- How GIAC Publishes the GCLD Objectives
- The 16 Content Areas at a Glance
- Threat-Facing Domains: Attacks, Intrusions, and Shared Responsibility
- Identity and Account Domains
- Networking and Monitoring Domains
- Compute, Containers, and Automation Domains
- Data and Secrets Domains
- Governance, Frameworks, and Compliance
- Exam Mechanics That Shape How You Study
- Using SEC502 Without Mistaking It for the Blueprint
- Scheduling the Domains Across Your Prep
- Frequently Asked Questions
- GIAC Cloud Security Essentials publishes 16 exam-objective headings, and the public outline gives no percentage weights.
- The exam is 75 questions in 2 hours, with a minimum passing score of 61%.
- The exam is open book, but electronic references and practice-question materials are prohibited, so your index quality matters.
- SANS SEC502 is affiliated preparation, but its sections do not replace the 16 official GIAC objectives.
How GIAC Publishes the GCLD Objectives
GIAC Cloud Security Essentials (GCLD) is a GIAC certification, and its official scope is published on the GIAC certification page under "Exam Certification Objectives & Outcome Statements." That outline lists 16 domain headings. Every domain name in this guide is reproduced from that published list, in the same order GIAC presents it.
Two caveats are worth understanding before you plan anything. First, the public outline does not publish percentage weights for the domains. Any article claiming "Domain 5 is 14% of the exam" is inventing numbers, and this guide will not do that. Second, GIAC identifies the candidate's account at exams.giac.org as the authority for attempt-specific objectives, question types, format, and passing score. The public specifications are a reliable map, but your assigned exam version is what actually governs your attempt, so check your account before finalizing a study plan.
The 16 Content Areas at a Glance
The domain names read like a tour of a cloud defender's job: attacking and responding, accounts and identity, automation, logging, networking, containers and storage, sensitive data, secrets, compute, monitoring, risk, and frameworks. Grouping them by theme makes the list far easier to retain than memorizing it as a flat sequence of 16 items.
| Theme | Domains (official headings) |
|---|---|
| Threats and shared responsibility | Domain 1: Attacking the Cloud and Responding to Intrusions; Domain 15: Understanding Shared Responsibility and Threat Informed Defense |
| Identity and accounts | Domain 2: Cloud Account Fundamentals; Domain 8: External access and IAM Best Practices |
| Networking and monitoring | Domain 5: Cloud Networking Technology; Domain 14: Securing Cloud Networks; Domain 10: Network Security Monitoring in the Cloud; Domain 4: Cloud Logging Fundamentals |
| Compute, containers, automation | Domain 13: Secure Compute Deployment; Domain 6: Containers and Cloud Storage; Domain 3: Cloud Automation |
| Data and secrets | Domain 7: Discovering and Storing Sensitive Data; Domain 16: Using Sensitive Data; Domain 12: Secrets Management |
| Governance | Domain 9: Frameworks for Built-in Security; Domain 11: Risk Management and Compliance |
This thematic grouping is our own study aid, not an official GIAC categorization. GIAC lists the domains in the numbered order shown above, and the exam does not necessarily present questions in that order.
Threat-Facing Domains: Attacks, Intrusions, and Shared Responsibility
Domain 1: Attacking the Cloud and Responding to Intrusions
This domain frames cloud security from an adversary's view and then from the responder's. Expect to reason about how cloud environments get compromised and what a defender does next.
- Understand common cloud attack paths well enough to recognize them in scenario questions.
- Know how incident response differs when infrastructure is API-driven and ephemeral.
- Connect attack techniques to the logs and telemetry that would reveal them.
Domain 15: Understanding Shared Responsibility and Threat Informed Defense
Shared responsibility is the conceptual foundation for the entire certification. The provider secures some layers and the customer secures others, and the boundary shifts depending on the service model you are using.
- Be able to say, for a given scenario, which party is responsible for a given control.
- Understand threat-informed defense as prioritizing controls based on how real adversaries operate rather than on a generic checklist.
- Expect this domain's reasoning to show up inside questions that are nominally about other domains.
Because Domain 1 and Domain 15 bookend the offensive and strategic sides of the exam, they pair well when you study. Learn how an attacker moves, then ask which defensive controls and which responsible party would have stopped or detected that movement.
Identity and Account Domains
Identity is the new perimeter in cloud environments, and two of the 16 domains are devoted to it directly.
Domain 2: Cloud Account Fundamentals
This covers how cloud accounts and their organizational structure work, and why account design is itself a security control.
- Understand how separating workloads into distinct accounts limits blast radius.
- Know the difference between the privileged root-level identity and everyday administrative identities.
- Be comfortable with how an organizational hierarchy can enforce guardrails across many accounts.
Domain 8: External access and IAM Best Practices
This domain is about who and what can reach your cloud resources, including identities that originate outside your accounts.
- Apply least privilege when reasoning about policies, roles, and permissions.
- Understand how external parties, federated identities, and cross-account access change your exposure.
- Recognize risky patterns such as overly broad permissions and long-lived credentials.
Key Takeaway
When a scenario question seems to have several plausible answers, favor the option that narrows permissions, shortens credential lifetime, or isolates blast radius. Those principles run through Domains 2, 8, and 12 and tend to separate the best answer from merely acceptable ones.
Networking and Monitoring Domains
Four domains concern networks and visibility. They are best studied as a chain: understand the technology, secure it, monitor it, and log it.
Domain 5: Cloud Networking Technology
The foundation layer: how cloud virtual networks are constructed and how traffic flows within and between them.
- Know virtual network building blocks, address space, subnets, and routing concepts.
- Understand how connectivity to the internet and to other networks is established.
Domain 14: Securing Cloud Networks
Applying controls on top of that foundation to restrict and inspect traffic.
- Understand layered filtering controls and how they differ in scope and behavior.
- Reason about segmentation and exposure of services to untrusted networks.
Domain 10: Network Security Monitoring in the Cloud
Detecting threats by observing network activity, adapted to environments where you cannot simply plug a sensor into a switch.
- Know what network-level telemetry is available and what questions it can answer.
- Understand the limits of network monitoring when traffic is encrypted or stays within provider-managed paths.
Domain 4: Cloud Logging Fundamentals
Logging is what makes detection and response possible across every other domain.
- Distinguish control-plane activity logging from workload and network logging.
- Understand protecting log integrity and retention so evidence survives an intrusion.
Compute, Containers, and Automation Domains
Domain 13: Secure Compute Deployment
Building and launching compute resources in a way that is secure from the start rather than patched afterward.
- Think about hardened images, patch posture, and how instances obtain their permissions.
- Understand how deployment choices affect the attack surface you inherit.
Domain 6: Containers and Cloud Storage
This heading pairs two distinct topics. Plan to study containers and storage services separately even though GIAC groups them.
- For containers, understand image provenance, runtime isolation, and orchestration-level risks.
- For storage, understand access control, exposure through misconfiguration, and encryption options.
Domain 3: Cloud Automation
Automation is both a security asset and a risk. Infrastructure defined as code can enforce consistency, but it can also replicate a mistake at scale.
- Understand how templates and scripted deployment support repeatable secure baselines.
- Recognize risks such as embedded credentials and overly permissive automation roles.
Data and Secrets Domains
Three domains focus on protecting what attackers ultimately want: data and the credentials that unlock it.
Domain 7: Discovering and Storing Sensitive Data
You cannot protect data you have not found. This domain covers locating sensitive information in cloud environments and choosing how to store it safely.
- Understand classification and discovery as prerequisites to applying controls.
- Know storage protection options, including encryption at rest and access restrictions.
Domain 16: Using Sensitive Data
Protection does not end once data is stored. This domain addresses how data is protected while it is being accessed and processed.
- Think about data in transit and in use, not only at rest.
- Consider how authorized access paths should be constrained and audited.
Domain 12: Secrets Management
Credentials, keys, tokens, and certificates are the connective tissue of cloud systems and a favorite attacker target.
- Understand why secrets should live in dedicated management services rather than in code or configuration files.
- Know the value of rotation, scoped access, and auditing for secrets.
Domains 7, 16, and 12 form a lifecycle: discover data, store it safely, use it safely, and protect the secrets that gate every step. Studying them together reveals how questions can blend them.
Governance, Frameworks, and Compliance
Domain 9: Frameworks for Built-in Security
This domain is about using established frameworks and architectural guidance so that security is part of the design rather than bolted on.
- Understand the purpose of well-architected style guidance and security benchmarks.
- Be ready to connect a framework recommendation to a concrete configuration decision.
Domain 11: Risk Management and Compliance
Translating technical findings into risk and demonstrating that controls meet obligations.
- Understand how risk is assessed, prioritized, and treated in a cloud context.
- Know how compliance requirements interact with the shared responsibility boundary.
Governance domains are sometimes underestimated by hands-on practitioners, but they reward careful reading. Questions here usually hinge on matching the right framework or risk decision to a stated business situation.
Exam Mechanics That Shape How You Study
The domains tell you what to learn. The exam mechanics tell you how to prepare to retrieve it under pressure.
| Item | Published specification |
|---|---|
| Format | One proctored web-based exam |
| Questions | 75 total |
| Time limit | 2 hours |
| Minimum passing score | 61% |
| Testing | Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
| Reference policy | Open book with permitted hardcopy books, notes, and an index; electronic references and practice or exam question-and-answer materials are prohibited |
| Standalone attempt cost | USD 999 (excludes applicable sales tax and training tuition) |
| Practice exam | USD 399, listed separately |
| Retake | USD 899 |
| Standalone access window | 120 days from activation |
| Certification validity | Four years; renew with 36 CPE credits or a renewal exam, plus the USD 499 standard renewal fee |
Two points deserve emphasis. The 61% minimum passing score applies to exam versions released on or after April 9, 2021. It is a scoring applicability date, not a syllabus revision date. It is also not a pass rate, and no issuer-published pass rate was verified, so be skeptical of any site quoting one. For details on the cutoff, see our GCLD passing score guide, and for the full fee picture see the GCLD certification cost breakdown.
Because the retake costs USD 899, a failed attempt is an expensive way to discover a weak domain. That is a strong argument for using the separately listed practice exam, or other legitimate practice questions during your preparation (not during the exam itself), to expose gaps first. You can also try our GCLD practice tests to gauge readiness across all 16 areas. For difficulty context, read how hard the GCLD exam is.
Using SEC502 Without Mistaking It for the Blueprint
The affiliated SANS course is SEC502: Cloud Security Tactical Defense. SANS documents a transition from the earlier SEC488 course to SEC502 and states that the GCLD certification remains unchanged by the realignment. You may still see SEC488 referenced in older testimonials, while the training link now resolves to SEC502.
The current SEC502 curriculum has five instructional sections plus a self-paced CloudWars capstone, numbered Section 6 in the brochure. It is tempting to assume that five sections or six parts map neatly onto the exam. They do not. The course is a preparation curriculum, and its sections, labs, and capstone do not establish the official domain count, weights, or exhaustive exam coverage. The 16 GIAC objectives remain the only official scope statement.
Key Takeaway
Use SEC502 material to deepen your hands-on skill, then verify your coverage against the 16 official domain headings, not against the course table of contents. If a domain from the GIAC list has no obvious home in your course notes, treat that as a gap to fill. The course exam attempt is also USD 999, with tuition additional, so factor that into your budget. See our GCLD training overview for options.
Scheduling the Domains Across Your Prep
Since there are no published weights, a sensible plan front-loads foundations that later domains depend on. Here is one way to sequence the 16 areas across a focused preparation period. Adjust the pacing to your experience, and note that the 120-day standalone access window gives you a hard outer limit if you register without a course.
Foundations
- Domain 15: Shared Responsibility and Threat Informed Defense
- Domain 2: Cloud Account Fundamentals
- Why first: nearly every later question assumes you know who owns which control and how accounts are structured.
Identity and Secrets
- Domain 8: External access and IAM Best Practices
- Domain 12: Secrets Management
- Why now: these share least-privilege and credential-lifetime reasoning.
Network Chain
- Domain 5, then Domain 14, then Domain 10, then Domain 4
- Why this order: technology, then controls, then monitoring, then logging.
Workloads and Data
- Domains 13, 6, and 3 for compute, containers, storage, and automation
- Domains 7 and 16 for sensitive data discovery, storage, and use
Threats, Governance, and Review
- Domain 1: Attacking the Cloud and Responding to Intrusions
- Domains 9 and 11 for frameworks, risk, and compliance
- Finish by building and testing your index against all 16 domains.
Saving Domain 1 until late is deliberate. Incident response and attack scenarios are far easier once you understand the logging, networking, identity, and data controls that attackers target and responders rely on. For the complete preparation approach, consult the GCLD study guide, and keep the GCLD cheat sheet handy for last-minute review. If you want a second perspective on this material, our companion GCLD exam domains guide covers the same 16 headings.
Frequently Asked Questions
GIAC's published objectives for GIAC Cloud Security Essentials list 16 domain headings. The public outline does not provide percentage weights for them, so no weighting should be assumed. Your account at exams.giac.org is the authority for attempt-specific objectives.
The public outline supplies no weights, so any specific percentages you see elsewhere are unverified. Prepare for all 16 areas and use practice results to find your weak spots rather than relying on guessed weightings.
The minimum passing score is 61% on a 75-question, 2-hour proctored web-based exam. GIAC applies this specification to exam versions released on or after April 9, 2021. Confirm your own attempt's details in your GIAC account, and see our GCLD pass rate article for why no pass-rate figure has been verified.
No formal certification prerequisites exist, and training is recommended rather than required. SEC502 is the affiliated course, but its sections do not replace the 16 GIAC objectives. Review the GCLD requirements guide for eligibility details.
The exam is open book, permitting hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited. Because time is limited to 2 hours for 75 questions, a well-organized index helps, but understanding the domains matters far more.
Mastering all 16 areas, from Cloud Account Fundamentals through Using Sensitive Data, is what turns an expensive exam attempt into a confident one. If you are weighing the investment, our analyses of whether the certification is worth it and the GCLD salary guide can help you decide, and the GCLD Exam Prep practice site is ready when you want to test yourself across every domain.