GCIA (GIAC Certified Intrusion Analyst) (GCIA) Exam Blueprint

Demonstrate knowledge and skill relating to application layer protocol dissection and analysis.

Demonstrate knowledge of fundamental IDS concepts, such as network architecture options and benefits/weaknesses of common IDS systems.

Create effective IDS rules to detect varied types of malicious activity.

Demonstrate competence in analyzing data from multiple sources (e.g., full packet capture, netflow, log files) to identify normal and malicious behaviors.

Demonstrate understanding of the TCP/IP communications model and link layer operations.

Demonstrate understanding of how fragmentation works, and how to identify fragmentation and fragmentation-based attacks in packet captures.

Demonstrate the ability to dissect IP packet headers and analyze them for normal and anomalous values that may point to security issues.

Demonstrate knowledge of IPv6 and how it differs from IPv4.

Demonstrate knowledge relating to packet crafting and manipulation.

Demonstrate an understanding of SiLK and other tools to perform network traffic and flow analysis.

Demonstrate understanding of the TCP protocol and the ability to discern between typical and anomalous behavior.

Demonstrate ability to craft tcpdump filters that match on given criteria.

Demonstrate understanding of the UDP and ICMP protocols and the ability to discern between typical and anomalous behavior.

Demonstrate ability to use Wireshark to analyze typical and malicious network traffic.