- What GIAC Defending Advanced Threats Actually Tests
- Exam Mechanics: Format, Fees, and the Open-Book Rules
- The Ten Domains and What to Master in Each
- Using SEC599 and Other Preparation Sources Wisely
- Building an Index That Works Under Time Pressure
- A Domain-Ordered Study Sequence
- Exam-Day Execution
- Who Hires for This Credential
- Frequently Asked Questions
- The exam is 75 questions in 2 hours with a 70% minimum passing score, so pace yourself at under two minutes per question.
- GIAC publishes ten GDAT domain headings but no percentage weights, so do not trust any source claiming exact domain weightings.
- The exam is open book with hardcopy books, notes, and an index; electronic references and practice Q&A materials are prohibited.
- A standalone attempt costs USD 999 and gives 120 days of access from activation.
What GIAC Defending Advanced Threats Actually Tests
The GIAC Defending Advanced Threats (GDAT) certification, administered by GIAC Certifications, validates a practitioner's ability to understand how advanced adversaries operate and to build defenses that interrupt them. The ten published objective headings read like an attacker's playbook: from Active Directory and administrative access through payload delivery, execution, lateral movement, and data exfiltration, ending with reconnaissance, threat handling, and incident response. That structure tells you something important about how to study. You are not memorizing a defensive product catalog. You are learning to think along a kill chain and to place a detection or control at each link.
If you are still orienting yourself, the overview of what GDAT certification is covers the basics, and the GDAT requirements guide explains eligibility. In short, there are no formal certification prerequisites, though training is recommended. That lack of a gate does not mean the exam is gentle; the GDAT difficulty breakdown explains why experienced practitioners still need a deliberate plan.
Exam Mechanics: Format, Fees, and the Open-Book Rules
Knowing the logistics removes avoidable stress. The publicly stated specifications are one proctored, web-based exam with 75 questions, a 2-hour limit, and a minimum passing score of 70%. GIAC applies that passing-score specification to exam versions released on or after October 1, 2018. That date is a scoring applicability marker, not a syllabus revision date. Your assigned exam version was not something public sources could confirm, so treat your GIAC candidate account as the final word on your attempt's objectives, question types, format, and passing score.
| Item | Published detail |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 70% |
| Standalone attempt | USD 999 |
| Practice exam (listed separately) | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
| Attempt access window | 120 days from activation |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Certification validity | Four years |
Prices exclude applicable sales tax and training tuition. If you attempt the exam through SANS, the associated attempt is also USD 999, with course tuition additional. For a fuller picture of what you will spend, see the GDAT certification cost breakdown, and for scoring details see what the GDAT passing score means.
Two numbers worth doing math on
Seventy-five questions in 120 minutes gives you roughly 96 seconds per question on average. That is generous for recall questions and tight for scenario questions that require you to consult your index. A 70% minimum means you need at least 53 correct out of 75 if all questions count equally; the exact scoring treatment for your attempt is something to verify in your account. Do not read the passing score as a pass rate. No issuer-published pass rate was verified, which the GDAT pass rate discussion addresses in more depth.
Scheduling and the 120-day clock
A standalone attempt is accessible for 120 days from activation. That window is your real study deadline, so do not activate until you have finished your first full pass through the material and built your index. Testing runs through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules, so check the proctoring requirements well before your date. The GDAT exam dates and scheduling guide walks through the booking process.
The Ten Domains and What to Master in Each
The ten headings below come straight from the published objective list. For a deeper treatment of each, the complete GDAT exam domains guide goes domain by domain. Here, the focus is on the practical question: what should you be able to do or explain when you see this heading on a question?
Domain 1: Active Directory/Domains
Active Directory is the terrain on which most enterprise intrusions play out, so expect to reason about how adversaries abuse it and how defenders harden and monitor it.
- Know the trust relationships, authentication flows, and where credential material lives.
- Be able to connect a hardening or logging measure to the specific abuse it blunts.
- Practice reading a described scenario and identifying which AD weakness is being exploited.
Domain 2: Administrative Access
Privileged access is what turns a foothold into a breach. This domain rewards understanding how attackers obtain, escalate, and persist with elevated rights, and how to constrain them.
- Understand privilege tiering and why separating administrative roles limits blast radius.
- Know detection opportunities around privilege use and account changes.
- Be ready to rank defensive controls by how much attacker effort they add.
Domain 3: Adversary Emulation
This is where the purple-team mindset shows up. You should understand why emulation is used to validate defenses, not just attack them.
- Know how emulation plans map adversary behavior to detection coverage.
- Understand how findings feed back into control and detection improvements.
- Be able to explain the value of repeatable, scoped emulation versus ad hoc testing.
Domain 4: Application Exploitation
Expect questions on how application weaknesses give adversaries entry or execution and what compensating defenses reduce that risk.
- Recognize exploitation patterns and the mitigations that counter them.
- Link application-layer events to the kill-chain stage they represent.
Domain 5: Data Exfiltration
The end goal of many intrusions. Study how data leaves a network and how to detect or constrain it.
- Understand common exfiltration channels and what telemetry exposes them.
- Be able to choose between preventive and detective controls for a given channel.
Domain 6: Installation
Persistence and implant installation. Questions here test whether you can spot how an adversary maintains access and how to find and remove it.
- Know the common persistence locations and the artifacts they leave.
- Pair each persistence technique with a detection or prevention approach.
Domain 7: Lateral Movement
Moving between systems is where network segmentation, credential hygiene, and monitoring pay off.
- Understand the techniques used to pivot and the logs that reveal them.
- Be able to explain which architectural controls make lateral movement harder.
Domain 8: Payload Delivery
How malicious content reaches a target, and which email, web, and endpoint controls intercept it.
- Know delivery vectors and the layered controls that address each.
- Be ready to evaluate which control stops delivery earliest in the chain.
Domain 9: Payload Execution
Once content lands, what lets it run, and what stops it? Application control, script restrictions, and execution monitoring are central themes.
- Understand execution mechanisms and the restrictions that block or expose them.
- Practice distinguishing a prevention control from a detection control.
Domain 10: Reconnaissance, Threat Handling, and Incident Response
This heading is retained exactly as GIAC words it. Its outcome statement and the SEC599 course both discuss threat hunting, so treat hunting as part of how you prepare for it.
- Understand adversary reconnaissance and how defenders can detect or deceive it.
- Know how detection, hunting, and incident response workflows connect.
- Be able to reason about response priorities in a described incident.
Using SEC599 and Other Preparation Sources Wisely
The affiliated preparation course is SANS SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses. It is a useful alignment with the exam's kill-chain orientation, but be precise about what it is. Course sections, labs, and capstones are preparation curriculum, and they do not establish official exam-domain counts, weights, or exhaustive exam coverage. Likewise, SANS's Purple Team Course FAQ describes course-emphasis percentages, and those are not GDAT exam weights. Do not translate a course emphasis into a study-time ratio for the exam.
SANS has also publicized a preparation-course update, announced in an August 25, 2025 agenda titled "Purple Teaming Reloaded: AI, Adversaries & the New SEC599." That documents a change to the course, not an exam-version change. If you are weighing training, the GDAT training guide compares your options, and the GDAT ROI analysis helps you decide whether the investment fits your goals.
Practice material: know the line you cannot cross
Practice and exam question-and-answer materials are prohibited in the testing room, and electronic references are prohibited as well. That affects how you build your reference set: it must be hardcopy. Separately, GIAC lists a practice exam at USD 399, and you can also supplement with our GDAT practice tests to rehearse question style and timing before you commit your attempt window.
Building an Index That Works Under Time Pressure
Because the exam is open book with permitted hardcopy books, notes, and an index, your index is effectively a study tool you get to bring into the room. A weak index wastes time; a strong one converts your 96-second average into a comfortable pace. For a quick-reference companion, the GDAT cheat sheet distills the facts worth memorizing so your index can focus on lookups instead.
- Index terms, not pages. Record the technique, control, or concept name and where it is covered, rather than copying summaries.
- Tag each entry by kill-chain stage. Add a domain tag so a scenario question can lead you to every relevant reference quickly.
- Pair every attack with its defense. When you find an attack technique, your index should point you to the preventive and detective counterpart.
- Mark your weak spots. Flag entries you got wrong in practice so you know where to look first on exam day.
- Test it under the clock. Run a timed practice set using only your hardcopy materials to confirm the index actually speeds you up.
Key Takeaway
Aim to know the material well enough that you look things up only to confirm details, not to learn them. If you are looking up a concept for the first time during the exam, the time math stops working in your favor.
A Domain-Ordered Study Sequence
You have 120 days of access once you activate, but you should do most of your learning before that clock starts. Here is one way to sequence the domains, grouped by dependency rather than by the published order. Adjust the length to your experience and your work schedule; this is a template, not a prescription.
Foundations: Active Directory and Administrative Access
- Cover Active Directory/Domains first, since later domains assume you understand the environment.
- Move into Administrative Access while the AD concepts are fresh.
- Begin your index with these entries.
Entry and Execution: Payload Delivery, Payload Execution, Application Exploitation
- Study these together as the front half of the kill chain.
- For each, write the earliest point a defender can intervene.
Spread and Theft: Installation, Lateral Movement, Data Exfiltration
- Tie persistence to the detection artifacts it leaves.
- Map lateral movement techniques to the architectural controls that slow them.
Validation and Response: Adversary Emulation, Reconnaissance, Threat Handling, and Incident Response
- Revisit every earlier domain through the lens of emulation and detection coverage.
- Finish the index, then run timed full-length practice sets against it.
The reasoning behind this order: Active Directory and administrative access underpin nearly every later scenario, so learning them first makes everything else easier to place. Adversary Emulation and the response domain come last because they synthesize what came before. If your timeline is shorter, compress the weeks but keep the order, and spend any spare time on timed practice rather than on a second pass through your strongest domains.
Exam-Day Execution
Whether you test onsite through Pearson VUE or remotely through ProctorU, review the GIAC proctoring and candidate agreement rules in advance, because modality rules apply and prohibited items are enforced. Remote candidates should prepare the room and equipment ahead of time; onsite candidates should plan arrival and ID.
- First pass fast. Answer questions you know immediately and flag anything that needs an index lookup.
- Budget your lookups. With about 96 seconds per question on average, cap how long you spend on any single reference search.
- Read for the kill-chain stage. Identify which stage a scenario sits in before you evaluate the answer choices; it often eliminates two options.
- Leave review time. Reserve the final stretch to revisit flagged items rather than rushing the last questions.
If the first attempt does not go your way, the published retake fee is USD 899. Plan your preparation so that you only pay it as insurance, not as a strategy.
Who Hires for This Credential
GDAT's content points toward roles that sit between offense and defense: security operations and detection engineering, incident response and threat hunting, purple-team and adversary-emulation functions, and security architecture where kill-chain controls get designed. Employers in those functions tend to value people who can explain why a control works against a specific adversary behavior, which is exactly what the domain list trains. For role titles and where employers use the credential, see the GDAT jobs overview, and for compensation context see the GDAT salary guide. No salary figures are quoted here because none are verified in the issuer's materials.
Keep the credential current once you have it. The certification is valid for four years, and you can renew with 36 CPE credits or by renewal examination, plus the renewal fee (standard renewal is USD 499). Budgeting for that from the start avoids a surprise later. If you want to benchmark yourself before committing, take a free diagnostic on our main practice test site and see how you handle scenario-style questions across the kill chain.
Frequently Asked Questions
The published specification is 75 questions in 2 hours, delivered as a proctored web-based exam. The minimum passing score is 70%. Confirm your specific attempt's format and question types in your GIAC account, which is the authority for attempt-specific details.
Yes. The exam is open book with permitted hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice and exam question-and-answer materials. Build a hardcopy index organized by technique, kill-chain stage, and domain.
No formal certification prerequisites are listed, and training is recommended rather than required. SEC599 is the affiliated preparation course, but its sections and labs are not official exam-domain weights. You can attempt the exam on a standalone basis for USD 999.
GIAC's public outline lists the ten domain headings but supplies no percentage weights, so equal weighting should not be assumed and neither should any specific split. Prepare broadly across all ten, and read the GDAT domains guide for detail on each area.
A standalone attempt gives you 120 days of access from activation. A retake is listed at USD 899. Prices exclude applicable sales tax and training tuition, so check GIAC's current pricing page before you budget.