- GDAT is GIAC Defending Advanced Threats: one proctored exam, 75 questions, 2 hours, 70% minimum passing score.
- The public outline lists 10 domains, from Active Directory/Domains through Reconnaissance, Threat Handling, and Incident Response, without published weights.
- The exam is open book with hardcopy books, notes, and an index; electronic references are prohibited.
- A standalone attempt costs USD 999, and the certification stays valid for four years.
What the GDAT Certification Actually Certifies
GIAC Defending Advanced Threats, abbreviated GDAT, is a credential from GIAC Certifications. It targets defenders who need to counter realistic, multi-stage adversaries rather than commodity malware. If you are looking for a broader orientation first, our explainers on what GDAT certification is and what GDAT stands for cover the basics. This article goes deeper into the mechanics: how the exam is built, what the ten published domains demand, and how to organize your preparation around them.
The credential's identity is easiest to understand through its domain list. Notice that the headings read like an attack lifecycle: reconnaissance, payload delivery, payload execution, installation, administrative access, lateral movement, data exfiltration. That is deliberate framing. The exam asks you to think the way a purple team does, understanding an adversary's technique well enough to build or tune the control that stops it.
There are no formal certification prerequisites. That said, "no prerequisites" is not the same as "no background needed." The domain list assumes you already understand Windows domain environments, common post-exploitation behavior, and how detection telemetry is generated. Our GDAT requirements guide walks through what eligibility looks like in practice.
Exam Format, Delivery, and Open-Book Rules
The public specifications describe a single proctored, web-based exam with the following parameters:
| Attribute | Published Specification |
|---|---|
| Number of questions | 75 |
| Time allowed | 2 hours |
| Minimum passing score | 70% |
| Proctoring | Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Reference policy | Open book: hardcopy books, notes, and an index permitted |
| Prohibited materials | Electronic references and practice/exam question-and-answer materials |
| Standalone attempt access | 120 days from activation |
Two minutes per question is the arithmetic, and it shapes strategy. Questions on adversary tradecraft often require you to recall a specific technique, a specific log source, or a specific control rather than reason from first principles. That is why the open-book allowance matters so much, and why the index you build is arguably the most valuable preparation artifact you will produce.
One caution on the 70% figure: the minimum passing score is a scoring specification that GIAC applies to exam versions released on or after October 1, 2018. It is not a pass rate. No issuer-published pass rate was verified, so any number you see quoted should be treated as unsupported. Our pages on the GDAT passing score and what the data shows about pass rates separate these two ideas in more detail.
Building an index that works under time pressure
Because only hardcopy materials are allowed, your index has to do the work that a search function would otherwise do. For GDAT, a useful index is organized by adversary action and by defensive control, not by book chapter. When a question describes an attacker abusing a credential or moving between hosts, you want to find the relevant technique name, the relevant telemetry, and the relevant mitigation in a single lookup. Cross-reference these rather than listing each once. Our GDAT cheat sheet offers a compact starting framework for the facts worth indexing.
The Ten Published Exam Domains
The public outline lists ten domain headings in a fixed order. It publishes no percentage weights, so none are stated here and none should be assumed. Treat each domain as potentially significant until your own account says otherwise. For a domain-by-domain companion piece, see the complete guide to all 10 GDAT content areas.
Domain 1: Active Directory/Domains
Active Directory is the connective tissue of most enterprise intrusions, so expect the exam to treat it as both a target and a source of defensive telemetry.
- How domain trust, authentication, and directory structure create attack paths
- Which directory events and configurations reveal abuse
- Hardening choices that shrink the blast radius of a compromised account
Domain 2: Administrative Access
Privileged access is what adversaries chase and what defenders must tightly govern.
- How attackers obtain and abuse elevated rights
- Controls that limit, monitor, and time-bound administrative privilege
- Detecting privilege use that deviates from normal administrative patterns
Domain 3: Adversary Emulation
This domain reflects the purple-team heart of the certification: reproducing attacker behavior to test whether your defenses actually fire.
- Planning emulation around realistic threat behavior
- Mapping emulated actions to the detections they should trigger
- Using results to close gaps rather than merely document them
Domain 4: Application Exploitation
Applications are a common entry and pivot point, and defenders need to understand how exploitation shows up on the wire and on the host.
- Common exploitation paths against applications and services
- Compensating controls and hardening that reduce exploitability
- Telemetry that distinguishes exploitation attempts from benign activity
Domain 5: Data Exfiltration
The end of many intrusion chains. Candidates should understand how data leaves an environment and how to notice it.
- Exfiltration channels and staging behavior
- Network and endpoint controls that restrict or flag outbound data movement
- Detection logic tuned to unusual transfer patterns
Domain 6: Installation
Persistence and tooling installation give attackers durable footholds.
- How adversaries establish persistence and install implants
- Application control and integrity-monitoring approaches that interrupt installation
- Artifacts that reveal a foothold after the fact
Domain 7: Lateral Movement
Once inside, attackers expand. This domain asks how to make that expansion difficult and visible.
- Techniques for moving between systems using legitimate mechanisms
- Segmentation and credential-hygiene controls that constrain movement
- Detections for remote execution and unusual authentication flows
Domain 8: Payload Delivery
The initial vector that gets malicious content to a target.
- Delivery mechanisms such as messaging, web content, and removable paths
- Gateway, filtering, and user-environment controls that blunt delivery
- How to validate those controls through emulation
Domain 9: Payload Execution
The moment code runs. Prevention and detection here often decide whether an incident stays small.
- Execution methods and the host behaviors they generate
- Restricting what is allowed to run and how scripting is governed
- Endpoint logging that exposes suspicious execution chains
Domain 10: Reconnaissance, Threat Handling, and Incident Response
The exact GIAC heading is retained here. Its outcome statement and the affiliated SEC599 course both discuss threat hunting, so expect proactive searching to sit alongside reactive response.
- Attacker reconnaissance and how defenders can observe or disrupt it
- Threat-hunting approaches grounded in adversary behavior
- Incident-response handling once an intrusion is confirmed
Key Takeaway
Read the ten domains as one kill chain, not ten silos. A single scenario question can touch payload delivery, execution, and lateral movement at once. Study each technique alongside the control that breaks it and the log that exposes it.
How SANS SEC599 Relates to the Exam
The affiliated preparation course is SANS SEC599, titled "Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses." It is the natural training companion to the certification, and the SANS-associated exam attempt carries the same USD 999 price as the standalone attempt, with course tuition additional. The linked public syllabus brochure and the course page describe the curriculum in terms of purple-team methods and kill-chain defenses, which aligns thematically with the domain list above.
There is an important distinction to keep in view. Course sections, labs, and capstones are preparation material. They do not establish the official exam-domain counts, weights, or exhaustive coverage. The SANS "Purple Team Course FAQ" describes course-emphasis percentages, and those are course emphases, not GDAT exam weights. Do not translate them into a study-time budget as if they were exam blueprints.
SANS has also publicized a preparation-course refresh through a public agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599," dated August 25, 2025. That agenda documents a change to the course, not a change to the exam version. Only the public agenda was reviewed; the sign-in-gated recording was not retrieved, so avoid drawing conclusions about its contents. For a fuller picture of course-based preparation, see our page on GDAT training.
Fees, Access Window, and Renewal Mechanics
The published figures, excluding applicable sales tax and training tuition, are straightforward:
| Item | Published Amount |
|---|---|
| Standalone exam attempt | USD 999 |
| SANS-associated exam attempt | USD 999 (course tuition additional) |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
A standalone attempt gives you 120 days of access from activation. That window argues against buying the attempt early as a motivational device; activate it when your index is built and your practice results are consistent. A retake costs less than the first attempt, but it is still a significant expense, which is part of why careful readiness matters. For a fuller treatment of the financial picture, including how training tuition changes the total, read our GDAT certification cost breakdown.
Staying certified
The certification is valid for four years. Renewal is available either by earning 36 CPE credits or by taking a renewal examination, and either path also requires the renewal fee. Because many working defenders accumulate CPE through conferences, webinars, and published work as a matter of routine, the CPE route is often the lower-friction option for people who stay active in the field. Confirm current renewal procedures in GIAC's renewal documentation before your four-year window closes.
If you are weighing whether the outlay is justified, our analysis of whether the GDAT certification is worth it frames the decision against your career goals.
Sequencing the Domains in a Study Plan
Generic study advice is plentiful, so here is one GDAT-specific sequencing idea and nothing more. Because the domains form an attack chain, it helps to study them in an order that lets later topics build on earlier ones, while reserving the final stretch for integration and index refinement.
Foundations: Active Directory/Domains and Administrative Access
- Establish how domain authentication and privilege work, since later domains lean on them
- Start the index with credential and privilege entries, cross-referenced to controls
Entry chain: Payload Delivery, Payload Execution, Application Exploitation, Installation
- Walk a single intrusion from first contact to persistence
- Pair every technique with its prevention control and its detection source
Expansion and impact: Lateral Movement and Data Exfiltration
- Focus on segmentation, credential hygiene, and outbound-traffic visibility
- Extend the index with movement and exfiltration detections
Integration: Adversary Emulation and Reconnaissance, Threat Handling, and Incident Response
- Tie the whole chain together through emulation-driven validation and hunting
- Run timed practice and refine the index based on lookups that were slow
This is a template, not a mandate. If your daily work already covers lateral movement and incident response, compress those weeks and spend longer on whichever domains feel least familiar. For a broader plan with more detail, our GDAT study guide covers pacing and resources, and the difficulty guide helps you calibrate how much preparation you personally need.
When you are ready to test recall under time pressure, the GDAT practice tests on the main site let you rehearse the two-minutes-per-question rhythm. Keep in mind the policy boundary: practice and exam question-and-answer materials are prohibited in the exam room, so use them for study only and never as a reference during the attempt.
Who Hires for This Skill Set
The domains point to defensive roles that sit close to adversary behavior. Employers who value this skill set tend to run mature security operations, and the typical role families include:
- Security operations and detection engineering: building and tuning detections mapped to attacker techniques.
- Purple team and adversary emulation: planning exercises that validate whether controls work.
- Threat hunting: proactively searching telemetry for signs of intrusion, directly echoing the hunting emphasis in Domain 10.
- Incident response: containing and investigating confirmed compromises.
- Security architecture and hardening: reducing attack paths in directory services, endpoints, and networks.
Organizations that operate large Windows estates, managed security providers, consultancies, and enterprise security teams are the usual places these titles appear. For a closer look at role types and where the credential is requested, see our overview of GDAT jobs. Compensation varies widely with region, seniority, and employer, and no issuer-published salary figure was verified for this credential, so our GDAT salary guide discusses earnings qualitatively rather than quoting numbers you cannot rely on.
Frequently Asked Questions
Here it means GIAC Defending Advanced Threats, a certification administered by GIAC Certifications. It is unrelated to other credentials that happen to share the acronym. See our guide to what GDAT is for background.
The public specification lists 75 questions in 2 hours, with a minimum passing score of 70%. GIAC points candidates to their own account for attempt-specific format and question types, so confirm those details there.
Yes, the exam is open book. Permitted materials include hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited, so your printed index is your main lookup tool.
No. There are no formal certification prerequisites, and training is recommended rather than required. SEC599 is the affiliated preparation course, and its curriculum is not an official statement of exam domain weights or exhaustive exam coverage.
It is valid for four years. You renew by earning 36 CPE credits or by taking a renewal examination, and either route also requires the renewal fee, which is listed at USD 499. Check GIAC's renewal pages for current procedures before your certification expires.