- The Number: 70% on a 75-Question Exam
- What 70% Actually Means for Your Question Count
- Why the Passing Score Is Not a Pass Rate
- Your Exam Version and the October 2018 Scoring Rule
- Where Points Come From: The 10 Domains
- Open-Book Rules and Their Effect on Your Score
- Fees, Attempt Access, and Retake Economics
- Building a Plan That Clears 70%
- After You Pass: Validity and Renewal
- Frequently Asked Questions
- GIAC sets the minimum passing score for GDAT at 70%, on a proctored exam of 75 questions in 2 hours.
- The 70% figure is a cut score, not a pass rate; GIAC has not published a verified GDAT pass rate.
- Your own account at exams.giac.org/pages/attempts is the authority for your attempt's format and passing score.
- The exam is open book with hardcopy books, notes, and an index; electronic references are prohibited.
The Number: 70% on a 75-Question Exam
If you are searching for the GDAT passing score, the short answer is 70%. GIAC Defending Advanced Threats is delivered as a single proctored, web-based exam with 75 total questions and a 2-hour time limit. GIAC lists the minimum passing score at 70%, and that specification applies to exam versions released on or after October 1, 2018.
That is the headline. The rest of this article covers what the number does and does not tell you, how it interacts with the ten published exam domains, and how to plan your preparation so that 70% is a floor you clear comfortably rather than a line you hope to scrape past. If you are still orienting yourself to the credential itself, start with What Is GDAT Certification? and then return here.
What 70% Actually Means for Your Question Count
On a 75-question exam, 70% works out to 52.5 questions. Because you cannot answer half a question correctly, the practical reading is that you need roughly 53 correct answers if every question carries equal weight. Treat that arithmetic as an approximation, not a guarantee. GIAC states the minimum passing score as a percentage, and your assigned version may differ in format or question types from what any public description suggests.
Two cautions follow from that:
- Do not assume every item is worth the same. GIAC points you to your candidate account for attempt-specific question types, format, and passing score. Use that page, not a forum post, as the authority for how your attempt is scored.
- Do not budget to the bare minimum. If your practice results hover near 70%, ordinary variation between question sets can push you under. Plan to practice well above the line.
For a sense of how demanding the content is relative to that cut score, see How Hard Is the GDAT Exam? Complete Difficulty Guide 2026.
Pacing at 75 questions in 2 hours
Two hours across 75 questions averages out to a little over a minute and a half per question. Because the exam is open book, the real pacing risk is not recall; it is the time you burn flipping through your index on questions you could have answered from understanding. Candidates who reach for a book on every item run out of clock. Candidates who never reach for one miss easy confirmations. The balance is to answer from knowledge first and use your index for the questions where a specific tool behavior, log field, or technique detail matters.
Why the Passing Score Is Not a Pass Rate
This is the most common confusion in exam-prep searches. The minimum passing score is the percentage of questions you must answer correctly to earn the certification. A pass rate is the share of all candidates who succeed. They are unrelated figures.
| Concept | What it measures | Status for GDAT |
|---|---|---|
| Minimum passing score | Your required percentage correct | 70% (published by GIAC) |
| Pass rate | Share of all candidates who pass | No issuer-published figure verified |
| Practice score | Your performance on unofficial materials | Useful signal, not a prediction |
You will see confident pass-rate claims in various places. For GDAT, no issuer-published pass rate was verified, so any specific percentage you encounter should be treated as unsupported. Our own discussion of what is and is not known lives in GDAT Pass Rate 2026: What the Data Shows.
Your Exam Version and the October 2018 Scoring Rule
GIAC applies the 70% passing-score specification to exam versions released on or after October 1, 2018. That date is a scoring applicability date. It is not a syllabus revision date, and it does not tell you when the objectives last changed. The candidate's assigned exam version is not something a public page can tell you.
There is a related point worth keeping straight. SANS publicly announced a refreshed SEC599 preparation course, "Purple Teaming Reloaded: AI, Adversaries & the New SEC599," on August 25, 2025. That agenda documents an update to the training course. It is not evidence of an exam-version change, so do not assume the exam changed because the course did.
Where Points Come From: The 10 Domains
GIAC publishes the GDAT exam objectives as ten headings. The public outline does not attach percentage weights to them, so any claim that a particular domain is "worth" a given share of the exam is not supported by the published material. What the ten headings do give you is a map of the territory, and because you need roughly 70% overall, weak coverage of even a few areas can sink your score. The detailed breakdown is in GDAT Exam Domains 2026: Complete Guide to All 10 Content Areas; here is how to think about them through a scoring lens.
Domain 1: Active Directory/Domains
Identity infrastructure is central to how advanced adversaries move and persist, and equally central to how defenders detect them.
- Know how domain structures, trusts, and authentication relate to attacker tradecraft
- Be able to reason about both abuse paths and the defensive controls that break them
Domain 2: Administrative Access
Privileged access is a recurring theme across advanced attack chains.
- Understand how elevated access is obtained, abused, and constrained
- Connect privilege concepts to the preventive and detective measures that address them
Domain 3: Adversary Emulation
GDAT sits in purple-team territory, where red and blue perspectives meet.
- Understand how emulating adversary behavior validates defensive coverage
- Be ready to interpret a technique from both the attacker's and the defender's side
Domains 4 through 9: The Kill-Chain Stages
Application Exploitation, Data Exfiltration, Installation, Lateral Movement, Payload Delivery, and Payload Execution cover the progression of an intrusion.
- Learn each stage as a pair: how the technique works and where defenders can disrupt or detect it
- Expect questions that test whether you can place an activity at the correct stage
Domain 10: Reconnaissance, Threat Handling, and Incident Response
This is the exact GIAC heading, and its outcome statement discusses threat hunting.
- Cover how defenders hunt for adversary activity and respond once it is found
- Tie reconnaissance observations to detection and handling decisions
Because the outline is unweighted, the safe strategy is breadth first. Avoid the trap of mastering two favorite domains and neglecting the rest, since a 70% threshold across 75 questions leaves little room to write off an entire area.
Open-Book Rules and Their Effect on Your Score
GDAT is open book. You may bring permitted hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice-exam and exam question-and-answer materials. That last restriction matters: materials that reproduce exam questions have no place in your preparation or in your testing room.
How you test also shapes logistics. GIAC lists Pearson VUE for onsite testing and ProctorU for remote delivery, subject to GIAC modality rules. Review the GDAT exam dates and scheduling guide and the proctoring documents GIAC publishes before exam day so that your reference materials and testing environment comply.
Key Takeaway
An open-book exam rewards a good index, not a thick pile of books. Build your index while you study, organized by technique, tool, and kill-chain stage, so you can confirm a detail in seconds instead of searching for it.
Indexing for a purple-team exam
Because GDAT questions pair offensive technique with defensive response, a single-axis index is weak. Consider cross-referencing each entry two ways: by the attacker action and by the detection or mitigation. That way, whether a question starts from "how would an adversary do this" or "how would you catch this," you land on the same page. The full approach to building these resources sits in the GDAT Study Guide 2026: How to Pass on Your First Attempt, and a condensed reference is in the GDAT Cheat Sheet 2026.
Fees, Attempt Access, and Retake Economics
The passing score is easier to take seriously when you see what a miss costs. All figures below exclude applicable sales tax and training tuition.
| Item | Amount (USD) |
|---|---|
| Standalone exam attempt | 999 |
| Separately listed practice exam | 399 |
| Retake | 899 |
| Standard renewal | 499 |
| SANS-associated exam attempt (course tuition additional) | 999 |
A standalone attempt gives you access for 120 days from activation, so the clock starts when you activate rather than when you pay. Plan your schedule so that activation coincides with the point at which you are actually ready to test. For the full financial picture, including how training tuition changes the total, see GDAT Certification Cost 2026: Complete Pricing Breakdown.
The economics point in one direction: a retake at USD 899 is nearly as expensive as the original attempt. Using the separately listed GIAC practice exam is one way to gauge readiness, and quality unofficial practice from our GDAT practice test site can supplement it. Neither substitutes for a score comfortably above the line in your own timed practice.
Building a Plan That Clears 70%
There is no formal prerequisite for GDAT, though training is recommended; the details are in GDAT Requirements 2026. The affiliated preparation course is SANS SEC599, which covers the purple-team and kill-chain material the exam objectives echo. One caution: SEC599's sections, labs, and capstone, and the course-emphasis percentages in SANS's Purple Team Course FAQ, describe the course. They do not establish official exam-domain counts, weights, or exhaustive exam coverage. Use the course as preparation, and the GIAC objectives as the measure of what you must know.
If you want a schedule tied to the domains, one reasonable sequencing follows. It is a suggestion, not an official blueprint, since GIAC publishes no weights.
Identity foundations
- Active Directory/Domains: structures, trusts, authentication
- Administrative Access: privilege paths and controls
Entry into the environment
- Payload Delivery and Payload Execution
- Application Exploitation and how it feeds the chain
Persistence, movement, and loss
- Installation and Lateral Movement
- Data Exfiltration and the detections that catch it
Defender workflow and integration
- Reconnaissance, Threat Handling, and Incident Response, including threat hunting
- Adversary Emulation, then timed full-length practice and index refinement
The logic is that identity and privilege concepts underpin most later stages, so they come first, while emulation and incident handling tie the earlier material together and suit the final week alongside timed practice. Stretch the schedule if your background in any domain is thin; four weeks assumes existing security fluency.
Calibrating against the cut score
Take timed practice under conditions that mimic the exam: 75 questions, 2 hours, only the references you will be allowed to bring. Track results by domain, not just overall. A strong overall score can hide a domain where you are consistently weak, and that weakness is exactly what a different question draw would expose. If you are comparing the credential against alternatives or wondering whether the effort pays off, Is the GDAT Certification Worth It? Complete ROI Analysis 2026 and the GDAT Salary Guide 2026 cover that angle.
After You Pass: Validity and Renewal
The certification is valid for four years. To renew, you can earn 36 CPE credits or sit a renewal examination, and either route requires the renewal fee, listed as USD 499 for standard renewal. Because renewal is a recurring cost, it belongs in any long-term assessment of the credential. Roles that tend to value this kind of purple-team and advanced-threat-defense skill are covered in GDAT Jobs, and training options are outlined in GDAT Training. GIAC's own renewal pages and its 2026 renewal how-to guide are the authority on current renewal mechanics.
Frequently Asked Questions
GIAC lists the minimum passing score at 70%. The exam has 75 questions and a 2-hour limit. Confirm the specifics for your own attempt in your GIAC candidate account.
Seventy percent of 75 is 52.5, so roughly 53 correct answers if all questions are weighted equally. Because GIAC points to your account for attempt-specific scoring details, treat that figure as an estimate rather than a guarantee.
No. The 70% figure is the score a candidate must reach. A pass rate describes how many candidates succeed overall, and no issuer-published pass rate for GDAT was verified.
No. GIAC applies the 70% specification to exam versions released on or after October 1, 2018. That is a scoring applicability date, not a syllabus revision date.
You would need to retake the exam at the listed retake fee of USD 899, excluding tax. Standalone attempt access runs 120 days from activation, so check your account for how that window applies to your situation before planning a second try.