GIAC GCIA Study Roadmap

Domain 1: TCP/IP fundamentals (IP headers, TCP flags, protocol behavior, state machines)

Domain 1: Deep packet inspection (Fragmentation, TTL analysis, checksum, anomalies)

Domain 2: IDS/IPS (Snort/Suricata architecture, rule syntax, signature writing)

Domain 2: Signature tuning (False positive reduction, threshold alerts, evasion detection)

Domain 3: Wireshark (Display filters, stream reconstruction, file extraction)

Domain 3: tcpdump (BPF filters, capture techniques, command-line analysis)

Domain 3: Traffic forensics (Malware patterns, C2 detection, payload analysis)

Domain 4: Network monitoring (Sensor placement, TAPs, SPAN ports, packet brokers)

Domain 4: SIEM & logging (NetFlow, IPFIX, log aggregation, monitoring architecture)

Domain 5: Advanced detection (APTs, covert channels, DNS tunneling, data exfiltration)

Domain 5: Threat intelligence (MITRE ATT&CK, beaconing, lateral movement, correlation)

Index Building: Create open-book index for exam day, organize notes by topic

Full Review: Practice exams, Packet analysis exercises, Index refinement

Final Review: Timed practice exams, Weak areas, Exam logistics