GIAC Certified Enterprise Defender (GCED) Exam Syllabus
Use this quick start guide to collect all the information about GIAC GCED Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the GIAC Certified Enterprise Defender (GCED) exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual GIAC Certified Enterprise Defender (GCED) certification exam.
The GIAC GCED certification is mainly targeted to those candidates who want to build their career in Cyber Defense domain. The GIAC Certified Enterprise Defender (GCED) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of GIAC GCED.
GIAC GCED Exam Summary:
| Exam Name | GIAC Certified Enterprise Defender (GCED) |
| Exam Code | GCED |
| Exam Price | $999 (USD) |
| Duration | 180 mins |
| Number of Questions | 115 |
| Passing Score | 69% |
| Books / Training | SEC501: Applied Cyber Defense |
| Schedule Exam | PearsonVUE |
| Sample Questions | GIAC GCED Sample Questions |
| Practice Exam | GIAC GCED Certification Practice Exam |
GIAC GCED Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Attack Surface Management | - Candidates will demonstrate the ability to identify, assess, and prioritize attack surface exposures and vulnerabilities. Candidates will demonstrate familiarity with the MITRE ATT&CK and D3FEND frameworks, the use of open-source intelligence (OSINT) techniques to understand attacker reconnaissance and attack phases and be able to describe the phases of enterprise vulnerability management. |
| Configuration Management and Automation Workflows | - Candidates will demonstrate the ability to maintain secure configurations and automate continuous hardening using modern defensive practices including mitigating configuration drift and leveraging automation and AI-assisted tools to manage configuration. |
| Engineered Telemetry through Defensive Controls | - Candidates will demonstrate the ability to implement and evaluate defensive controls that improve detection and reduce infrastructure exposure. |
| Enterprise Security Operations | - Candidates will demonstrate an understanding of how security operations center (SOC) processes and personnel support detection and event monitoring workflows. Candidates will demonstrate the ability to develop and optimize detection capabilities using security telemetry and analytics including the review and interpretation of common source and network log formats. |
| Evidence Collection and Visibility | - Candidates will demonstrate the ability to assess the accuracy and integrity of security records, baselines, and logs. Candidates will demonstrate the ability to evaluate how baselines and standards inform alert prioritization and recognize the importance of time and logging integrity for reliable analysis. |
| Identity and Infrastructure Hardening | - Candidates will demonstrate the ability to implement identity and network controls that reduce attack paths and limit attacker movement. Candidates will identify and differentiate common attack vectors and techniques including reconnaissance, password-based attacks and command-and-control activity. |
| Identity and Infrastructure Records | - Candidates will demonstrate the ability to analyze identity and network infrastructure records, including enterprise technologies such as Active Directory, RADIUS, and TACACS+ to determine system and user activity. Candidates will be able to recognize how logs can be enriched as they move from source to presentation as well as identify indicators of spoofing, poisoning and other malicious manipulation of infrastructure records. |
| Incident Containment and Recovery | - Candidates will demonstrate an understanding of the post-incident response processes and will demonstrate an ability to recognize common obstacles that can complicate containment, eradication, and recovery efforts |
| Incident Investigation and Analysis | - Candidates will demonstrate the ability to collect and analyze evidence to determine the scope of an incident, apply established incident detection and response methodologies to analyze host-based artifacts, and integrate threat intelligence to guide investigative and response activities |
| Malware Analysis and Defensive Controls | - Candidates will demonstrate the ability to determine when static and dynamic malware analysis is appropriate, characterize malicious behavior through interactive and network-based analysis, and apply analysis findings to improve threat detection and defensive controls across the enterprise. |
| Malware Identification and Triage | - Candidates will demonstrate the ability to identify malware characteristics and assess indicators of compromise to support malware triage using tools and techniques to recognize common attack methodologies and symptoms of infection during early triage. |
| Network Traffic Analysis and Investigation | - Candidates will demonstrate the ability to analyze network traffic and forensic evidence to investigate security events using a variety of tools to examine packets, flows, and artifacts and will demonstrate the ability to configure, tune and interpret network intrusion detection/prevention systems, including the development and review of open source rules. |
To ensure success in GIAC GCED certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for GIAC Certified Enterprise Defender (GCED) exam.
