GIAC GCIA Study Roadmap

Domain 1: TCP/IP fundamentals — IP headers, TCP flags, protocol behavior, state machines

Domain 1: Deep packet inspection — Fragmentation, TTL analysis, checksum, anomalies

Domain 2: IDS/IPS — Snort/Suricata architecture, rule syntax, signature writing

Domain 2: Signature tuning — False positive reduction, threshold alerts, evasion detection

Domain 3: Wireshark — Display filters, stream reconstruction, file extraction

Domain 3: tcpdump — BPF filters, capture techniques, command-line analysis

Domain 3: Traffic forensics — Malware patterns, C2 detection, payload analysis

Domain 4: Network monitoring — Sensor placement, TAPs, SPAN ports, packet brokers

Domain 4: SIEM & logging — NetFlow, IPFIX, log aggregation, monitoring architecture

Domain 5: Advanced detection — APTs, covert channels, DNS tunneling, data exfiltration

Domain 5: Threat intelligence — MITRE ATT&CK, beaconing, lateral movement, correlation

Index Building: Create open-book index for exam day, organize notes by topic

Full Review: Practice exams, Packet analysis exercises, Index refinement

Final Review: Timed practice exams, Weak areas, Exam logistics