GCDA certification: exam, cost, passing score and topics

What is the GCDA certification?

GCDA stands for GIAC Certified Detection Analyst. GIAC says it validates a practitioner’s aptitude in leveraging SIEM tools and techniques — collecting and enriching logs, analysing them, and turning that analysis into alerts that catch real attacks.

GIAC lists a wide audience: security analysts and architects, senior security engineers, technical security managers, SOC staff, CND analysts, system administrators, cyber threat investigators, and people implementing continuous security monitoring or working on hunt teams. In practice, it is a credential for anyone whose job is to write, tune or act on detections.

Source: GIAC — GCDA certification. Checked 14 October 2026.

How much does the GCDA exam cost?

A GCDA certification attempt costs $999, in US dollars and excluding sales tax. GIAC’s price list also shows the costs that come up around an attempt.

Missing a proctored appointment incurs a $175 reseating fee, which comes with a 7-day extension from your current deadline.

• Certification attempt — $999
• Exam retake — $899
• Attempt extension — $479
• Practice exam — $399
• Certification renewal — $499

Source: GIAC — Pricing. Checked 14 October 2026.

GCDA exam format

The GCDA is one proctored exam of 75 questions with a 2-hour limit. All GIAC exams are web-based and must be proctored, either remotely through ProctorU or onsite through Pearson VUE.

Once your attempt is activated, you have 120 days to sit the exam. Book the appointment early in that window: an extension costs $479.

GIAC exams are open book, but not open internet or open computer. You may bring hardcopy books and notes, including your course material and a printed index; hardcopy material that looks like practice test or exam questions and answers is strictly prohibited.

Source: GIAC — Proctor Program Overview. Checked 14 October 2026.

GCDA passing score

GIAC set the GCDA passing score at 76% for all candidates who receive the exam version released on or after 27 April 2026.

The passing score is tied to the exam version, so check the Certification Information section of your GIAC account for the format and passing score that apply to your own attempt.

Source: GIAC — GCDA certification. Checked 14 October 2026.

What is on the GCDA exam?

GIAC publishes nine exam certification objectives for GCDA, without weightings. They run from SIEM fundamentals and log collection through endpoint, network and application analytics to cloud logging and Microsoft security tooling.

The cloud and Microsoft objectives are worth flagging: Azure and AWS logging, and Defender and Sentinel, each appear as their own objective. A candidate whose SIEM experience is purely on-premises should plan time for them.

• SIEM Overview
• Log Collection and Enrichment
• Log Analysis and Alerting
• Endpoint Analytics
• Asset and Network Analytics
• Application Protocol Analytics
• Application and User Monitoring Analytics
• Azure and AWS Logging Overview
• Defender and Sentinel Overview

Source: GIAC — GCDA certification. Checked 14 October 2026.

GCDA prerequisites

GIAC lists no prerequisites or eligibility requirements for the GCDA exam.

The affiliated SANS course expects a basic understanding of TCP/IP, logging methods and techniques, and operating system fundamentals. Experience with a logging system, the command line and a SIEM is helpful rather than required.

Source: SANS Institute — SEC555: Detection Engineering and SIEM Analytics. Checked 14 October 2026.

GCDA training: SANS SEC555

GIAC links SANS SEC555: Detection Engineering and SIEM Analytics as the training for GCDA. It runs five days instructor-led or 30 hours self-paced, carries 30 CPEs, and is offered in person, virtually or self-paced. The OnDemand version is listed at $8,260 USD.

Training is not required to sit the exam. If you prepare on your own, build your study around the nine objectives above and create a printed index of your notes — GIAC’s open-book format rewards being able to find information fast.

Source: SANS Institute — SEC555: Detection Engineering and SIEM Analytics. Checked 14 October 2026.

How long is the GCDA certification valid?

GIAC certifications run on a four-year cycle. To keep the GCDA active you collect 36 credits over four years, and GIAC lists the certification renewal fee at $499.

If you renew more than one GIAC certification, GIAC’s price list notes that additional renewals within two years of paying a full-price renewal cost $249.

Source: GIAC — Renewal. Checked 14 October 2026.

GCDA vs GMON

GCDA and GMON are both GIAC defensive certifications. GMON, the GIAC Continuous Monitoring certification, validates a practitioner’s ability to deter intrusions and quickly detect anomalous activity — a broader monitoring brief than GCDA’s.

GCDA is narrower and more tool-centred: SIEM analytics, log enrichment and detection logic. The exams also differ in size — GMON has 82 questions in 3 hours with a 74% passing score, against 75 questions in 2 hours and 76% for GCDA.

Source: GIAC — GMON certification. Checked 14 October 2026.

GCDA practice questions and exam dumps

GIAC sells an official GCDA practice exam for $399. It simulates the real exam, but GIAC states that practice exams never include actual exam questions and that the practice question bank is limited, so questions can repeat.

Certsqill’s GCDA practice questions are expert-developed and follow the nine GIAC objectives. Every question comes with an explanation for every answer option, and your results build a readiness score per domain, so a weak spot such as Defender and Sentinel shows up before exam day rather than during it.

Stay away from exam dumps. GIAC’s Exam Integrity Policy treats any use of or reference to exam dump sites containing actual or possible GIAC questions as a violation, with sanctions up to revocation of previously issued GIAC certifications and bans from future GIAC programmes.

Source: GIAC — Exam Integrity Policy. Checked 14 October 2026.

GCDA questions people ask

What is the GCDA certification?

GIAC Certified Detection Analyst, a GIAC credential that validates the use of SIEM tools and techniques for detection. Source: GIAC, checked 14 October 2026.

How much does the GCDA exam cost?

$999 per certification attempt in USD, excluding sales tax. A retake costs $899. Source: GIAC Pricing, checked 14 October 2026.

How many questions are on the GCDA exam?

75 questions in 2 hours. Source: GIAC GCDA page, checked 14 October 2026.

What is the GCDA passing score?

76% for exam versions released on or after 27 April 2026. Your GIAC account shows the score for your attempt. Checked 14 October 2026.

Is the GCDA exam open book?

Yes, with hardcopy books and notes only. It is not open internet or open computer. Source: GIAC Proctor Program Overview, checked 14 October 2026.

Can I take the GCDA exam online?

Yes. GIAC exams can be taken with remote proctoring through ProctorU or onsite at a Pearson VUE centre. Checked 14 October 2026.

Are there prerequisites for GCDA?

GIAC lists none. SANS SEC555 is the affiliated training, but it is not required. Checked 14 October 2026.

Which SANS course prepares for GCDA?

SEC555: Detection Engineering and SIEM Analytics — five days instructor-led or 30 hours self-paced. Source: SANS, checked 14 October 2026.

How do I renew GCDA?

Collect 36 credits over four years; GIAC lists the renewal fee at $499. Source: GIAC, checked 14 October 2026.