GCED certification: exam format, cost and objectives

What is the GCED certification?

GCED stands for GIAC Certified Enterprise Defender. GIAC, whose affiliated training courses come from the SANS Institute, positions it as a technical, in-depth credential for people who build and run the defensive side of an enterprise network: detection, hardening, investigation and recovery.

GIAC names the audience directly: incident responders and penetration testers, Security Operations Center engineers and analysts, network security professionals, and anyone who wants deep technical knowledge of implementing comprehensive security solutions. In other words, the GCED certification is aimed at practitioners who already work with logs, network traffic and endpoints rather than at newcomers to security.

The certification is active. GIAC’s pricing page lists a handful of credentials as “In Abeyance”, and GCED is not one of them.

Source: GIAC — GIAC Certified Enterprise Defender (GCED). Checked 10 October 2026.

How much does the GCED certification cost?

GIAC lists the GCED certification attempt at US$999. That price covers the exam attempt only; prices are in US dollars and exclude sales tax, and GIAC reserves the right to change them without notice.

The other fees on the same price list matter for planning: a retake costs US$899, an attempt extension US$479, a practice exam US$399, and certification renewal US$499. A missed proctored exam appointment incurs a US$175 reseating fee and adds a seven-day extension to your deadline.

Many candidates take the exam after the affiliated SANS course, which is sold separately and costs considerably more than the attempt itself. The SANS course page lists SEC501 OnDemand at US$8,780. GIAC and SANS do not publish one combined price on the pages checked for this article, so check the bundle offer at the point of purchase.

Source: GIAC — Certification pricing and fees. Checked 10 October 2026.

What is the GCED exam format?

The GCED exam is one proctored exam with 115 questions and a time limit of 3 hours. That is roughly a minute and a half per question, which is less than it sounds once you factor in looking things up in your notes.

All GIAC exams are web-based and must be proctored. You choose between remote proctoring through ProctorU and onsite proctoring at a Pearson VUE test center. Once your attempt is activated, you have 120 days to sit it.

GIAC exams are open book, but only on paper: printed books, notes and study guides are allowed, digital items are not. That rule shapes how you should prepare, because a well-built printed index is worth more than a folder of PDFs you cannot open on exam day.

Source: GIAC — GIAC Certified Enterprise Defender (GCED). Checked 10 October 2026.

GCED passing score

The minimum passing score for the GCED exam is 69%. GIAC states that it set this figure through a psychometric standard-setting study and that it applies to candidates who receive the exam version released on or after 1 October 2022.

GIAC also notes that it periodically reviews certification specifications for fairness, validity and reliability, so treat the 69% as the current figure rather than a permanent one and check the certification page before you book.

Source: GIAC — GIAC Certified Enterprise Defender (GCED). Checked 10 October 2026.

GCED exam objectives: what is on the exam?

GIAC publishes twelve exam certification objectives for GCED. It does not publish a weighting per objective, so you cannot safely skip any of them. Together they follow the defender’s workflow from reducing exposure, through detecting and investigating, to containing and recovering.

Several objectives name specific frameworks and technologies: attack surface management covers MITRE ATT&CK and D3FEND, OSINT and the phases of enterprise vulnerability management; the identity records objective covers systems such as Active Directory, RADIUS and TACACS+; and the network objective includes configuring, tuning and interpreting IDS/IPS, including writing and reviewing open-source rules.

• Attack Surface Management
• Configuration Management and Automation Workflows
• Engineered Telemetry through Defensive Controls
• Enterprise Security Operations
• Evidence Collection and Visibility
• Identity and Infrastructure Hardening
• Identity and Infrastructure Records
• Incident Containment and Recovery
• Incident Investigation and Analysis
• Malware Analysis and Defensive Controls
• Malware Identification and Triage
• Network Traffic Analysis and Investigation

Source: GIAC — GIAC Certified Enterprise Defender (GCED). Checked 10 October 2026.

GCED requirements and prerequisites

GIAC lists no formal prerequisites for GCED. You do not need another GIAC certification first, and taking a SANS course is not mandatory to buy an attempt.

The practical requirement is experience. The objectives assume you can read packet captures and flow data, analyse host artifacts, work with directory and authentication logs, and reason about malware behaviour. If those tasks are unfamiliar, plan more study time before activating the attempt, because the 120-day window starts at activation.

Source: GIAC — GIAC Certified Enterprise Defender (GCED). Checked 10 October 2026.

GCED training: SANS SEC501 and other study options

GIAC states that the best way to prepare for any of its practitioner certifications is the affiliated SANS training course. For GCED that course is SEC501: Applied Cyber Defense. SANS lists it as six days instructor-led or 38 hours self-paced, worth 38 CPEs, available live, online and OnDemand.

The course is recommended, not required. GIAC’s own preparation guidance is built around the open-book format: create a systematic, colour-coded index of your printed material, and take practice tests to check both your knowledge and your pacing.

GIAC sells practice exams for GCED at US$399 each. It states that practice exams never include actual exam questions and that the practice question bank is limited, so you may see the same question again on a second practice test.

Source: SANS Institute — SEC501: Applied Cyber Defense. Checked 10 October 2026.

How long is the GCED certification valid?

GIAC certifications run on a renewal cycle: you collect 36 credits over four years to keep your certification active. The renewal fee on GIAC’s price list is US$499, and additional renewals within two years of paying a full-price renewal cost US$249.

Log qualifying activities as you complete them. Leaving it to the end of the four-year cycle means scrambling for credits against a deadline.

Source: GIAC — Certification renewal. Checked 10 October 2026.

GCED exam dumps and practice tests

GIAC’s exam integrity policy explicitly lists any use of or reference to exam dump sites containing actual or possible GIAC questions and answers as a violation. Candidates must not share or accept knowledge of test content, including questions, answers or scenarios.

The sanctions are serious: GIAC can revoke previously issued certifications back to the date they were issued and ban candidates from future GIAC certifications. The legitimate route is GIAC’s own practice tests plus a thorough printed index.

Source: GIAC — Exam integrity policy. Checked 10 October 2026.

GCED practice questions

Certsqill’s GCED practice questions come with an explanation for each answer option and a readiness score per objective, so you can see which of the twelve GIAC objectives still need work before you activate your attempt.

GCED questions people ask

What is the GCED certification?

The GIAC Certified Enterprise Defender, a technical credential for defenders such as SOC analysts, incident responders and network security professionals. Source: GIAC, checked 10 October 2026.

How much does the GCED exam cost?

A certification attempt costs US$999, a retake US$899 and a practice exam US$399, excluding tax. Source: GIAC pricing, checked 10 October 2026.

How many questions are on the GCED exam?

115 questions, with a 3-hour time limit. Source: GIAC GCED certification page, checked 10 October 2026.

What is the GCED passing score?

69%, for exam versions released on or after 1 October 2022. Source: GIAC GCED certification page, checked 10 October 2026.

Is the GCED exam open book?

Yes, with printed books, notes and study guides only; no digital items. Source: GIAC practitioner exam preparation guidance, checked 10 October 2026.

Can I take the GCED exam online?

Yes. GIAC offers remote proctoring through ProctorU as well as onsite proctoring at Pearson VUE. Source: GIAC GCED certification page, checked 10 October 2026.

Which SANS course prepares for GCED?

SEC501: Applied Cyber Defense, six days instructor-led or 38 hours self-paced. It is recommended, not required. Source: SANS, checked 10 October 2026.

How do I renew GCED?

Collect 36 credits over four years; the renewal fee is US$499. Source: GIAC renewal and pricing pages, checked 10 October 2026.

Does GIAC publish GCED salary data?

No. GIAC does not publish salary figures for GCED holders on its certification pages, so this page does not quote any.