GCIA (GIAC Certified Intrusion Analyst)
Network and host monitoring, traffic analysis, and intrusion detection are the core of GCIA, including configuring IDS tools such as Snort and Zeek and interpreting packet captures and logs. GIAC aims it at intrusion detection practitioners, security analysts, and network engineers. The aligned SANS course is SEC503.
Exam Details
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
15 domains| Domain |
|---|
| Advanced IDS Concepts |
| Application Protocols |
| Concepts of TCP/IP and the Link Layer |
| Fragmentation |
| IDS Fundamentals and Network Architecture |
| Intrusion Detection System Rules |
| IP Headers |
| IPv6 |
| Network Forensics and Traffic Analysis |
| Packet Engineering |
| SiLK and Other Traffic Analysis Tools |
| TCP |
| Tcpdump Filters |
| UDP and ICMP |
| Wireshark Fundamentals |
DoD 8140 Work Roles
7 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GCIA as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Tools Covered by GCIA
Wireshark
Open SourceNetwork packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.
tcpdump
Open SourceCommand-line packet analyzer for capturing network traffic, applying BPF filters, and saving raw PCAP files for analysis.
Zeek
Open SourceNetwork security monitoring framework that translates raw packet traffic into structured transaction logs and network events.
Related Tool Categories
Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.
Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Frequently Asked Questions
What is the GCIA passing score?→
GIAC set the GCIA passing score at 67% for exam versions released on or after January 21, 2023. The exam has 106 questions over 4 hours.
Which tools does GCIA cover?→
The objectives include Wireshark, tcpdump filters, SiLK, and writing IDS rules, with Snort and Zeek named as covered open-source IDS platforms.
How much is the GCIA exam?→
A GCIA attempt is $999. Renewal every four years costs $499 plus 36 CPEs.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GCIA is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.