SANS SEC503: Network Monitoring and Threat Detection In-Depth
RecommendedGIAC names its affiliated SANS course as the best preparation for GCIA. You can buy an attempt without it.
GIAC Certified Intrusion Analyst (GCIA) Exam Guide
Validates practical skills in network intrusion detection, including packet-level TCP/IP analysis, tcpdump, Wireshark, Snort, Zeek and network forensics.
GCIA tests detailed traffic analysis: protocol headers, filters, IDS rules and network forensics, including CyberLive tasks with real tools. Master the TCP/IP foundations first, index the books and tool syntax, and repeat the labs.
Understand the exam
Syllabus
GIAC publishes no weights, so these areas are groupings of its 15 official objectives.
TCP/IP and IP headers
- Concepts of TCP/IP and the link layer: understand the TCP/IP communications model and link layer operations
- IP headers: dissect IP packet headers and analyze them for normal and anomalous values that may point to security issues
- IPv6: understand IPv6 and how it differs from IPv4
- Fragmentation: understand how fragmentation works, and how to identify fragmentation and fragmentation-based attacks in packet captures
Example scenario: A capture shows IPv4 fragments whose offsets overlap. What could an attacker gain, and how would different hosts reassemble them?
Transport protocols and packet crafting
- TCP: understand the TCP protocol and discern between typical and anomalous behavior
- UDP and ICMP: understand the UDP and ICMP protocols and discern between typical and anomalous behavior
- Packet engineering: understand packet crafting and manipulation
Example scenario: A host sends SYN packets with the FIN flag also set. Which tools or scans produce that, and how would a stateful firewall respond?
Traffic analysis tools and application protocols
- Wireshark fundamentals: use Wireshark to analyze typical and malicious network traffic
- Tcpdump filters: craft tcpdump filters that match on given criteria
- Application protocols: understand application layer protocol dissection and analysis
Example scenario: You need only TCP packets with SYN set and ACK clear to or from port 443. How would you write that tcpdump filter?
Intrusion detection with Snort and Zeek
- IDS fundamentals and network architecture: understand fundamental IDS concepts, such as network architecture options and benefits/weaknesses of common IDS systems
- Intrusion detection system rules: create effective IDS rules to detect varied types of malicious activity
- Advanced IDS concepts: understand IDS tuning methods and correlation issues
Example scenario: A Snort rule for a web exploit fires hundreds of times a day on harmless traffic. What would you change to tune it?
Network forensics and flow analysis
- Network forensics and traffic analysis: analyze data from multiple sources to identify normal and malicious behaviors
- SiLK and other traffic analysis tools: understand SiLK and other tools to perform network traffic and flow analysis
Example scenario: Flow records show a workstation sending small, regular transfers to one external address overnight. What would you look at to confirm beaconing?
GCIA certification objectives · Exam versions released on or after January 21, 2023
Format
- Questions
- 106
- Duration
- 4h
- Passing score
- 67%
- Delivery
- Test centre or online
- Languages
- English
Question types
Select your answer from the options shown for each question.
CertUp example
A captured TCP segment has both the SYN and FIN flags set. What does this most likely indicate?
Show answer
An invalid flag combination often used in scanning or evasion. SYN opens a connection and FIN closes one, so a legitimate stack does not send both together.
Work in a live virtual machine with real tools to complete a task, then enter the result as your answer; these items come at the end of the exam and usually count for more than multiple choice.
CertUp example
A packet capture is open in the lab virtual machine. Use tcpdump or Wireshark to count the DNS requests (UDP port 53) sent from 10.1.1.20, and enter the number.
Show answer
For example, 47: the number of packets that match a source of 10.1.1.20 and a UDP destination port of 53. A display filter or a tcpdump filter both give the count.
Eligibility and booking
Buy a certification attempt from the GIAC certification page or add one to a SANS course. Access usually arrives within 3 business days, and you then have 120 days to sit the exam.
Make a study plan
Work through the SEC503 material or an equivalent study route once, building your index as you read. Then use practice tests to fix your index and your weak objectives.
Most candidates spend 80–130 hours. Plan for the low end if you read packet captures and IDS rules daily; plan for the high end if packet headers and hex are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.60 h
- 4Practice with mock examsTake timed practice tests and review every mistake.30 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h
Learn the core concepts
SEC503 is the course the exam is written from. The early TCP/IP material underpins everything after it, so do not rush it. Practical Packet Analysis is a useful Wireshark companion.
Best official courseSANS SEC503: Network Monitoring and Threat Detection In-Depth
Best supplementary bookPractical Packet Analysis, 3rd EditionMake syntax sheets. Keep one printed page each for tcpdump filters, Snort and Zeek syntax and the tool commands from the labs.
Practice with mock exams
GIAC practice tests use the real exam engine and report the objectives you missed. Take one after your first pass through the material and the second when you feel ready, fixing your index in between.
See all 2 GCIA practice tests →
Best free optionAre you ready?
- You pass a timed practice test with time to spare.
- You can find most answers through your index quickly.
- You can complete the course labs without following the workbook step by step.
The practice question bank is small, so a second test can repeat questions from the first.
Prepare for exam day
Schedule from your GIAC account once the attempt is active. GIAC expects candidates within 60 miles of a Pearson VUE centre to test there; ProctorU online testing is the other route.
At a Pearson VUE centre
Testing with ProctorU
- Bring two current, original IDs. The primary ID needs your photo and signature, and both names must match your booking.
- Arrive 15 minutes early. Arriving more than 15 minutes late or missing the appointment costs a $175 reseating fee.
- Reschedule at least 24 hours ahead. Your GIAC account shows times in UTC.
- Read GIAC's remote proctor guide and test your computer, webcam and connection before exam day.
- Keep your printed materials within reach of your desk.
- Reschedule at least 24 hours ahead to avoid the $175 reseating fee.
- Bring printed books, notes and your index. Electronic files, devices and printed practice questions are not allowed.
- You get 15 minutes of break time, in one or two parts.
Advice from exam takers
Expect packet-level detail.
In a 2024 thread, holders described GCIA as much harder than GCIH, heavy on protocol offsets and hex patterns, and advised getting comfortable with tcpdump early.
Bring organised reference material.
A November 2025 passer used an index per book, a page-title table of contents, cheat sheets for lab commands and protocols, and printed manuals for tools such as tshark, Zeek and SiLK. They found the CyberLive questions the easiest part.
Course quizzes are not exam rehearsal.
A 2024 reply explained that the end-of-section quizzes test each section, while practice tests and the exam ask you to apply knowledge to new situations.