After completing the FOR572 course from SANS, I had an exam waiting for me.

GNFA, Network Forensic Analyst. The exam lasts at most 2 hours, contains 50 questions, and you need to pass with 60%. Which seems like a fairly low bar... the opposite is true. The exam is genuinely hard. Even though it's open book. The instructor recommended creating an index for the study materials; cheat sheets are also useful (tcp/ip, tcpdump, wireshark filters,...). None of that will get you the certification on its own though — there's still a significant percentage of questions where you need to show you actually know the stuff practically. I passed. I'm the 682nd holder of the GNFA worldwide. I can say I'm proud of myself.

Previous Post Next Post

Other Related Posts:

SANS certifikace GIAC

Certification Renewal

GMON and GNFA

Another four years gone and time to renew certifications… but since there's no budget, I'm faced with the choice of renewing out of pocket or just letting them lapse. Each certification costs $479. That's not nothing. What would I actually get out of it? I'd have active certification...

12th Jul 2024
SANS czechitas zoom

Online Teaching

The pandemic brought online learning to a much wider audience

Online learning is nothing new for me — I take courses from time to time. But during the crisis there was no alternative to online teaching, whether for school or continuing education. I got to experience it from both sides — as an inst...

15th May 2020