GIAC GCFA 考試概覽:

認證廠商:	GIAC (Global Information Assurance Certification)
考試名稱:	GIAC 認證數位鑑識分析師（GCFA）
考試代碼:	GCFA
證照有效期限:	4 年
實際考試題數:	82
考試費用:	$999 USD
及格分數:	71%
支援語言:	English
考試時間:	180 分鐘
考試形式:	全程監考, 選擇題, CyberLive 實作題型, 開放參考資料
相關認證:	GCFR GCIH GCFE
推薦課程:	SANS FOR508：進階事件回應、威脅狩獵與數位鑑識
考試報名:	GIAC 官方報名 Pearson VUE 考場預約
範例考題:	GIAC GCFA 範例考題
考試方式:	網路監考測驗；可透過 ProctorU 遠端應考，或至 Pearson VUE 實體考場應考
必備條件:	無強制報名條件；建議具備數位鑑識、事件回應相關經驗，或完成 SANS FOR508 課程訓練
官方大綱網址:	https://www.giac.org/certifications/certified-forensic-analyst-gcfa

GIAC GCFA 考試大綱：

主題	簡介
主題 1	Enterprise Environment Incident Response: Covers incident response steps, attack progression, and rapid system assessment in enterprise environments using scalable tools.
主題 2	Analyzing Volatile Malicious Event Artifacts: Covers identifying malicious processes, suspicious drivers, and malware techniques like code injection and rootkits within Windows memory.
主題 3	Identification of Normal System and User Activity: Focuses on differentiating normal versus abnormal system and user behavior using memory and disk artifacts.
主題 4	File System Timeline Artifact Analysis: Focuses on understanding Windows filesystem timestamps and how user and system actions modify these artifacts.
主題 5	Windows Artifact Analysis: Focuses on collecting and analyzing Windows system artifacts including backups, restores, and application execution evidence.
主題 6	Analyzing Volatile Windows Event Artifacts: Focuses on detecting normal Windows memory activity, including network connections, command line artifacts, processes, handles, and threads.
主題 7	Identification of Malicious System and User Activity: Covers detecting and documenting indicators of compromise, malware, attacker tools, and anti-forensic actions on memory and disk.
主題 8	NTFS Artifact Analysis: Covers analyzing Windows filesystem structures and recovering evidence from data, metadata, and filename layers.