- How the Official Outline Is Built
- Exam Format and Mechanics
- Domains 1, 2 and 10: Directory Services, Privilege, and Response
- Domain 3: Adversary Emulation
- Domains 4, 6, 8 and 9: Exploitation Through Execution
- Domains 5 and 7: Lateral Movement and Data Exfiltration
- Mapping SEC599 to the Domains
- Sequencing the Domains in Your Prep
- Who Values This Credential
- FAQ
- GIAC Defending Advanced Threats publishes 10 exam-objective headings, but no percentage weights, so never trust a "domain weight" figure.
- The exam is 75 questions in 2 hours with a 70% minimum passing score, open book with hardcopy materials only.
- Domain 10 pairs reconnaissance, threat handling, and incident response, so expect hunting and response thinking, not just attack knowledge.
- Attempt-specific objectives live in your GIAC account at exams.giac.org/pages/attempts; check there before finalizing your plan.
How the Official Outline Is Built
GIAC Defending Advanced Threats (GDAT) is a GIAC certification aimed at defenders who need to understand how advanced adversaries operate and how to stop them at each stage of an intrusion. The public objectives page lists 10 domain headings, and what stands out immediately is how they are organized. Most are named after phases of an attack chain rather than after defensive technologies: Installation, Lateral Movement, Payload Delivery, Payload Execution, Data Exfiltration. That naming tells you something about how to study. You are expected to think like the adversary at each phase and then know what detection and prevention looks like at that same phase.
The complete list, in the order GIAC publishes it, is:
- Active Directory/Domains
- Administrative Access
- Adversary Emulation
- Application Exploitation
- Data Exfiltration
- Installation
- Lateral Movement
- Payload Delivery
- Payload Execution
- Reconnaissance, Threat Handling, and Incident Response
Note that the listing is alphabetical rather than chronological, which is why Reconnaissance, an early attack phase, appears last and is bundled with response activities. Don't read the order as a priority ranking or a recommended study sequence. We cover sequencing later in this article.
Exam Format and Mechanics
Before diving into the domains, it helps to understand the container they come in. The GDAT is a single proctored, web-based exam with 75 questions and a 2-hour time limit. The minimum passing score is 70%. GIAC applies this passing-score specification to exam versions released on or after October 1, 2018; that date marks when the scoring rule applies and is not a syllabus revision date. Your assigned exam version may carry its own details, so GIAC points candidates to their account page at exams.giac.org/pages/attempts as the authority for attempt-specific objectives, question types, format, and passing score.
| Item | GDAT Detail |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Reference policy | Open book: hardcopy books, notes, and an index permitted; electronic references and practice or exam Q&A materials prohibited |
| Standalone attempt fee | USD 999 (SANS-associated attempt also USD 999, course tuition additional) |
| Practice exam | USD 399, listed separately |
| Retake | USD 899 |
| Attempt access window | 120 days from activation (standalone) |
| Validity | Four years; renew with 36 CPE credits or a renewal exam, plus USD 499 standard renewal fee |
Prices exclude applicable sales tax and training tuition. For a fuller financial picture, read our GDAT certification cost breakdown, and for scheduling logistics see GDAT exam dates and scheduling. There are no formal certification prerequisites, though training is recommended; our GDAT requirements guide explains what that means in practice.
The open-book rule shapes how you should study. With roughly 96 seconds per question on average, you cannot afford to hunt through poorly organized notes. Candidates who build a clean, domain-keyed index while studying tend to find it a major advantage; those who show up with a stack of unindexed pages tend to burn time. We cover the index strategy further in the GDAT study guide.
Domains 1, 2 and 10: Directory Services, Privilege, and Response
These three domains form the identity-and-response backbone of the exam. In nearly every advanced intrusion, the adversary's real objective is control of identity, because identity is what grants access to everything else.
Domain 1: Active Directory/Domains
Active Directory is the central target in most enterprise intrusions, and defenders must know it well enough to harden it and to recognize abuse of it.
- How domain trust relationships and domain structure affect attacker reach
- Authentication mechanisms and where credentials can be stolen or forged
- Hardening practices that limit what a compromised account can touch
- Which directory events are worth logging and alerting on
Domain 2: Administrative Access
This domain covers how adversaries obtain and abuse elevated privileges, and how defenders constrain them.
- Privilege escalation paths on endpoints and in the domain
- Controls such as tiered administration, least privilege, and credential protection
- Detecting abnormal use of administrative tools and accounts
- Why a single over-privileged account can collapse an otherwise sound design
Domain 10: Reconnaissance, Threat Handling, and Incident Response
This heading is retained exactly as GIAC prints it. Its outcome statement and the affiliated SEC599 course both discuss threat hunting, so prepare for proactive detection as well as reactive response.
- How attackers gather information about your environment, and what defenders can observe of it
- Hypothesis-driven threat hunting and how to turn adversary behavior into detections
- Triage, containment, and eradication decisions during an active incident
- Feeding lessons from an incident back into preventive controls
Domains 1 and 2 reward candidates with hands-on Windows and Active Directory experience. If your background is network security or Linux, budget extra time here. Domain 10 is where blue-team and SOC experience pays off most directly, which is one reason the credential appeals to people moving into hunt and detection-engineering roles; see GDAT jobs for how employers frame those roles.
Domain 3: Adversary Emulation
Adversary Emulation is the domain that most clearly separates GDAT from a conventional defensive certification. It asks you to understand how defenders can safely replicate real attacker techniques to test their own controls, an approach commonly called purple teaming.
Domain 3: Adversary Emulation
Defenders who cannot reproduce an attacker technique cannot confirm whether their detections would catch it.
- Planning emulation exercises around realistic adversary behavior
- Mapping techniques to detections, and finding the gaps
- Using emulation results to prioritize defensive improvements
- The collaborative loop between offensive testers and defensive teams
Domains 4, 6, 8 and 9: Exploitation Through Execution
Four domains trace the middle of the kill chain: getting a foothold, delivering a payload, running it, and staying installed. They are best studied together because the same intrusion typically touches all four, and a control that breaks one link often changes what the others look like.
Domain 4: Application Exploitation
How adversaries abuse vulnerabilities in applications to gain initial execution, and how defenders reduce that exposure.
- Common exploitation outcomes and the mitigations that blunt them
- Patching, application hardening, and exploit-mitigation concepts
- Recognizing exploitation attempts in logs and telemetry
Domain 8: Payload Delivery
The routes by which malicious content reaches a victim system.
- Delivery vectors such as email-borne and web-borne content
- Filtering, sandboxing, and content-control defenses
- Reducing the success rate of user-targeted delivery through technical controls
Domain 9: Payload Execution
What happens when delivered content actually runs, and how defenders prevent or detect it.
- Application control and allow-listing concepts
- Script and living-off-the-land execution that evades simple signatures
- Endpoint telemetry that reveals suspicious process behavior
Domain 6: Installation
How adversaries establish durability on a compromised host so they survive reboots and cleanup.
- Common persistence locations and mechanisms
- Auditing and baselining to spot unauthorized persistence
- Integrity-monitoring approaches that surface unexpected changes
A useful way to hold these four in your head: Domain 4 is how they get in, Domain 8 is how the bad content arrives, Domain 9 is how it runs, and Domain 6 is how it stays. For each, learn one preventive control and one detective control. If you can name both, you are working at the level the exam targets.
Domains 5 and 7: Lateral Movement and Data Exfiltration
These two domains cover what happens after the initial foothold, which is where defenders get the most leverage because adversaries must act inside an environment you control.
Domain 7: Lateral Movement
How attackers pivot from their first compromised system toward higher-value targets.
- Remote-service and credential-based movement techniques
- Network segmentation and host-firewall strategies that restrict east-west traffic
- Detecting unusual authentication and remote-execution patterns
- Why credential hygiene and lateral movement defense are tightly linked to Domains 1 and 2
Domain 5: Data Exfiltration
How stolen data leaves the environment, and how defenders notice or block it.
- Common exfiltration channels and covert transfer methods
- Egress filtering, proxying, and traffic-analysis approaches
- Data-loss-prevention thinking and baselining of normal outbound behavior
Key Takeaway
Lateral Movement and Active Directory questions overlap heavily. When you learn a movement technique, also note which credential or privilege weakness enables it. Cross-referencing these in your index lets you find answers quickly under time pressure.
Mapping SEC599 to the Domains
The affiliated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. Its title mirrors the exam's attack-chain framing, and a public syllabus brochure is available from SANS. Two cautions are worth stating plainly.
- Course structure is not exam structure. SEC599 course sections, labs, and capstones do not establish official exam-domain counts, weights, or exhaustive coverage. Do not assume that a course day maps neatly to one exam domain.
- Course-emphasis percentages are not exam weights. SANS publishes a Purple Team Course FAQ that describes emphasis within the course. Those figures describe teaching time, not how many exam questions each domain contributes.
SANS has also announced an update to the course, presented in a public webinar agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599" (August 25, 2025). That agenda documents a change to the preparation course, not a change to the exam version. Only the public agenda was reviewed here, so check your own GIAC account for the objectives tied to your attempt rather than assuming the course update altered the exam.
Training is not mandatory; the standalone path exists and costs the same USD 999 attempt fee. Whether the course is worth adding depends on your experience and budget, a question we examine in is the GDAT certification worth it and on our GDAT training page.
Sequencing the Domains in Your Prep
Generic study techniques matter less than ordering the material sensibly. Because the domains are attack-chain phases that depend on identity concepts, this sequence works well for most candidates, with each week tied to specific domains:
Identity foundations
- Domain 1: Active Directory/Domains
- Domain 2: Administrative Access
- Why first: these underpin lateral movement and most persistence questions
Getting in and running
- Domain 4: Application Exploitation
- Domain 8: Payload Delivery
- Domain 9: Payload Execution
Staying and spreading
- Domain 6: Installation
- Domain 7: Lateral Movement
- Domain 5: Data Exfiltration
Tie it together
- Domain 3: Adversary Emulation
- Domain 10: Reconnaissance, Threat Handling, and Incident Response
- Finalize and cross-reference your index; take timed practice runs
Leave Domains 3 and 10 for last because they synthesize everything else: emulation tests your understanding of every earlier technique, and hunting and response require knowing what each phase looks like in telemetry. A timed run against 75 questions in 2 hours, using only your permitted printed materials, is the best final check. You can build that habit with the practice questions on our main practice test site. Remember that the exam prohibits electronic references and practice or exam question-and-answer materials in the testing room, so everything you bring must be your own hardcopy notes, permitted books, and index.
If you are unsure how demanding this will feel, our GDAT difficulty guide breaks down where candidates typically struggle, and the GDAT pass rate article explains why no issuer-published pass rate has been verified.
Who Values This Credential
Because the exam spans attack techniques and defensive response, it resonates with roles that sit between offense and defense. Typical audiences include SOC analysts moving into hunting, detection engineers, incident responders, security architects hardening Windows environments, and purple-team practitioners. Employers in regulated industries and large enterprises with mature security programs tend to appreciate the kill-chain framing because it maps onto how they structure detection coverage.
As for compensation, we avoid quoting unsupported figures here; our GDAT salary guide discusses earnings qualitatively and explains the variables that matter, such as location, seniority, and role. The certification stays valid for four years, renewable via 36 CPE credits or a renewal exam plus the USD 499 renewal fee, which is worth factoring into long-term ROI.
If you are new to the credential itself, start with what GDAT certification is, or keep this article alongside our GDAT cheat sheet for quick review. When you are ready to test yourself against realistic questions, head to the GDAT Exam Prep practice tests.
FAQ
GIAC's public objectives list 10 domain headings: Active Directory/Domains, Administrative Access, Adversary Emulation, Application Exploitation, Data Exfiltration, Installation, Lateral Movement, Payload Delivery, Payload Execution, and Reconnaissance, Threat Handling, and Incident Response.
The public outline supplies no percentage weights, so none can be stated reliably. Prepare for all 10 areas, and check your GIAC account at exams.giac.org/pages/attempts for objectives specific to your assigned exam version.
It is one proctored, web-based exam with 75 questions in 2 hours and a minimum passing score of 70%. It is open book, but only hardcopy books, notes, and an index are permitted.
No. SEC599 is affiliated preparation, but its sections, labs, and course-emphasis percentages do not establish official exam-domain counts or weights. Use the GIAC objectives as the authority on exam scope.
Start with Active Directory/Domains and Administrative Access, since identity concepts underpin lateral movement, persistence, and response questions. Save Adversary Emulation and Reconnaissance, Threat Handling, and Incident Response for last, as they synthesize the rest.