GCDA Exam Domains 2026: Complete Guide to All 9 Content Areas

How GIAC Publishes the GCDA Scope

The GIAC Certified Detection Analyst (GCDA) credential is administered by GIAC, and its scope is defined by a list of exam certification objectives and outcome statements on the official certification page. For this guide, that list contains exactly nine headings, reproduced here in the order GIAC presents them:

1. Application and User Monitoring Analytics
2. Application Protocol Analytics
3. Asset and Network Analytics
4. Azure and AWS Logging Overview
5. Defender and Sentinel Overview
6. Endpoint Analytics
7. Log Analysis and Alerting
8. Log Collection and Enrichment
9. SIEM Overview

Two details matter before you plan anything. First, the numbering is simply source order, not a priority ranking. Second, GIAC does not publish percentage weights for these objectives. Any study resource that tells you "Domain 6 is 18% of the exam" is inventing a number. A sensible approach is to treat all nine as fair game and to invest according to your own gaps. If you want the broader certification context, see our overview in What Is GCDA Certification? and the companion article GCDA Study Guide 2026: How to Pass on Your First Attempt.

Exam Format and Fee Snapshot

The domains only make sense when you know the container they are tested in. Here are the verified mechanics:

Two hours for 75 questions works out to roughly 96 seconds per question on average. That is tight for an open-book exam if you rely on looking things up, which is why your paper index matters (more on that below). For deeper treatment of the numbers, read GCDA Passing Score 2026: Exactly What You Need to Pass and GCDA Certification Cost 2026: Complete Pricing Breakdown. Eligibility details live in GCDA Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Collection, Enrichment, and SIEM Foundations (Domains 7, 8, 9)

Detection analytics are only as good as the data feeding them. Three of the nine objectives address that foundation directly, and they make the best starting point for preparation.

Because these three objectives describe the plumbing that every other objective assumes, mastery here pays off across the whole exam. Our domain guide hub and the GCDA Exam Prep practice tests are useful for checking whether you can apply these ideas under time pressure.

The Analytics Domains (Domains 1, 2, 3, 6)

Four objectives focus on what to look for in specific telemetry types. Each demands a slightly different mental model.

Domain 6: Endpoint Analytics

Endpoint data is often the richest source for spotting adversary behavior after initial access. Study what endpoint telemetry records, such as process creation, command-line arguments, parent-child process relationships, and persistence-related changes, and how an analyst turns those records into hypotheses about malicious activity. Practice distinguishing unusual-but-benign administrative behavior from patterns that deserve escalation.

Domain 3: Asset and Network Analytics

This objective ties detections to the environment being defended. Knowing what assets exist, what they normally communicate with, and how traffic patterns look at baseline lets you notice rogue devices, unusual connections, and lateral movement. Expect to reason about how asset inventory and network flow data support detection and how gaps in either undermine confidence.

Domain 2: Application Protocol Analytics

Here the focus shifts to behavior at the protocol layer. Candidates should understand how common application protocols normally behave so that anomalies in requests, responses, or usage patterns stand out. The skill is recognizing what "malformed," "rare," or "abused" looks like for protocols that attackers commonly leverage for command and control or data movement.

Domain 1: Application and User Monitoring Analytics

This objective covers detection grounded in who is doing what inside applications. Identity and access behavior, authentication patterns, and application-level activity all fall in this territory. Think about unusual sign-in sequences, atypical access to sensitive functions, and account behavior that departs from a user's or role's baseline.

The Cloud and Microsoft Domains (Domains 4, 5)

Two objectives are named for specific platforms, which makes them different in character from the rest. Both are labeled "Overview," which signals breadth of understanding rather than deep administration, but candidates should not take that as license to skip them.

If your day job is entirely on-premises or entirely within one cloud, these two domains are the most likely place for blind spots. Build a small comparison table of log sources by platform in your own notes; it doubles as a fast lookup during the open-book exam.

Mapping SEC555 Sections to the Nine Objectives

The recommended preparation course is SANS SEC555: Detection Engineering and SIEM Analytics. It is optional, since no training is required to start the certification process, but many candidates use it. The key point is how the course relates to the exam: SEC555 is organized into five teaching sections, while GIAC's exam is defined by nine objectives. They are not the same structure, and the course sections are unweighted preparation groupings that do not establish exhaustive exam coverage.

Practically, this means you should build your study map from the nine objectives, then use SEC555 materials to fill each one in, rather than organizing your notes strictly by course section. After finishing the course, run a gap check: for every objective, can you explain it without opening the books? Any "no" is a targeted review item. More on training choices is in GCDA Training, and the practical side of the credential is discussed in GCDA Jobs.

Open-Book Strategy for a 75-Question Exam

GIAC's open-book policy permits paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A. Review the GIAC Proctored Exam Reference Guide before test day so nothing in your materials triggers a problem.

With roughly 96 seconds per question on average, the index you build is a primary performance tool. For this exam specifically, a useful index is organized by the nine objectives and cross-referenced by data source and detection concept, so you can jump from "what does this log field mean" to the right page quickly. Tabs or labeled sections for each domain help, and a one-page comparison of Azure versus AWS log sources and of Defender versus Sentinel roles can save real minutes.

A Domain-Sequenced Preparation Plan

Rather than a generic template, sequence your study by dependency: foundations first, then data-specific analytics, then the platform overviews, then integration and practice. Adjust the length to your experience.

If you need help judging how much time you personally need, read How Hard Is the GCDA Exam? Complete Difficulty Guide 2026. One note on expectations: the cited GIAC source publishes a passing score but not a candidate pass rate, so be cautious with any figure claiming to be one. Our discussion in GCDA Pass Rate 2026: What the Data Shows addresses what can and cannot be said. For a condensed refresher near test day, see the GCDA Cheat Sheet and the timing details in GCDA Exam Dates 2026: Testing Windows, Deadlines & Scheduling.

Who Hires for This Skill Set

The nine objectives describe work done in security operations centers, detection engineering teams, threat hunting functions, and managed detection and response providers. Roles that commonly touch this material include SOC analysts, detection engineers, SIEM engineers, threat hunters, and incident responders who rely on log-driven investigation. Organizations running a SIEM, especially those with cloud footprints in Azure or AWS or with Microsoft-centric security stacks, have the clearest use for the skills the cloud and Defender/Sentinel domains validate.

Employer demand and compensation vary widely by region, seniority, and sector, and we do not cite specific figures here. For earnings analysis and return-on-investment framing, see GCDA Salary Guide 2026: Complete Earnings Analysis and Is the GCDA Certification Worth It? Complete ROI Analysis 2026. For a definitional starting point, What Is GCDA? covers the basics, and you can test your readiness any time with the GCDA practice exams.

Frequently Asked Questions