minimum passing score of 67%, per GIAC. We pace practice to match.
Who Should Attend
- SOC analysts and intrusion detection staff.
- Network engineers and administrators.
- System and security analysts.
- Hands-on security managers who review alerts.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIA.
- You should be solid on networking. Network+, Security+ or GSEC level knowledge helps.
Pathway Map
The GCIA course in 8 modules.
Each module maps to one or more of GIAC's published GCIA certification objectives.
Course Content
- Dissecting IP headers for normal and odd values
- Fragmentation and fragmentation attacks
- How IPv6 differs from IPv4
- Typical and anomalous behavior for each protocol
- Writing tcpdump filters
- Analyzing normal and malicious traffic in Wireshark
- Dissecting and analyzing application layer protocols
- IDS placement and architecture options
- Strengths and weaknesses of common IDS tools
- Writing rules that catch real malicious activity
- Tuning and correlation
- Packet crafting and manipulation
- SiLK and other flow tools
- Pulling together packet capture, netflow and logs
Course Features
Built for the hands-on side of GCIA.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GCIA isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GCIA certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GCIA exam.
GCIA Exam Readiness
Every objective GIAC publishes for GCIA has a lesson and a lab in our course, so you know exactly what you've covered before you book.
Per GIAC, the GCIA exam is one proctored exam with 106 questions, a 4 hours time limit and a minimum passing score of 67%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GCIA page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Certification Objectives
What GIAC expects you to know for GIAC GCIA.
GIAC publishes 15 certification objectives for GCIA. Each one below uses GIAC's own wording, and our course maps a lesson or lab to every one of them.
Advanced IDS Concepts
The candidate will demonstrate an understanding of IDS tuning methods and correlation issues.
Application Protocols
The candidate will demonstrate knowledge and skill relating to application layer protocol dissection and analysis.
Concepts of TCP/IP and the Link Layer
The candidate will demonstrate understanding of the TCP/IP communications model and link layer operations.
Fragmentation
The candidate will demonstrate understanding of how fragmentation works, and how to identify fragmentation and fragmentation-based attacks in packet captures.
IDS Fundamentals and Network Architecture
The candidate will demonstrate knowledge of fundamental IDS concepts, such as network architecture options and benefits/weaknesses of common IDS systems.
Intrusion Detection System Rules
The candidate will create effective IDS rules to detect varied types of malicious activity.
IP Headers
The candidate will demonstrate the ability to dissect IP packet headers and analyze them for normal and anomalous values that may point to security issues.
IPv6
The candidate will demonstrate knowledge of IPv6 and how it differs from IPv4.
Network Forensics and Traffic Analysis
The candidate will demonstrate competence in analyzing data from multiple sources (for example full packet capture, netflow, log files) to identify normal and malicious behaviors.
Packet Engineering
The candidate will demonstrate knowledge relating to packet crafting and manipulation.
SiLK and Other Traffic Analysis Tools
The candidate will demonstrate an understanding of SiLK and other tools to perform network traffic and flow analysis.
TCP
The candidate will demonstrate understanding of the TCP protocol and the ability to discern between typical and anomalous behavior.
Tcpdump Filters
The candidate will demonstrate ability to craft tcpdump filters that match on given criteria.
UDP and ICMP
The candidate will demonstrate understanding of the UDP and ICMP protocols and the ability to discern between typical and anomalous behavior.
Wireshark Fundamentals
The candidate will demonstrate ability to use Wireshark to analyze typical and malicious network traffic.
Study Plan
A practical path to GIAC GCIA.
GIAC lists the GCIA objectives alphabetically, not in study order. We teach them in an order that builds, starting with the fundamentals and working up to the topics that lean on them, and every block ends with labs before you move on.
Save a review week for the two or three objectives you found hardest. For many students that is IPv6 or Wireshark Fundamentals, but your lab results will tell you.
If you are new to GCIA topics, plan on steady weekly study over a couple of months. If you already do this work every day, you may move faster. Either way, the objective list is the checklist we hold you to.
Areas and Audience
Where GIAC GCIA fits.
Areas GIAC says this certification covers
- Fundamentals of Traffic Analysis and Application Protocols
- Open-Source Intrusion Detection Systems (IDS): Snort and Zeek
- Network Traffic Forensics and Monitoring
Who GIAC says it is for
- Practitioners responsible for intrusion detection
- System analysts
- Security analysts
- Network engineers and administrators
- Network Administrators
- Hands-on security managers
Exam Format
How the GIAC GCIA exam works.
The GIAC GCIA exam is one proctored exam with 106 questions and a 4 hours time limit. GIAC sets the minimum passing score at 67%.
GIAC lets you sit the exam online through ProctorU or at a Pearson VUE testing center.
GCIA includes CyberLive hands-on questions, which GIAC describes as performance based challenges in realistic lab environments. That is why our course leans so hard on labs.
Our advice is simple. Work the objectives in order, do every lab, then take a practice test about two weeks out and spend the last stretch on whatever objectives it flags.
Career Outlook
Where GIAC GCIA can take you.
GCIA matches intrusion analyst, network security monitoring and SOC tier two roles. It proves you can read packets, tune Snort and Zeek, and pull the story of an attack out of raw network traffic.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for GIAC GCIA training.
GIAC GCIA is Air Force COOL Approved. See how Air Force COOL works with us.
Paying on your own? GIAC GCIA prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page covers every other way to pay, and you can always talk with us before you enroll.
Frequently Asked Questions
Common questions about Accumentum's GCIA prep course.
GIAC Certified Intrusion Analyst (GCIA) is a practitioner certification from GIAC. Per GIAC, the exam is 106 questions, 4 hours, with a minimum passing score of 67%, and it's proctored online through ProctorU or at a Pearson VUE center.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GCIA is Air Force COOL Approved. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCIA. You should be solid on networking. Network+, Security+ or GSEC level knowledge helps.
Yes. GCIA includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
GIAC sets the minimum passing score for GCIA at 67%.
The exam has 106 questions and a 4 hours time limit.
GIAC publishes 15 certification objectives for GCIA, and our course covers all of them.
GIAC names these audiences for GCIA:
- Practitioners responsible for intrusion detection
- System analysts
- Security analysts
- Network engineers and administrators
- Network Administrators
- Hands-on security managers
Yes. GIAC offers remote proctoring through ProctorU, and you can also test in person at a Pearson VUE center.
Yes. GIAC sells official practice tests. GIAC notes the practice question bank is limited, so the same question can show up on more than one test.
Yes. GIAC GCIA prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in GCIA training with Accumentum.
Enroll in Accumentum's GCIA prep course to get ready for the GIAC Certified Intrusion Analyst (GCIA) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GCIA?
Start on your own schedule and work toward the test date you pick.