The GCED is 115 questions in 3 hours, proctored either remotely through ProctorU or on-site through PearsonVUE, with a minimum passing score of 69% for exam versions released since October 1, 2022. That works out to roughly a minute and a half per question, which sounds generous until you hit a question built around a log excerpt or a packet capture description that takes reading time before you even get to the answer choices.
GCED is open-book — but open-book on GIAC exams means printed materials only. You can bring an armful of hardcopy books, handwritten notes, and a personal index into the testing room; GIAC explicitly prohibits anything in digital form and anything that resembles actual exam questions. This matters more for GCED than it sounds, because the question style leans scenario-based rather than pure definition recall: you’re usually asked what a SOC analyst or incident responder should do given a specific log, packet, or malware artifact, not “define IDS.” An index that’s organized by concept rather than by chapter number will serve you far better than a straight table of contents.
Once your attempt is activated in your GIAC account, you have 120 days to sit it — plenty of time if you build a schedule around it, easy to let slip if you don’t.
GIAC does not publish percentage weightings for GCED’s objectives — unlike some vendor exams, there’s no “this domain is 25% of the test” guidance to lean on, so treat every objective below as fair game rather than trying to triage by assumed weight.
Domain | What It Actually Covers |
|---|---|
Attack Surface Management | Identifying and prioritizing exposures and vulnerabilities; familiarity with MITRE ATT&CK and D3FEND; OSINT techniques for understanding attacker reconnaissance |
Configuration Management and Automation Workflows | Maintaining secure configurations, mitigating configuration drift, and using automation and AI-assisted tooling to manage configuration at scale |
Engineered Telemetry through Defensive Controls | Implementing and evaluating defensive controls that improve detection and reduce exposure |
Enterprise Security Operations | How SOC processes and personnel support detection and monitoring; developing and optimizing detection using telemetry and log formats |
Evidence Collection and Visibility | Assessing the accuracy and integrity of security records, baselines, and logs; time and logging integrity for reliable analysis |
Identity and Infrastructure Hardening | Identity and network controls that reduce attack paths; differentiating reconnaissance, password-based attacks, and command-and-control activity |
Identity and Infrastructure Records | Analyzing Active Directory, RADIUS, and TACACS+ records; recognizing log enrichment and signs of spoofing or manipulation |
Incident Containment and Recovery | Post-incident processes and common obstacles that complicate containment, eradication, and recovery |
Incident Investigation and Analysis | Collecting and analyzing evidence to scope an incident; applying detection and response methodologies; integrating threat intelligence |
Malware Analysis and Defensive Controls | Knowing when static vs. dynamic malware analysis applies, and turning findings into better detection |
Malware Identification and Triage | Recognizing malware characteristics and indicators of compromise during early triage |
Network Traffic Analysis and Investigation | Analyzing packets, flows, and forensic artifacts; configuring and tuning network IDS/IPS, including reviewing open-source rules |
Most GCED candidates arrive with a reasonably strong network defense background and assume that carries them through. A few places it doesn’t:
Identity and Infrastructure Records. Reading Active Directory, RADIUS, and TACACS+ logs well enough to spot spoofing or manipulation is a different skill than knowing network defense in the abstract. Candidates coming from a packet-and-firewall background, rather than an identity-and-AAA background, tend to lose time here.
Configuration Management and Automation Workflows. This objective leans into automated and AI-assisted hardening tooling and configuration drift — territory that didn’t exist in older versions of this exam’s blueprint. If your experience is manual hardening against a checklist, budget extra time here.
The split between malware identification and malware analysis. GIAC treats early triage (recognizing indicators, symptoms of infection) and deeper static/dynamic analysis as two separate objectives. Candidates who’ve only done surface-level “this file looks suspicious” work often do fine on triage questions and then get caught by questions that expect them to reason through what static versus dynamic analysis would actually reveal.
Open-source IDS/IPS rule review. If your hands-on experience is limited to a commercial SIEM’s point-and-click rule builder, reviewing and interpreting raw open-source intrusion detection rules can feel unfamiliar under time pressure.
Because GCED is open-book, the value of a practice test isn’t memorizing answers — it’s rehearsing how fast you can locate the right section of your index under a scenario-based question. GIAC itself notes that its own practice question bank is limited enough that you may see the same question appear across multiple attempts, so treat repetition as a signal to understand the underlying concept, not as confirmation you’ve “seen it all.”
Run practice sets under a timer that mirrors the ratio — roughly 90 seconds per question — rather than untimed. If a question about TACACS+ logging or D3FEND mapping takes you three minutes to track down in your notes during practice, that’s the domain to rebuild your index around before exam day, not after a retake.
Treating “open-book” as a substitute for preparation. You cannot learn enterprise defense concepts for the first time while the clock is running; the book is there to confirm, not to teach.
Building an index by chapter instead of by concept. A table-of-contents-style index slows you down exactly when scenario questions need a fast, topic-based lookup.
Underweighting identity and infrastructure records. This is the domain most retake candidates report being surprised by, especially if their background is more network-centric than identity-centric.
Letting the 120-day window drift without a fixed test date. Open-ended windows tend to produce rushed, underprepared attempts near the deadline.
Not reviewing the post-exam domain breakdown after a failed attempt. GIAC provides a score report by objective — skipping it means re-studying everything instead of the two or three domains that actually cost you the pass. A retake runs $899 (versus $999 for a first attempt), so a targeted second attempt is both faster and cheaper than a broad one.
New to enterprise/blue-team defense (general IT or security background, no SOC experience):
Plan on 12–16 weeks. Spend the first half building foundational familiarity with each domain, especially identity/AAA log analysis and malware triage if those are new to you, then spend the back half on index-building and timed scenario practice.
Already working in a SOC, or holding GSEC/GCIH:
6–8 weeks is . Most of the content will feel familiar; the work is filling specific gaps (automation/AI-assisted configuration tooling tends to be the newest material for experienced analysts) and converting existing knowledge into a fast, usable index.
Retaking:
2–4 weeks, focused entirely on the domains flagged in your GIAC score report rather than a full re-study. Rebuild the index sections for those specific domains and run timed practice on nothing else.
GIAC has substantially rewritten the GCED objective list from the version many older prep resources still describe. The current blueprint adds domains around attack surface management with MITRE ATT&CK/D3FEND mapping, OSINT-based reconnaissance analysis, and AI-assisted configuration and automation workflows — material that didn’t exist in the exam’s earlier topic set (which focused more narrowly on protocol defense and wireless security basics). If a question bank or guide you’re using still lists those older topics as the primary focus, it’s working from an outdated blueprint.
The associated SANS offering, SEC501, underwent a parallel overhaul: it was renamed from “Advanced Security Essentials – Enterprise Defender” to “Applied Cyber Defense” and rebuilt around a single continuous investigation narrative with content aimed at AI-accelerated attacks. The passing score itself has been stable since October 1, 2022 at 69%, so that part of the exam hasn’t moved — it’s the content being tested, not the bar for passing, that’s shifted.
Last updated on Oct, 14 2026
