For more info visit:
Reference: http://www.giac.org/certification/certified-forensic-analyst-gcfa
GIAC GCFA Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Windows Artifact Analysis | - The candidate will demonstrate an understanding of Windows system artifacts and how to collect and analyze data such as system back up and restore data and evidence of application execution. |
| Identification of Malicious System and User Activity | - The candidate will demonstrate an understanding of the techniques required to identify and document indicators of compromise on a system, detect malware and attacker tools, attribute activity to events and accounts, and identify and compensate for anti-forensic actions using memory and disk resident artifacts. |
| Enterprise Environment Incident Response | - The candidate will demonstrate an understanding of the steps of the incident response process, attack progression, and adversary fundamentals and how to rapidly assess and analyze systems in an enterprise environment scaling tools to meet the demands of large investigations. |
| NTFS Artifact Analysis | - The candidate will demonstrate an understanding of core structures of the Windows filesystems, and the ability to identify, recover, and analyze evidence from any file system layer, including the data storage layer, metadata layer, and filename layer. |
| Introduction to File System Timeline Forensics | - The candidate will demonstrate an understanding of the methodology required to collect and process timeline data from a Windows system. |
| Introduction to Volatile Data Forensics | - The candidate will demonstrate an understanding of how and when to collect volatile data from a system and how to document and preserve the integrity of volatile evidence. |
| File System Timeline Artifact Analysis | - The candidate will demonstrate an understanding of the Windows filesystem time structure and how these artifacts are modified by system and user activity. |
| Volatile Data Artifact Analysis of Malicious Events | - The candidate will demonstrate an understanding of abnormal activity within the structure of Windows memory and be able to identify artifacts such as malicious processes, suspicious drivers and malware techniques such as code injection and rootkits. |
| Volatile Data Artifact Analysis of Windows Events | - The candidate will demonstrate an understanding of abnormal activity within the structure of Windows memory and be able to identify artifacts such as malicious processes, suspicious drivers and malware techniques such as code injection and rootkits. |
| Identification of Normal System and User Activity | - The candidate will demonstrate an understanding of the techniques required to identify, document, and differentiate normal and abnormal system and user activity using memory and disk resident artifacts. |
GCFA Certified Professional Salary
- England: £72221
- Europe:€84754
- United States:$94k
- India:₹ 667810
Introduction to GCFA Exam
The Global Information Assurance Certification Forensic Analyst (GCFA) certifies that applicants have the knowledge, skills, and abilities to conduct formal incident investigations and manage advanced incident management scenarios, including internal and external data breach intrusions, advanced persistent threats, forensic techniques used by attackers. and complex digital court cases. The GCFA certification focuses on the basic skills needed to collect and analyze data from Windows and Linux computer systems.
988 Customer Reviews
Quality and ValueITCertKing Practice Exams are written to the highest standards of technical accuracy, using only certified subject matter experts and published authors for development - no all study materials.
Tested and ApprovedWe are committed to the process of vendor and third party approvals. We believe professionals and executives alike deserve the confidence of quality coverage these authorizations provide.
Easy to PassIf you prepare for the exams using our ITCertKing testing engine, It is easy to succeed for all certifications in the first attempt. You don't have to deal with all dumps or any free torrent / rapidshare all stuff.
Try Before BuyITCertKing offers free demo of each product. You can check out the interface, question quality and usability of our practice exams before you decide to buy.
