GIAC (SANS)

GIAC Certified Forensic Analyst

GCFA

The GIAC Certified Forensic Analyst (GCFA) certification validates your ability to collect and analyze data from computer systems to conduct formal incident investigations. It is designed for incident responders, threat hunters, and forensic analysts who must detect and eradicate advanced threats, including APTs and anti-forensic techniques. Earning GCFA proves you can handle complex digital forensic cases and serve as a vital line of defense for your organization.

Practice Free Questions

5Domains

10Objectives

86Practice pages

417Free questions

GCFA free practice questions

Choose any objective and open any question page — no sign-in required.

Enterprise Environment Incident Response

52 questions · 11 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–52

Introduction to Memory Forensics

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Analyzing Volatile Malicious Event Artifacts

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Analyzing Volatile Windows Event Artifacts

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Introduction to File System Timeline Forensics

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

File System Timeline Artifact Analysis

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

NTFS Artifact Analysis

58 questions · 12 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–58

Windows Artifact Analysis

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

Identification of Normal System and User Activity

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Identification of Malicious System and User Activity

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (10 objectives · 86 pages).

GIAC Certified Forensic Analyst

GCFA free practice questions

Domain 1 · Incident Response Fundamentals12% of practice bank · 1 objectives · 52 questions12%

Domain 2 · Memory Forensics29% of practice bank · 3 objectives · 121 questions29%

Domain 3 · File System Forensics31% of practice bank · 3 objectives · 128 questions31%

Domain 4 · Windows Artifact Analysis10% of practice bank · 1 objectives · 40 questions10%

Domain 5 · Activity Analysis18% of practice bank · 2 objectives · 76 questions18%