Passed GNFA

Scored 80% in the exam. This has to be the toughest SANS paper I've ever taken. I actually failed both practise exams scoring 52 and 56.

I studied for around 3 weeks straight doing the labs once and reading the books twice. GNFA is only SANS paper so far where I did not get much answers from the books. There were several scenario based questions and understanding tcpdump, iptables, Wireshark and BPFs are essential.

Having said that, don't be discouraged if you failed the practise exams. Having the wrong answers turned out to be a blessing in disguise as you learn from the answers given and its explanation. Tough exam but am grateful I managed to pass.

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

waykin

Hey Yomista congrats, I scored the same and passed the exam this week as well. I was uneasy about the final score and also had like 8 seconds left to answer the last question. I felt the exam to be difficult and I could barely reference my index or books. My side of the questions were situational and it did heavily rely on knowing command line utilities and the correct switches to use. There were some questions that came from left field as well, I just used my best judgment on those. At the end I felt accomplished and proud to have gotten through it. I'm looking at the GPEN or GREM next.

yomista

Congrats to you too waykin! It's nice to see a fellow GNFA alumni. I don't see alot of people who's taken this SANS course. My exact sentiments on the exam and best judgement worked well for me. GREM is pretty tough so I've heard. I had a colleague who flunked GPEN twice but another colleague scored pretty high on it. I'll bet you do well on either so all the best!

As for me, I'm interested in GCTI but seems like it's not a popular course...

trueshrewkmc

I think GCTI is fairly new----late 2016 or early 2017. The exam doesn't come out until late December 2017.

TechGuru80

yomista wrote: »

I studied for around 3 weeks straight doing the labs once and reading the books twice.

Honestly if 3 weeks is all you really spent, I wouldn’t have felt that bad if you didn’t pass since that isn’t what I would call a “strenuous” study routine.

al88

Congrats!

And i agree to both, it was one of the toughest exams i took and that I didn't depend on the books (or index for that matter) much for answers .. mostly was on experience and scenarios that were discussed on the book or lecture.

So be prepared, and I too failed one of the practices .. passed the second with low grade and scored higher on the exam.

I just wish if they let authors put the exams or be part of the process .. that would align the material/lecture and the exam much better!

yomista

TechGuru80 wrote: »

Honestly if 3 weeks is all you really spent, I wouldn’t have felt that bad if you didn’t pass since that isn’t what I would call a “strenuous” study routine.

I guess having some experience in network analysis and SANS did help abit. But I would not want to recommend this to anyone since it was so nerve wrecking! First and last time that I will rush for an exam

yomista

Congrats! Always nice to see FOR572 alumni. Glad you passed the tough exams! Agree on the authors setting the exams instead of SANS .