GNFA Exam Review: Cert for a Real Network Forensic Analyst

Hello everyone, it's Chicken0248 with my fourth certification from GIAC: the GIAC Network Forensic Analyst (GNFA). Taking it after GCIA was the right call for me. Plenty of people would say that if you want both, GNFA should come first and GCIA second, because GCIA makes you go much deeper into each protocol.

Just like every GIAC cert before it, I took this one without the formal FOR572 course. It made me doubt myself again and again, convinced I would never be ready, but the show must go on.

I pulled it off. How? Let's find out in the next section.

Before taking any exam, we need to know the exam objectives first, right?

The GIAC Network Forensic Analyst (GNFA) certification validates a practitioner's ability to perform advanced analysis of network forensic artifacts. GNFA certification holders are qualified to process and interpret normal and abnormal network activity, and to analyze application activity through system logs, network traffic captures, and network metadata.

That is how the official GNFA exam page describes it. It tells us network forensics is not only about pcaps. It also covers system logs and network metadata, so you need to be able to spot something off in any of those evidence types.

The objectives and outcome statements list 8 areas: common network protocols (I won't reveal which ones show up), encryption and encoding, NetFlow (that's where the network metadata comes in), network architecture, network protocol reverse engineering, open source network security proxies, security event and incident logging, and wireless network analysis.

Architecture is not my thing, so that was a weak area. Protocol reverse engineering sounded advanced and I had no idea what it involved. Wireless is where I'm weakest of all.

Knowing the objectives still doesn't tell us how to prepare, because the page mentions no methodology, protocols, or tools. So we look at the training the exam is based on: FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response.

The course page has plenty of clues about what could appear in the exam. The overview tells us what the instructor teaches, and the full topic details give a big hint: the Web Server Proxy topic means you have to study the Squid proxy server, its configuration, its logging, and cache extraction.

The course also splits network evidence into 3 core types: capture (likely pcap), logs, and NetFlow. It covers how to collect them from switches, taps, network packet brokers, and so on. To keep this post from bloating, here is the list I pulled from that page of what you will have to learn.

Tools

• Wireshark and tshark
• SOF-ELK (Elastic Stack)
• Zeek
• jq
• nfcapd, nfpcapd, and nfdump (nfdump is the main one)
• NetworkMiner
• Arkime (Moloch)

Protocols

• HTTP (all versions, including web server logs)
• DNS (the course also mentions DNS attacks such as fast flux and DGA)
• FTP (extracting files from a pcap is a must, I'd guess)
• SMB (same here)
• SMTP
• SSL/TLS

Now the main problem. I heard the labs in this course are massive and that students get the most out of the course by playing them, but I have no way to get them. You have to enroll to get the labs.

So what did I do after reading the outline? I thought hard about it, because I'm working full time while building a tool for my job, drafting a strategy to improve my organization's cyber resilience and its threat hunting and digital forensics capability, and squeezing in some personal research. And of course using some days off to watch series and read novels and manga.

I copied the whole course outline into a text file and had Claude research every topic in it, then build 5 cheat sheets. The course has 6 sections, but the last is the capstone challenge. It did its job. All I needed now was to buy the practice test, to see what the cheat sheets were missing and to practice finding the right topic quickly.

For financial reasons I couldn't afford the practice test, so I crossed my fingers and bought the exam voucher after painfully going through every topic in the cheat sheets. ChatGPT helped a lot by breaking complex topics into pieces and giving clear examples. I've been using it that way since GCIA.

But the more I went through each section, the more underprepared I felt. I'm not sure why. Maybe because network is not my thing, or because I had no official material, or no lab to practice on. Maybe because I paid for the voucher out of my own pocket and didn't want to waste it on a retake. Probably all of them. The show must go on.

To fight the underprepared feeling, I scheduled the exam to give myself a deadline. No matter how unready I felt, there was no way back. On the day, I booked my ride and went.

The GNFA exam has 66 questions to finish in 3 hours. The last 11 are CyberLive, where you use their VM to investigate the given evidence and find the answers. I had learned my lesson from earlier GIAC attempts and brought water into the exam room, because my throat keeps drying out.

In the room I hit many questions my cheat sheet couldn't answer, because it simply didn't cover them. My confidence kept dropping as the questions went by, since I was guessing on probability and on what should be possible in the gaps. Experience helped, but the doubt stayed. If you can't figure out an answer, or suspect it will take a while or will surface once you work through other questions, you can skip it. I don't remember how many I skipped, but it was a bunch.

Then came the CyberLive part, and this is where it got fun. Some tools were new to me, but I could read the manual and get the gist. I got an answer for every CyberLive question, then paid back the karma for skipping questions by going back and yolo-ing them, knowing I might fail. I finished the whole exam in 90 minutes.

It turned out I passed, with 90% and a perfect score on CyberLive. I knew wireless and network architecture were my weak areas, and CyberLive clearly carried me there. Then reality hit: even where my guesses were right, I don't know why they were correct. That's the cost of not affording the official SANS material. AI can help you prepare a cheat sheet to bring into the exam center, but it can't know the course in detail either, so be aware there is a gap (or a huge one) that you will have to cover with your own experience.

This is how I felt after seeing the result. :D

GNFA should be a good exam once you have properly gone through the formal FOR572 course from SANS. I don't recommend taking it without the official material. I tried, and I'm sure I would have benefited greatly from it.

The exam goes deep into network forensics. You need to know what is normal and what is odd for each protocol it covers, how to acquire network evidence, how wireless networks work, and so on. It suits people who want to do network forensics better than GCIA does, since GCIA digs into each protocol's specification. In the end the two complement each other for network intrusion analysis, incident response, and threat hunting.