- Exam Snapshot: The Numbers on One Screen
- The Nine Exam Objectives at a Glance
- Collection, Enrichment, and SIEM Fundamentals
- Analytics Domains: Network, Protocol, Application, Endpoint
- Cloud Logging and Microsoft Defender/Sentinel
- Open-Book Rules and Index Strategy
- Fees, Access Window, and Renewal
- Mapping SEC555 to the Exam Objectives
- A Domain-Ordered Review Schedule
- Who Hires for Detection Skills
- Frequently Asked Questions
- GCDA is one proctored, open-book exam: 75 questions in 2 hours, with a 76% minimum passing score on versions released on or after 2026-04-27.
- GIAC publishes nine exam objectives but no official percentage weights, so study all nine rather than betting on a favorite.
- Paper references only: electronic materials, internet access, and anything containing exam or practice Q&A are prohibited.
- Fees: USD 999 exam, USD 899 retake, USD 399 optional practice exam, USD 499 renewal; the credential is valid for 4 years.
Exam Snapshot: The Numbers on One Screen
This page condenses the facts about the GIAC Certified Detection Analyst (GCDA) credential that candidates most often need to look up. If you want the deeper treatment of any item, follow the links to the longer guides on this site. Everything below is drawn from GIAC's published certification information; where GIAC does not publish a figure, this sheet says so rather than guessing.
| Item | What to Know |
|---|---|
| Certifying body | GIAC Certifications, administered by GIAC, LLC |
| Exam format | One web-based, proctored exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 76%, applicable to exam versions released on or after 2026-04-27 |
| Reference policy | Open book with paper references; electronic references and internet access prohibited |
| Testing providers | Pearson VUE (onsite) and ProctorU (remote), depending on GIAC's assigned modality |
| Prerequisites | None required to begin; training optional |
| Validity | 4 years |
| Initial attempt access | 120 days from activation for a standalone attempt; extensions available |
Two arithmetic notes are useful on exam day. Two hours for 75 questions works out to roughly 96 seconds per question on average, which is tight for an open-book exam if you are hunting through your notes for every answer. And a 76% threshold on 75 questions means you need to answer at least 57 correctly if every question carries equal weight. GIAC's published material gives a passing score, not a per-question scoring breakdown, so treat 57 as a planning figure and not an official cutoff. For more on how the threshold is applied, see the dedicated guide to the GCDA passing score.
The Nine Exam Objectives at a Glance
GIAC lists nine objective headings for the GCDA exam. They are reproduced below in GIAC's order. GIAC does not publish percentage weights for them, so no weighting is implied here: the right assumption is that any of the nine can appear, and your review time should be distributed accordingly, with extra hours going to whichever ones you personally find weakest.
- Application and User Monitoring Analytics
- Application Protocol Analytics
- Asset and Network Analytics
- Azure and AWS Logging Overview
- Defender and Sentinel Overview
- Endpoint Analytics
- Log Analysis and Alerting
- Log Collection and Enrichment
- SIEM Overview
A few of these headings say "Overview," which signals breadth over depth: expect to recognize the logging sources, concepts, and terminology rather than to configure every product from memory. The headings containing "Analytics" suggest the exam wants you to reason about what data tells you, such as what a pattern in the logs means and what you would do with it. The full breakdown, with topic-level detail, lives in the complete guide to all 9 GCDA content areas.
Collection, Enrichment, and SIEM Fundamentals
Three of the nine objectives, Log Collection and Enrichment, Log Analysis and Alerting, and SIEM Overview, describe the plumbing that every other objective depends on. If detection analytics is a building, these are the foundation. Candidates who skip them to chase more exciting topics tend to discover that the analytics questions assume this vocabulary.
Log Collection and Enrichment
Know how log data gets from a source to an analyst-usable form, and what is added along the way.
- Why raw logs are rarely sufficient on their own and how enrichment adds context such as asset, identity, or reputation information
- Parsing and normalization: turning differently formatted sources into consistent, searchable fields
- Collection trade-offs, including what to collect, what to drop, and what gaps that creates for detection
- Timestamp and field-consistency problems that quietly break correlation
Log Analysis and Alerting
Know how to move from collected data to a detection that is useful rather than noisy.
- The difference between searching data after the fact and alerting on it continuously
- Thresholds, baselines, and aggregation as ways to separate signal from background activity
- Why alert quality matters: false positives consume analyst time and erode trust in detections
- Interpreting what a query result does and does not prove
SIEM Overview
Know what a SIEM does, how its components fit together, and where it is strong or limited.
- The core SIEM functions of aggregation, correlation, search, alerting, and reporting
- How data flows from sources through ingestion into storage and analysis
- Where SIEM architecture decisions affect cost, retention, and detection coverage
When reviewing this group, keep one question in mind: where in the pipeline could this detection fail silently? A missing log source, a mis-parsed field, or a dropped enrichment step can all make a detection look healthy while detecting nothing. Questions that test this kind of reasoning are common in detection-focused certifications because it reflects real operational work.
Analytics Domains: Network, Protocol, Application, Endpoint
Four objectives cover the analytical heart of the exam: Asset and Network Analytics, Application Protocol Analytics, Application and User Monitoring Analytics, and Endpoint Analytics. Each looks at a different vantage point, and each answers a different kind of question about what is happening in an environment.
Asset and Network Analytics
Understanding what is on the network and how it behaves.
- Why an accurate asset inventory is a prerequisite for meaningful detection: you cannot spot an unexpected system if you do not know what is expected
- Network-level telemetry and what patterns in it can reveal about scanning, beaconing, or unusual communication
- Using context about a system's role to decide whether observed behavior is normal
Application Protocol Analytics
Reading protocol-level behavior for signs of misuse.
- Familiarity with how common application protocols behave when used legitimately, so deviations stand out
- Interpreting protocol logs and fields to identify suspicious requests, responses, or usage patterns
- Recognizing that attackers often abuse trusted protocols precisely because those protocols are allowed through
Application and User Monitoring Analytics
Watching what users and applications do, not just what machines say.
- Authentication and access patterns as a detection source
- Spotting unusual user behavior against a baseline of normal activity
- Application logs as evidence of misuse that network and endpoint data may not show
Endpoint Analytics
Using host-level data to see activity that the network cannot.
- What endpoint telemetry offers that network data lacks, such as process, file, and host-level activity
- Correlating endpoint events with network and identity data to build a fuller picture
- Understanding the limits of endpoint visibility, including systems that are unmanaged or unmonitored
Cloud Logging and Microsoft Defender/Sentinel
Two objectives are explicitly platform-flavored: Azure and AWS Logging Overview, and Defender and Sentinel Overview. Because the exam is open book, the sensible approach is to build compact paper references for these, since product-specific names and log categories are easy to look up but hard to memorize.
Azure and AWS Logging Overview
Recognizing what the major cloud platforms log and why it matters for detection.
- The idea that cloud environments generate their own control-plane and activity logs, distinct from traditional host and network logs
- Why cloud logging often needs to be deliberately enabled and routed rather than assumed to be on
- Comparing how the two platforms categorize and expose audit and activity data at a conceptual level
Defender and Sentinel Overview
Understanding Microsoft's security tooling at an overview level.
- The role of Defender-family products as sources of security telemetry and alerts
- The role of Sentinel as a cloud-based SIEM that ingests, correlates, and alerts on data
- How these tools relate to one another and to broader log sources feeding a detection program
A practical tip: build a one-page comparison table for the two cloud platforms yourself, mapping equivalent concepts side by side. The act of building it is the study, and the finished page becomes a fast reference during the exam. Just remember that your reference must be on paper.
Open-Book Rules and Index Strategy
GCDA is open book, but the rules are specific. Paper references are allowed. Electronic references and internet access are prohibited, and so are materials containing exam or practice question-and-answer content. GIAC's Proctored Exam Reference Guide and proctoring pages govern the details, and the delivery provider depends on GIAC's assigned modality: Pearson VUE for onsite testing, ProctorU for remote.
Because 96 seconds per question leaves little room for browsing, the index matters more than the raw volume of notes. A workable approach for this exam is to index by concept and objective rather than by page order alone: list each term, protocol, log source, or platform feature, and note where it is covered. Build the index as you study rather than in the final week, because the act of indexing reveals gaps. Practice looking things up under timed conditions so that the lookup itself is a rehearsed motion. Our difficulty guide discusses how time pressure shapes the experience.
Fees, Access Window, and Renewal
The financial and administrative facts are among the most frequently asked about, so here they are in one place. All prices exclude tax.
| Item | Amount or Rule |
|---|---|
| Exam attempt | USD 999 |
| Retake | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Standalone attempt access window | 120 days from activation; extensions available |
| Certification validity | 4 years |
| Renewal requirement | 36 approved CPE credits earned in the active four-year cycle, or passing a renewal exam, plus the renewal fee |
The 120-day window is worth planning around. It starts at activation, not at purchase in the colloquial sense, so activate your attempt when you are ready to commit to a study timeline. If life intervenes, extensions exist under GIAC's Certification Attempt Delivery policy. For a line-by-line breakdown including training costs, see the GCDA certification cost guide, and for scheduling logistics see the page on GCDA exam dates and scheduling.
One more note on the passing score: the 76% figure applies to exam versions released on or after 2026-04-27. That date identifies when the standard applies; it does not by itself signal a change to the exam objectives. Your GIAC account's certification information governs the specific attempt you purchase, including its objectives, question types, format, and passing score, so confirm those details there once your attempt is active.
Mapping SEC555 to the Exam Objectives
The recommended preparation course is SANS SEC555: Detection Engineering and SIEM Analytics. Training is optional, and no prerequisites are required to begin the certification process. If you take the course, keep a clear mental distinction: the nine GIAC exam objectives are authoritative for what the exam covers, while SEC555's teaching sections are supplemental groupings used to organize the course. They are not an official list of exam domains and do not establish exhaustive exam coverage.
There is also a small source caveat worth knowing: the current SEC555 course webpage and its linked brochure use different titles for some preparation sections, including Sections 3 and 5. If you notice naming mismatches between course materials, that is why, and the nine GIAC objectives remain the reference point. Course hours, labs, and capstones are separate from the proctored exam time, so do not confuse the length of a course with the length of the test.
Key Takeaway
Use the nine GIAC objectives as your checklist and the course material as your source of depth. After each course section, ask which objectives it served, and note any objective that no section seems to cover so you can fill the gap with independent study. More on training options is in the GCDA training overview.
A Domain-Ordered Review Schedule
Rather than a generic weekly template, order your review by dependency: foundations first, then analytics, then platform-specific overviews, then timed practice. The schedule below is an example of how to sequence the nine objectives over several weeks; adjust the pace to your background and the 120-day access window.
Foundations: SIEM Overview and Log Collection and Enrichment
- Learn the data flow from source to SIEM and what enrichment adds
- Start your paper index with core terms and concepts
Log Analysis and Alerting
- Practice reasoning about baselines, thresholds, and alert quality
- Revisit pipeline failure points: where could a detection silently break?
Asset and Network Analytics, Application Protocol Analytics
- Build intuition for normal versus anomalous network and protocol behavior
- Add protocol and network terms to your index
Application and User Monitoring, Endpoint Analytics
- Practice choosing the right vantage point for each scenario
- Correlate identity, endpoint, and network evidence in sample cases
Azure and AWS Logging, Defender and Sentinel
- Create your side-by-side cloud comparison page
- Summarize product roles and relationships on a single reference sheet
Timed Practice and Index Refinement
- Take timed practice sets and look up answers using only paper references
- Refine the index based on what slowed you down
The reasoning behind this order is that the analytics objectives assume the vocabulary of collection, enrichment, and SIEM operations, while the cloud and Microsoft overviews are broad and benefit from a solid conceptual base. You can use the GCDA practice tests on the main site during the final two weeks to check pacing, and the GCDA study guide expands on how to structure longer preparation.
Who Hires for Detection Skills
GCDA targets the practical skills used in security operations and detection engineering. Roles that commonly draw on these skills include SOC analysts, threat hunters, detection engineers, and security engineers responsible for SIEM content. Employers of such roles include managed security service providers, enterprise security operations teams, and organizations running cloud-heavy environments where Azure, AWS, and Microsoft security tooling are in daily use. Because the exam content spans SIEM analytics, endpoint and network data, and cloud logging, it maps well to teams that must build and tune detections rather than only respond to alerts.
For a closer look at the job market, see the overview of GCDA jobs. If compensation is your question, the GCDA salary guide addresses earnings, and the ROI analysis weighs the credential's cost against its benefits. This cheat sheet deliberately does not quote salary numbers, since GIAC does not publish them and unsourced figures would mislead. If you are still confirming the basics, the explainers on what GCDA certification is and the GCDA requirements are the right starting points.
Frequently Asked Questions
The exam is one web-based, proctored test with 75 questions and a 2-hour time limit. That averages roughly 96 seconds per question, so your paper references need to be well organized to be useful.
The minimum passing score is 76%, applicable to exam versions released on or after 2026-04-27. GIAC publishes the passing score but not a candidate pass rate. Your GIAC account's certification information governs the specifics of your purchased attempt.
Yes, the exam is open book with paper references. Electronic references and internet access are prohibited, as are materials containing exam or practice question-and-answer content. Review GIAC's Proctored Exam Reference Guide before test day.
No. There are no prerequisites to begin the certification process, and training is optional. SEC555: Detection Engineering and SIEM Analytics is the recommended preparation, but the nine GIAC exam objectives, not the course sections, define what the exam covers.
The certification is valid for 4 years. Renewal requires either 36 approved CPE credits earned during the active four-year cycle or passing a renewal exam, plus the USD 499 renewal fee. Prices exclude tax.
Keep this sheet nearby as a quick-reference companion while you work through the longer guides, and revisit the nine objective headings regularly as a checklist. When you are ready to test your recall under realistic timing, the GCDA Exam Prep practice tests are the natural next step.