GCFA done!

Hi kids -

I'm going to say that GCFA was the hardest GIAC exam in my opinion. Did a fall short before, yes, but I am glad that it's now over. Finally!

I studied so much on this that the books are getting ragged!

VV5 out!

Find more posts tagged with

GIAC

SANS

GIAC Exam

GCFA

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Cuse0311

That's awesome! Congrats on the pass! Way to stick with it.

VictorVictor5

Thanks @Cuse0311! Hope everything is well with you!

charismaticx

That’s awesome! I heard this one was rough.

SecretUser

I'm taking this course after I finish 504 in August (hopefully). Did you have any knowledge of Windows forensics and artifacts going in? If not, how hard was the course without that knowledge?

Did you use any outside resources to supplement the materials? I've been looking at andreafortuna's blog and 13cubed to prepare. Might give Phillip Polstra a try as well. I just want to be extra prepared going in because I heard the cert was TOUGH.

VictorVictor5

@charismaticx - No doubt about it. Most definitely, glad it's over.

@SecretUser - To be honest, I had very little knowledge of Windows forensics when I took this course. And that, being completely honest, was my downfall. If I had to do it all over again, I would have taken FOR500 to get into it first. But being the hardhead that I am, I took the maximum amount of attempts, and waived to get in the 4th and final try. My scores were 65%, 68%, 70%, and passing for the last one (I think 78%?). After the third attempt I was beyond livid since I was so close.

So yes, this exam is not for the faint of heart. I don't care if it's open book. I'd put it up there with CISSP in terms of covering many areas. In fact I'd say it's harder than that.

Andrea's blog is definitely helpful. I'm not aware of the other two resources. But remember, in the end, it's your prep and index that is going to get you ready for it. And labs! Yes focus on the labs. Basically labs and books. Just when you think you're ready, read them again and do the labs one more time.

I will caveat that my nutty self is a glutton for punishment since I am full-time employed and in law school doing certs! But hey, YOLO, right?

VV5 out.

charismaticx

Sounds like the GCIA all over again. Sounds rough.

VictorVictor5

@charismaticx - Haven't taken 503 yet (that's on the list - eventually) but I'm tellin' ya, not fun. Worth it, but very rough. I basically used the full time limit allowed. Unless it changed, there weren't any simulated labs like GCIH and GPEN, but still.

charismaticx

Oh really?! I thought GCFA had some. GCIA was mentally exhausting but well worth it. What made this one challenging.

VictorVictor5

No, straight from the books and labs. Posters definitely helped. You're a fool if you don't bring them (not you personally, but you get my point). But again, it might of changed with the virtual labs. But perhaps not because some of the tools in that class weren't free (like F-Response), unlike GCIH/GPEN.

charismaticx

It sounds like it’s worth having. Maybe, one day I can challenge the exam. It sounds like a great course.

VictorVictor5

I highly recommend it. You will learn a ton. But, don't repeat my mistake - if you know very little DFIR, go for FOR500 first if you can. It will set you up for success.

UnixGuy

Congrats, it's a tough one indeed.

VictorVictor5

Thanks @UnixGuy! I hope your gym is working out for you given these unprecedented times.

UnixGuy

VictorVictor5 said:

Thanks @UnixGuy! I hope your gym is working out for you given these unprecedented times.

No it's not, that ship has sailed