- The Exam at a Glance
- Fees, Access Window, and Renewal Numbers
- The 10 Published Domains in One Pass
- Memorizing the Domains as an Attack Chain
- Open-Book Rules and Index Strategy
- Where SEC599 Fits (and Where It Doesn't)
- A Domain-Ordered Review Schedule
- Where This Credential Shows Up in Hiring
- Facts People Commonly Get Wrong
- FAQ
- GDAT is one proctored exam: 75 questions, 2 hours, 70% minimum passing score.
- The public outline lists 10 domains and publishes no percentage weights, so study all of them.
- The exam is open book with hardcopy materials only; electronic references are prohibited.
- A standalone attempt costs USD 999 and gives 120 days of access from activation.
The Exam at a Glance
This page condenses the verifiable facts about GIAC Defending Advanced Threats into something you can review in a few minutes. GDAT is administered by GIAC Certifications and focuses on defending against advanced adversaries across the full attack lifecycle, from initial reconnaissance through data exfiltration. If you are still orienting yourself, start with what GDAT certification is and come back here for the numbers.
| Item | Fact |
|---|---|
| Issuer | GIAC Certifications |
| Format | One proctored, web-based exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Prerequisites | None formal; training recommended |
| Testing options | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Validity | Four years |
Two hours for 75 questions works out to a little under two minutes per question on average. That is tight for an open-book exam, which is why your index matters so much (more on that below). For a deeper look at the threshold itself, see GDAT passing score: exactly what you need to pass.
Fees, Access Window, and Renewal Numbers
The cost side of GDAT is easy to memorize because there are only a handful of figures. All prices exclude applicable sales tax and training tuition.
| Item | Amount / Rule |
|---|---|
| Standalone exam attempt | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal fee | USD 499 |
| SANS-associated exam attempt | USD 999, with course tuition additional |
| Standalone attempt access | 120 days from activation |
| Renewal requirement | 36 CPE credits or a renewal exam, plus the renewal fee |
The 120-day clock matters more than most candidates realize. It starts at activation, not at purchase planning, so do not activate an attempt until your index is built and your lab time is mostly done. A full breakdown of how these figures combine into a realistic budget lives in GDAT certification cost: complete pricing breakdown, and scheduling mechanics are covered in GDAT exam dates, testing windows, and deadlines.
Note that the standalone price and the SANS-associated attempt price are both USD 999. The difference is that the course route adds tuition on top. Choosing between them is a question of how you learn best, not a question of exam-fee savings.
The 10 Published Domains in One Pass
GIAC's public objectives list ten domain headings. The public outline does not publish percentage weights, so nobody can honestly tell you that one domain is worth a specific share of the exam. Treat all ten as fair game. The full treatment of each lives in GDAT exam domains: complete guide to all 10 content areas; here is the cheat-sheet version.
1. Active Directory/Domains
Identity infrastructure is the center of gravity for most enterprise intrusions, so expect questions on how domain environments are structured and how attackers abuse them.
- How domain trust, authentication, and privilege relationships create attack paths
- Which hardening and monitoring controls blunt directory-focused attacks
2. Administrative Access
Once an adversary holds elevated rights, defenders lose most of their margin. This domain is about controlling, auditing, and limiting privileged access.
- How elevated access is obtained, abused, and detected
- Defensive patterns that constrain administrative reach
3. Adversary Emulation
GDAT treats emulation as a defensive skill: you validate controls by running realistic attacker behavior against them.
- Planning emulation around known adversary techniques
- Using results to find and close detection and prevention gaps
4. Application Exploitation
Attackers who cannot phish their way in often exploit software. Know how exploitation works well enough to evaluate mitigations against it.
- Exploitation concepts and the protections designed to counter them
- How exploitation fits into a broader kill chain
5. Data Exfiltration
The attacker's end goal in many campaigns. Defensive questions focus on recognizing and interrupting data leaving the environment.
- Common exfiltration channels and what they look like on the wire
- Egress controls and monitoring that expose staging and transfer
6. Installation
Persistence and foothold establishment. This is where an intrusion tries to survive reboots and credential changes.
- Persistence mechanisms and the artifacts they leave behind
- Controls that prevent or surface unauthorized installation
7. Lateral Movement
How an adversary pivots from the first compromised system toward valuable targets, and how segmentation and detection interrupt that pivot.
- Techniques for moving between hosts with legitimate protocols and credentials
- Detection and containment strategies that make movement noisy
8. Payload Delivery
The routes by which malicious content reaches a target environment, and the layered controls that stop it.
- Common delivery vectors
- Preventive controls at the email, web, and endpoint layers
9. Payload Execution
What happens after a payload lands. Defenders need to stop or detect code running even when delivery controls fail.
- Execution techniques and the telemetry they generate
- Application control and endpoint hardening that constrain execution
10. Reconnaissance, Threat Handling, and Incident Response
This is the exact GIAC heading, and its outcome statement discusses threat hunting. Expect both proactive hunting and reactive response.
- Recognizing and limiting attacker reconnaissance
- Hunting for hidden activity and handling incidents once detected
Memorizing the Domains as an Attack Chain
The domain list is alphabetical, but attacks are not. Reordering the headings into a plausible intrusion sequence turns ten labels into a story you can recall under time pressure. This is a memory aid, not an official ordering or weighting.
- Reconnaissance, Threat Handling, and Incident Response: the adversary scouts; defenders hunt and eventually respond.
- Payload Delivery: malicious content reaches a user or system.
- Application Exploitation: software flaws give initial code execution.
- Payload Execution: attacker code runs.
- Installation: persistence is established.
- Administrative Access: privileges are escalated.
- Active Directory/Domains: identity infrastructure becomes the lever.
- Lateral Movement: the adversary spreads toward objectives.
- Data Exfiltration: the objective is achieved.
- Adversary Emulation: the defender's loop for testing whether all of the above would be caught.
Open-Book Rules and Index Strategy
GDAT is open book, but within limits. Permitted materials are hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice and exam question-and-answer materials. That last restriction is worth stating plainly: you cannot bring in a printed bank of practice questions with answers.
- Build the index while you study, not after. An index assembled the night before captures nothing you actually understood.
- Index by concept and by tool or technique name. Scenario questions describe behavior; you will search by what the attacker is doing.
- Record the location, not the explanation. With under two minutes per question on average, the index should point you to the right page fast; it cannot replace comprehension.
- Cross-reference adjacent stages. Because the domains chain together, a persistence concept often links to an execution or lateral movement concept.
Because of the time limit, open book is a safety net rather than a strategy. If you must look up most answers, you will run out of clock. For a realistic picture of how this plays out, see how hard the GDAT exam is.
Where SEC599 Fits (and Where It Doesn't)
The affiliated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. It is the natural training companion to this credential, and the pairing explains why the exam is organized around attacker stages. Candidates who want course-based preparation should read GDAT training options alongside this section.
Keep three cautions in mind, because they prevent common planning mistakes:
- Course structure is not exam structure. SEC599 sections, labs, and capstones do not establish official exam-domain counts, weights, or exhaustive exam coverage. Use the ten GIAC headings as your checklist, and use the course as a way to learn them.
- Course-emphasis percentages are not exam weights. SANS's Purple Team Course FAQ describes how the course allocates emphasis. Those figures describe teaching time, not scoring.
- A course update is not an exam update. SANS has publicly announced a refreshed SEC599 that adds AI-related material. That is a change to the preparation course. It is not evidence that the exam version has changed, and your account page remains the authority on your attempt.
Key Takeaway
Plan your study around GIAC's ten published domain headings, and treat SEC599 material as a teaching resource for those headings rather than as a map of the exam. Training is recommended but not required, since there are no formal prerequisites; see GDAT requirements and eligibility for the full picture.
A Domain-Ordered Review Schedule
Generic study advice is plentiful, so here is only the GDAT-specific part: the order in which to tackle the domains. The sequence below follows the attack chain, so each week builds context for the next. Adjust the pacing to your own timeline and the 120-day access window; the full method is laid out in the GDAT study guide for passing on your first attempt.
Front of the chain
- Reconnaissance, Threat Handling, and Incident Response (hunting fundamentals first, since hunting recurs everywhere)
- Payload Delivery
- Start your index with section headings and technique names
Getting code to run
- Application Exploitation
- Payload Execution
- Compare which controls stop exploitation versus which only detect execution
Staying and escalating
- Installation
- Administrative Access
- Active Directory/Domains
Spreading and leaving
- Lateral Movement
- Data Exfiltration
- Adversary Emulation as the capstone: connect every earlier stage to a test you could run
Integration
- Timed practice against the 75-question, 2-hour constraint using the GDAT practice tests
- Clean up and cross-reference the index; do not activate your attempt until this is done
Where This Credential Shows Up in Hiring
GDAT sits on the defensive side of advanced threat work, so it aligns best with roles that blend detection, response, and validation: security operations analysts, threat hunters, incident responders, detection engineers, and purple team practitioners. Because the exam spans offensive technique awareness and defensive controls, it also suits security engineers who need to justify control investments against realistic attacker behavior.
Employers rarely list a single certification as a sole requirement, so treat it as evidence of structured knowledge across the kill chain rather than a standalone ticket. For a look at how job postings frame it, read GDAT jobs. For compensation, no verified figures are cited on this page; the qualitative discussion in the GDAT salary guide and the broader ROI analysis are better places to weigh the investment against your own market.
Facts People Commonly Get Wrong
The 70% figure is not a pass rate
The 70% minimum passing score is the score you need on the exam. It says nothing about what share of candidates pass, and no issuer-published pass rate has been verified. If you see a specific pass-rate number attributed to this exam, treat it with suspicion. The honest discussion is in GDAT pass rate: what the data shows.
The October 1, 2018 date is not a syllabus date
GIAC applies its passing-score specification to exam versions released on or after October 1, 2018. That is a scoring applicability date. It does not tell you when the syllabus was last revised.
No domain has a published weight
The public outline lists ten headings and no percentages. Any claim that a domain is "worth 20%" is not drawn from the public objectives.
"GDAT" is easy to confuse with other acronyms
This acronym is used by other credentials and terms elsewhere. Everything on this page refers only to GIAC Defending Advanced Threats. If you are sorting out the terminology, what GDAT stands for clears it up.
Renewal is a four-year cycle with two paths
The certification lasts four years. You renew by earning 36 CPE credits or by taking a renewal examination, and in either case you pay the renewal fee. Plan CPE collection early so you are not scrambling near expiration.
FAQ
The exam has 75 questions and a 2-hour time limit, delivered as a single proctored web-based exam. Confirm question types and format for your own attempt in your GIAC account, which is the authority for attempt-specific details.
The minimum passing score is 70%. This is a score threshold, not a pass-rate statistic. The details, including the version applicability date, are in our passing score breakdown.
Yes, within limits. Hardcopy books, notes, and an index are permitted. Electronic references and practice or exam question-and-answer materials are prohibited. Check GIAC's proctoring rules for your chosen testing modality, whether Pearson VUE onsite or ProctorU remote.
A standalone attempt is USD 999 and provides 120 days of access from activation. A retake is USD 899 and the separately listed practice exam is USD 399. Prices exclude applicable sales tax and training tuition.
No. There are no formal certification prerequisites, though training is recommended. SEC599 is the affiliated SANS course, and the SANS-associated exam attempt is also USD 999 with course tuition additional. Candidates who self-study can use targeted practice from the main practice test site alongside the official domain headings.