GIAC GCFA 認定試験の出題範囲:
| トピック | 出題範囲 |
|---|
| トピック 1 | - Introduction to Memory Forensics: Focuses on collecting volatile data and preserving its integrity for forensic investigations.
|
| トピック 2 | - Identification of Malicious System and User Activity: Covers detecting and documenting indicators of compromise, malware, attacker tools, and anti-forensic actions on memory and disk.
|
| トピック 3 | - File System Timeline Artifact Analysis: Focuses on understanding Windows filesystem timestamps and how user and system actions modify these artifacts.
|
| トピック 4 | - Analyzing Volatile Malicious Event Artifacts: Covers identifying malicious processes, suspicious drivers, and malware techniques like code injection and rootkits within Windows memory.
|
| トピック 5 | - Analyzing Volatile Windows Event Artifacts: Focuses on detecting normal Windows memory activity, including network connections, command line artifacts, processes, handles, and threads.
|
| トピック 6 | - Identification of Normal System and User Activity: Focuses on differentiating normal versus abnormal system and user behavior using memory and disk artifacts.
|
| トピック 7 | - Introduction to File System Timeline Forensics: Covers methods to collect and process timeline data from Windows systems for forensic analysis.
|
| トピック 8 | - NTFS Artifact Analysis: Covers analyzing Windows filesystem structures and recovering evidence from data, metadata, and filename layers.
|
| トピック 9 | - Enterprise Environment Incident Response: Covers incident response steps, attack progression, and rapid system assessment in enterprise environments using scalable tools.
|
参照:http://www.giac.org/certification/certified-forensic-analyst-gcfa
GIAC GCFA 試験概要:
| 認定ベンダー: | GIAC (SANS Institute) |
| 試験名: | GIAC Certified Forensic Analyst (GCFA) |
| 試験番号: | GCFA |
| 認定の有効期間: | 4年間 |
| 出題数: | 約82-115問 |
| 関連資格: | GIAC Network Forensic Analyst (GNFA) GIAC Certified Incident Handler (GCIH) GIAC Certified Forensic Examiner (GCFE) |
| 合格点: | 約72% |
| 試験時間: | 180-240 |
| 試験形式: | 選択式 |
| 対応言語: | 英語 |
| 受験料: | $999 USD(受験のみ、地域やパッケージにより異なります) |
| サンプル問題: | GIAC GCFA サンプル問題 |
| 受験方法: | オンライン監督付き試験(オープンブック、リモート監視) |
| 前提条件: | 正式な前提条件はありませんが、オペレーティングシステム、ネットワーク、基本的なインシデント対応に関する知識、またはGCIHやGCFEなどの事前のGIAC認定資格の保有が推奨されます。 |
| 公式シラバスのURL: | https://www.giac.org/certifications/certified-forensic-analyst-gcfa/ |