GCTD logo
Focused certification exam prep
Start practice

GCTD Exam Dates 2026: Testing Windows, Deadlines & Scheduling

TL;DR
  • GIAC Cloud Threat Detection is a single proctored web-based exam you schedule on demand, not on a published seasonal calendar.
  • A standalone attempt gives you 120 days from activation, so your real deadline starts when you activate.
  • The exam is 75 questions in 2 hours with a 70% minimum passing score.
  • Testing is available through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules.

Why GCTD Has No Fixed Exam Calendar

Searches for "GCTD exam dates 2026" usually assume a cert with quarterly testing windows, like a university entrance exam. GIAC Cloud Threat Detection does not work that way. The credential is administered by GIAC Certifications, and the exam is delivered as a single proctored, web-based test that you attach to an attempt you have purchased and activated. There is no published list of "the 2026 sittings" to wait for.

That changes how you should think about dates. Instead of asking "when does the next window open?", the useful questions are: when will I activate my attempt, how long does that attempt stay valid, and which proctoring modality will let me test on a day that suits me? This article walks through each of those, with the GCTD-specific mechanics that determine your actual deadlines.

Verify before you plan: The public specifications summarized here come from GIAC's published pages. GIAC identifies your own candidate account at exams.giac.org/pages/attempts as the authority for attempt-specific objectives, question types, format and passing score. Treat that page as the final word on your dates and conditions.

How GCTD Scheduling Actually Works

The scheduling path has three stages, and your calendar is governed by the middle one.

  1. Acquire an attempt. You can buy a standalone attempt, or you can obtain an attempt associated with SANS training. The standalone attempt is USD 999. The SANS-associated attempt is also USD 999, with course tuition additional. Prices exclude applicable sales tax.
  2. Activate the attempt. Activation is what starts your clock. For standalone attempts, access runs 120 days from activation.
  3. Book a slot and sit the exam. You choose Pearson VUE (onsite) or ProctorU (remote), subject to GIAC modality rules, and reserve a time within your access window.

There are no formal certification prerequisites. Training is recommended but not required, which means nothing external gates your start date. If you want a fuller picture of eligibility, see our guide to GCTD requirements, eligibility and prerequisites.

The 120-Day Activation Window

The 120-day figure is the single most important date-related number for a standalone attempt. Once you activate, you have 120 days to complete the exam. Think of activation as pressing "start" on a countdown, not as a neutral administrative step.

Why activation timing matters

Candidates commonly make one of two mistakes. The first is activating the attempt immediately after purchase to "lock it in," then discovering they cannot realistically be ready within 120 days. The second is delaying activation indefinitely, which removes urgency and lets preparation drift. A better approach is to activate when your study materials are assembled and you can describe, in writing, what your final four weeks will look like.

Build in slack: Do not plan to test on day 119. Proctoring slots, onsite site availability, and personal disruptions all consume time. Aim to take the exam well inside the window so a rescheduling event does not push you past it.

Standalone vs. SANS-associated attempts

The 120-day access figure applies to standalone attempts. If you take affiliated SANS training, the attempt arrives bundled into that experience, and the training timeline shapes when you test. The relevant preparation course here is SANS SEC541, "Cloud Security Threat Detection." Its five course sections are organized around AWS, Azure and Microsoft 365, and they are a separate structure from GIAC's 12 official exam objectives. Check your account for the exact terms attached to your attempt.

PathExam attempt priceAccess timingAdditional cost
Standalone attemptUSD 999120 days from activationNone required; training optional
SANS-associated attemptUSD 999Confirm in your accountCourse tuition additional
RetakeUSD 899Confirm in your accountRequires a prior attempt

For a complete money picture across these paths, read our GCTD certification cost breakdown.

Pearson VUE Onsite vs. ProctorU Remote

GCTD is delivered through two proctoring channels: Pearson VUE for onsite testing and ProctorU for remote testing, subject to GIAC's modality rules. Which you choose affects when you can realistically sit the exam.

Onsite at Pearson VUE

  • You travel to a testing center, so your effective dates depend on local seat availability.
  • Controlled environment reduces the chance of a technical or room-compliance problem.
  • Better fit if your home or office cannot meet remote-proctoring room requirements.

Remote with ProctorU

  • You test from your own space, which generally widens your choice of dates and times.
  • Your environment, equipment and connection must satisfy proctoring rules.
  • Run any required system checks well before exam day, not the morning of.

Key Takeaway

Because GCTD is open book with strict rules on what you may bring, the physical setup matters more than for many exams. Decide on your modality early, then confirm in GIAC's proctored exam reference guide exactly how your permitted hardcopy materials are handled in that setting.

What You Are Scheduling: Format and Scoring

Knowing the exam's shape helps you choose a realistic date. The published specifications are:

  • Questions: 75 total
  • Time: 2 hours
  • Minimum passing score: 70%
  • Delivery: one proctored, web-based exam
  • Reference policy: open book, with permitted hardcopy books, notes and an index

Two hours for 75 questions works out to a pace of roughly 1.6 minutes per question on average. That is tight for scenario-style items, which is why an organized index matters so much in an open-book format. Electronic references and any practice or exam question-and-answer materials are prohibited.

GIAC applies the 70% passing-score specification to exam versions released on or after March 25, 2023. That is a scoring applicability date, not a syllabus revision date. Your assigned exam version was not something public sources could confirm, so check your account. For the scoring details, see our page on the GCTD passing score. Note also that the minimum passing score is not a pass rate; no issuer-published pass rate was verified, and our GCTD pass rate analysis explains what can and cannot be said.

Fees, Retakes and Timing Decisions

Money and dates are linked, because the cost of a failed attempt influences how long you should wait before booking. Published figures:

ItemPrice (USD)
Standalone exam attempt999
Practice exam (separately listed)399
Retake899
Standard renewal499

Prices exclude applicable sales tax and training tuition. A retake costs USD 100 less than a first attempt, but that is small comfort when the first fee already stung. The practical lesson: do not book your exam as a "diagnostic." Use readiness evidence first. If you are weighing whether the investment is justified, our GCTD ROI analysis covers the broader case.

For readiness checks that are not tied to your official attempt, you can use realistic GCTD practice tests before committing a date.

Working Backward From Your Test Date

Because GCTD has twelve objective areas and no published weights, you cannot prioritize by percentage. The sensible approach is to cover all twelve and allocate extra time to the areas where your background is thinnest. Below is one way to sequence the final stretch before an exam date, tied to the actual domains rather than generic scheduling.

Weeks 1-2

Foundations first

  • Cloud Monitoring Fundamentals and Log Centralization, since every later domain assumes you can find and aggregate the right telemetry.
  • Build the skeleton of your open-book index as you go.
Weeks 3-4

Platform investigation

  • Investigating AWS Environments and Investigating Azure Environments, handled back to back so you can compare how each provider surfaces activity records.
  • Pay attention to the Microsoft 365 angle that SEC541-style preparation emphasizes.
Weeks 5-6

Workload and data layers

  • Containers and Orchestration, Host OS Monitoring, and Data and Storage Monitoring.
  • Network and Flow Monitoring plus Application and Proxy Monitoring round out the visibility picture.
Weeks 7-8

Detection logic and consolidation

  • Automated Detection and Response, Cyber Threat Intelligence for the Cloud, and Cloud Vulnerability Analysis.
  • Timed practice sets, then finalize and cross-check your index.

This eight-week arrangement is only an illustration; compress or stretch it to fit your 120-day window. The point is that the sequence mirrors how the content builds, not an arbitrary template. For deeper content coverage of each area, use our guide to all 12 GCTD exam domains and the broader GCTD study guide.

Domains to schedule earliest

Front-load the areas that feed others.

  • Log Centralization: you cannot reason about detections in other domains without knowing where logs land and how they are queried.
  • Cloud Monitoring Fundamentals: establishes the vocabulary used in every investigation scenario.
  • Investigating AWS/Azure Environments: platform-specific, and the easiest area to underestimate if you only work in one cloud.

Preparing Your Open-Book Materials Before Test Day

The open-book rule is a scheduling issue in disguise: your materials must be ready before the date you book, not assembled in the last two days. GIAC permits hardcopy books, notes and an index. It prohibits electronic references and practice or exam question-and-answer materials. Read the proctored exam reference guide and the attempt delivery policy so you know exactly what is allowed in your chosen modality.

  • Print and bind or tab your materials early enough to test them under timed conditions.
  • Build your index by topic and by domain name, so a scenario question can be matched quickly.
  • Do at least one full timed run using only what you will have on the day. If lookups slow you down, fix the index, not the booking date.
Date-readiness test: If you cannot finish a full-length timed practice set inside the 2-hour limit while using only your permitted materials, you are not ready to book, regardless of how much content you have read. Consider the difficulty guide to calibrate expectations.

After the Exam: Certification Validity and Renewal Dates

Your exam date also starts a longer clock. A GIAC Cloud Threat Detection certification is valid for four years. To renew, you can earn 36 CPE credits or pass a renewal examination, plus pay the renewal fee (standard renewal is USD 499). Because the four-year period begins from certification, it is worth noting your expiry date and working backward from it, accumulating CPE credits gradually rather than in a final-year rush.

If you are thinking about what the credential does for your career, see the GCTD salary guide and our overview of GCTD-relevant jobs. Roles that value cloud detection skills tend to sit in security operations, cloud security engineering and incident response teams, though specific titles and compensation vary and are not claimed here.

Frequently Asked Questions

Are there set GCTD exam dates in 2026?

No fixed public calendar of sittings was identified. GCTD is a proctored web-based exam you take within the access window of an activated attempt, scheduled through Pearson VUE onsite or ProctorU remotely.

How long do I have to take the exam after activating?

For a standalone attempt, access is 120 days from activation. Confirm the exact terms for your attempt in your candidate account, especially if your attempt came through SANS training.

Can I take the GCTD exam from home?

GIAC offers remote proctoring through ProctorU, subject to its modality rules, as well as onsite testing through Pearson VUE. Review the proctored exam reference guide so your environment and materials comply.

How many questions and how much time does the exam give me?

The published specification is 75 questions in 2 hours, with a minimum passing score of 70%. Your account is the authority for attempt-specific format details.

What happens to my dates if I need a retake?

A retake is priced at USD 899. Check your account for the access terms that apply to a retake attempt, and avoid rebooking until your practice results show a clear improvement.

For related background on what the credential covers, you can also read what GCTD certification is. When you are ready to measure readiness against a likely test date, start from the main GCTD practice test site.

Ready to pass your GCTD exam?

Put this into practice with free GCTD questions across every exam domain.