GCTD Certification

What the GCTD Certification Actually Certifies

GIAC Cloud Threat Detection (GCTD) is a certification administered by GIAC Certifications, the credentialing body associated with SANS Institute training. It is aimed at practitioners who detect and investigate hostile activity in cloud environments rather than those who only configure them. The emphasis is on telemetry: what logs exist, where they live, how they are centralized, and how an analyst turns them into detections and investigative conclusions.

If you are new to the acronym itself, our explainers on what GCTD is and what GCTD stands for cover the basics. This article goes further into the exam's structure, its published objectives, and how to organize your preparation around them.

Exam Format, Fees, and Testing Mechanics

The public specifications describe a single proctored, web-based exam. The numbers that matter are below.

Fees exclude applicable sales tax and training tuition. If you take the exam in association with a SANS course, the associated exam attempt is also USD 999, with course tuition additional. For a fuller breakdown of how these line items combine, see our GCTD certification cost guide.

The 70% figure, interpreted carefully

The 70% minimum passing score is a scoring specification, not a pass rate. GIAC applies it to exam versions released on or after March 25, 2023, and that date marks when the scoring rule became applicable, not when the syllabus was last revised. Your assigned exam version was not something the public materials could tell us, so check your GIAC account attempts page, which GIAC identifies as the authority for attempt-specific objectives, question types, format, and passing score. Our GCTD passing score article goes deeper on this distinction, and our pass rate discussion explains why no issuer-published pass rate could be verified.

Registration and delivery

Testing is delivered through Pearson VUE (onsite) or ProctorU (remote), subject to GIAC modality rules. The standalone attempt remains accessible for 120 days from activation, which effectively sets your preparation deadline once you activate it. Read the GIAC Candidate Agreement and the proctored exam reference guide before scheduling, since they govern what you may bring and how the session runs. Scheduling specifics are covered in our exam dates guide, and eligibility questions in the requirements article.

The 12 Published Exam Objectives

GIAC publishes twelve objective headings under "Exam Certification Objectives & Outcome Statements." The public outline supplies no percentage weights, so any claim that one domain makes up a particular share of the exam would be invented. Treat all twelve as in scope and prepare accordingly. For a domain-by-domain walk-through, see our complete guide to all 12 content areas; below is a practical reading of each heading.

Where AWS and Azure Investigation Skills Fit

Two of the twelve headings name specific platforms: AWS and Azure. That is a meaningful signal. Platform-neutral reasoning will carry you through much of the exam, but the investigation objectives expect fluency with each provider's native telemetry, identity concepts, and terminology. A candidate with deep AWS experience and no Azure exposure should plan explicit time on the unfamiliar platform, and vice versa.

Because SEC541, the affiliated course, organizes its material around AWS, Azure, and Microsoft 365, candidates following that path get coverage across these platforms. Keep in mind that course sections are a separate structure from the twelve GIAC objectives, so map your notes to the objectives rather than assuming the two line up one-to-one.

SEC541 and Other Preparation Paths

The affiliated training is SANS SEC541: Cloud Security Threat Detection, which is organized into five course sections. A public brochure describes the syllabus, though no printed revision date could be verified for it. Training is recommended but not required, and GIAC lists no formal prerequisites. The course content, labs, and capstones are preparation material; they do not define the official exam domain count, weights, or exhaustive coverage. The official source of truth for what is tested is the GIAC objectives list.

Whether to buy training is a cost-benefit question we address in our GCTD training overview and in the worth-it analysis. If you are self-studying, the standalone attempt route at USD 999 avoids course tuition but puts the burden of coverage on you, which is where a structured set of practice questions helps. You can test your readiness with the GCTD practice tests on our main site.

Open-Book Strategy and the Index

The exam is open book. Permitted resources are hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited. That combination shapes the whole preparation approach, and it is a defining feature of GIAC exams.

• Build your index while you learn. An index assembled during study reinforces memory; one assembled in the last week mostly does not.
• Index by concept and by provider. Entries for the same idea in AWS and Azure terms should point to the same notes.
• Record log-source facts. Which service produces which record, what fields matter, and what is off by default are exactly the lookups an open-book candidate needs fast.
• Do not rely on lookup speed to replace understanding. With 75 questions in 2 hours, you have limited time per question, so the index should confirm knowledge rather than substitute for it.

A condensed reference of your own making is useful too; see our GCTD cheat sheet for the kind of must-know facts worth capturing, keeping in mind that anything you bring must comply with the permitted-materials rules.

Sequencing Your Preparation by Domain

Generic scheduling advice is less useful than ordering topics by dependency. Foundations first, then telemetry pipelines, then workload-specific monitoring, then the platform investigations that tie everything together. Here is one reasonable arrangement within a single standalone attempt's 120-day access window; compress or stretch it to fit your background.

The platform investigation objectives come last because they synthesize everything before them: you cannot reconstruct an attack timeline from Azure logs if you have not internalized what each log source contains. For broader planning, our GCTD study guide offers additional structure, and our difficulty analysis helps calibrate how much time your background may require.

Who Benefits From This Credential

The credential fits roles where cloud telemetry is the daily material: security operations analysts, detection engineers, incident responders, threat hunters, and cloud security engineers who own monitoring pipelines. Organizations running workloads in AWS, Azure, or Microsoft 365 value people who can demonstrate they know how to investigate those environments rather than just secure them in principle.

Job postings vary widely in how they reference GIAC credentials, and some list them as preferred rather than required. For a view of the roles and employers that commonly mention it, see our GCTD jobs overview, and for compensation context, our salary guide. We deliberately avoid quoting specific figures here, since no issuer-verified salary data exists to anchor them.

Validity, Renewal, and Ongoing Costs

The certification is valid for four years. To renew, you either earn 36 CPE credits or take a renewal examination, and in either case pay the renewal fee, listed at USD 499 as the standard renewal price, excluding applicable sales tax. Renewal procedures are documented in GIAC's renewal guidance, so confirm current mechanics there before your window closes.

Spreading CPE activity across the four-year cycle is easier than scrambling at the end, and the work of staying current in cloud detection tends to generate eligible activity naturally.

Frequently Asked Questions