GCED (GIAC Certified Enterprise Defender)
GCED covers enterprise defense: attack surface management, secure configuration and hardening, detection with security telemetry, network traffic analysis, malware triage, and incident investigation and recovery. GIAC positions it as building on the skills measured by GSEC. Incident responders, penetration testers, SOC engineers and analysts, and network security professionals are the audience, and SANS SEC501 is the aligned course.
Updated
Exam Details
- Issuer
- GIAC
- Level
- Advanced
- Exam type
- Multiple choice
- Questions
- 115
- Duration
- 3 hours
- Passing score
- 69%
- Exam fee
- $999
- Validity
- 4 years
- Tracks
- Security Operations, Forensics and Incident Response
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
12 domains| Domain |
|---|
| Attack Surface Management |
| Configuration Management and Automation Workflows |
| Engineered Telemetry through Defensive Controls |
| Enterprise Security Operations |
| Evidence Collection and Visibility |
| Identity and Infrastructure Hardening |
| Identity and Infrastructure Records |
| Incident Containment and Recovery |
| Incident Investigation and Analysis |
| Malware Analysis and Defensive Controls |
| Malware Identification and Triage |
| Network Traffic Analysis and Investigation |
DoD 8140 Work Roles
4 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GCED as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Frequently Asked Questions
What does GCED stand for?→
GCED stands for GIAC Certified Enterprise Defender. GIAC itself was previously named Global Information Assurance Certification.
How many questions are on the GCED exam?→
The exam has 115 questions and a 3-hour time limit, with a passing score of 69% for versions released on or after October 1, 2022.
How much does the GCED exam cost?→
One GCED certification attempt costs $999. A retake is $899 and a practice test is $399.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
- GIAC: GIAC Certified Enterprise Defender (GCED)
- GIAC Knowledge Base: Proctor Program Overview (open book guidelines)
- GIAC: How to Renew
- GIAC Certification Pricing and Fees
- GIAC Knowledge Base: Renewal
- GIAC Knowledge Base: Retakes and Extensions
- GIAC: DoD 8140 Directive
- GIAC Company Info
- GIAC Proctoring
- GIAC Blog: Applied Knowledge exams compared with Practitioner exams
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GCED is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.