- The exam is 75 questions in 2 hours, with a 67% minimum passing score.
- GIAC publishes ten objective headings but no official weights, so ignore any percentage split you see online.
- Paper books, notes, and an index are allowed; electronic references and practice-question material are prohibited.
- Answers cannot be revised after submission, so use your limited skip allowance deliberately.
Identity Check: Which GSOC Is This?
Search engines blur several things that share this acronym, including a well-known open-source mentorship program and the generic "global security operations center." This cheat sheet covers only GIAC Security Operations Certified (GSOC), issued by GIAC Certifications (administered by GIAC, LLC). If you want the naming background first, see What Is GSOC Certification? or What Does GSOC Stand For?.
Everything below comes from GIAC's published policies and pricing pages, plus the SANS SEC450 course information that serves as the affiliated preparation path. Where GIAC has not published a fact, this page says so rather than guessing.
The Exam Snapshot
| Item | What GIAC Publishes |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 67% (for exam versions released on or after August 28, 2021) |
| Format | One web-based, proctored practitioner exam |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to attempt-specific restrictions |
| Prerequisites | None mandatory; preparation recommended |
| Reference materials | Paper books, notes, and index permitted |
| Validity | 4 years |
Exam-Day Rules Worth Memorizing
- No revisions after submission. Once you submit an answer, it is final.
- Limited skips. You have a limited skip allowance, so spend it on genuinely time-consuming items, not mild uncertainty.
- 15-minute break allowance. Plan whether you need it before the clock starts.
- Prohibited: electronic or internet references, and any exam or practice-question material.
- Unverified: calculator availability and adaptive-testing status for this exact exam. Confirm through GIAC's proctor knowledge base rather than assuming.
Money, Windows, and Retake Rules
| Cost Item | Amount (USD) |
|---|---|
| Exam attempt (before tax) | 999 |
| Failed-exam retake | 899 |
| 45-day extension | 479 |
| Practice test | 399 |
| Renewal | 499 |
| Additional renewal within 2 years of a full-price renewal | 249 |
GIAC does not publish member and non-member tiers. The SANS-associated exam add-on is also USD 999, with course tuition billed separately. For the full breakdown, see GSOC Certification Cost 2026.
Attempt Windows and Waiting Periods
- Standalone attempt: 120 days from activation.
- Bundled with training: 120 days from the end of the event, or matching the OnDemand course deadline.
- Retake after a failure: normally a 30-day wait; the 60-day extension includes that wait.
- Three failures: trigger a one-year wait.
- Extensions: add 45 days each, within a 570-day total-access limit.
Scheduling details live in GSOC Exam Dates 2026, and eligibility questions are covered in GSOC Requirements 2026.
The Ten Objectives at a Glance
GIAC lists ten exam-objective headings in sequence. They are not a weighted-domain system: no percentages, no highest-weight objective, and no per-objective question counts have been published. Anyone quoting "15% for network traffic" or "seven questions per objective" is inferring, not citing. The full breakdown is in GSOC Exam Domains 2026; here is the compressed review version.
1. Analytic Design and Tuning
How detections are built and kept useful.
- Writing and refining detection logic, including rule formats such as Sigma
- Reducing false positives without blinding yourself to true positives
- Reasoning about what a detection does and does not cover
2. Blue Team Defense Concepts
The foundations a SOC analyst reasons from.
- Defensive frameworks and how attacker behavior maps to defender visibility
- Where each control sits in a layered defense
3. Endpoint Defense
Host-level telemetry and protection.
- Windows and Linux evidence: processes, logons, persistence, command lines
- What endpoint tooling can and cannot tell you
4. HTTP(S) Analysis and Attacks
Web traffic as both evidence and attack surface.
- Reading requests, responses, status codes, headers, and user agents
- Recognizing injection, traversal, and web-shell patterns in logs
- What encryption hides from you and what remains visible
5. Interpreting Events
Turning raw log lines into meaning.
- Reading event fields correctly and spotting what is missing
- Distinguishing normal administrative activity from suspicious activity
6. Intrusion Triage and Analysis
Deciding what an alert is and what to do next.
- Prioritizing, scoping, and escalating
- Building a defensible timeline from multiple sources
7. Network Traffic Analysis
Packets, flows, and the conversations inside them.
- Packet-capture reading and display-filter fluency
- Spotting beaconing, scanning, and unusual connection patterns
8. Operational Improvement
Making the SOC better after each incident.
- Feeding lessons learned back into detections and procedures
- Measuring and refining SOC effectiveness
9. Protocol Attacks and Analysis
Abuse of core network protocols.
- How protocols behave normally, so anomalies stand out
- Recognizing spoofing, poisoning, tunneling, and similar abuse
10. SOC Management Systems
The tooling that holds the operation together.
- SIEM, case management, and automation platforms
- How data flows from source to analyst and where it gets lost
Evidence-Reading Reference Points
The exam is about interpreting evidence, so memorizing definitions is not enough. Practice reading artifacts until the patterns are automatic. These are working reference points to rehearse; verify details against your own course materials.
Wireshark Display Filters Worth Knowing Cold
ip.addr == 10.0.0.5isolates traffic to or from one host.tcp.port == 443andudp.port == 53narrow by transport and port.http.request.method == "POST"surfaces uploads and form submissions.dns.qry.name contains "example"finds lookups for a name fragment.tcp.flags.syn == 1 && tcp.flags.ack == 0shows connection attempts, useful for spotting scans.
Questions to Ask of Any Log Line
- Who or what initiated this, and from where?
- What was the parent activity? A child process without a plausible parent is a clue.
- Does the timing fit normal behavior, or does it repeat at suspiciously regular intervals?
- What would I expect to see next if this were malicious, and is it there?
- What is this log source incapable of showing me?
This habit applies equally to a Windows logon event, a Linux authentication entry, or an HTTP access log. It is also the fastest way to build a mental model for scenario questions, which the Interpreting Events and Intrusion Triage and Analysis objectives lean on.
Your Open-Book Index
Because paper materials are permitted, your index is a core exam tool. With 75 questions in 2 hours, you have well under two minutes per question on average, so lookups must be fast.
- Index by task and symptom, not just term. "Beaconing," "persistence," and "false-positive tuning" retrieve faster than abstract headings.
- Include worked examples. A short note such as a filter plus what it reveals beats a bare definition.
- Add a page-and-book locator to every entry. An entry you cannot find in seconds is worthless.
- Cross-reference the ten objective headings. A small front-of-binder map from objective to books and pages saves time when a question's domain is obvious but the term is not.
- Do not rely on it to substitute for understanding. Scenario questions reward people who already know where the answer lives.
Key Takeaway
Build your index while studying, not the week before. Every time you miss a concept in practice, add or fix an entry. Only use practice material in ways that respect GIAC's rules: your own notes may reflect concepts, but exam and practice-question content must not be copied into permitted references.
Where SEC450 Fits
The affiliated preparation path is SANS SEC450: AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation. Current course features include five instructor-led days, 30 self-paced hours, 30 course CPEs, 19 labs, and a MoneyMatrix Incident capstone. These describe the training, not the exam: the exam is still 75 questions in 2 hours.
Two cautions keep your expectations accurate:
- AI and agentic-workflow topics, YARA-X, and Sigma are curriculum content. They do not create new GIAC objectives or establish a separate 2026 exam version.
- Naming drift exists. An older course catalog entry still carries a previous title and different hour and lab counts. The current detailed SEC450 page governs.
SANS groups preparation into five practical areas, while GIAC publishes ten objective headings. They are different lenses on the same field, not a one-to-one mapping. Course prerequisites are recommendations (basic TCP/IP, Windows and Linux, and command-line familiarity), not GIAC exam requirements. See GSOC Training for course-path context.
Which Domain to Study When
This is the one planning section in this article, tied to how the objectives build on each other. Adjust the length to your own calendar and the 120-day attempt window.
Foundations
- Blue Team Defense Concepts and SOC Management Systems: learn the vocabulary and data flow first
- Start the index skeleton from the ten headings
Evidence Sources
- Endpoint Defense and Interpreting Events: Windows and Linux artifacts, log fields
- HTTP(S) Analysis and Attacks: web logs and request anatomy
Network Depth
- Network Traffic Analysis, then Protocol Attacks and Analysis
- Daily packet-reading and filter drills
Judgment and Improvement
- Intrusion Triage and Analysis, Analytic Design and Tuning, Operational Improvement
- Full-length timed practice (75 questions, 2 hours) and index cleanup
For a fuller plan, the GSOC Study Guide 2026 goes deeper. When you want timed repetition on scenario-style questions, the GSOC practice tests are built for exactly that kind of drill.
Numbers You Will See That Are Wrong
Search results for this credential contain conflicting claims. Check them against GIAC before you plan around them.
| Claim You May See | Reality |
|---|---|
| 115 questions, 240 minutes, 70% to pass | GIAC publishes 75 questions, 2 hours, 67% |
| Exam fee of USD 949 | GIAC's current exam fee is USD 999 before tax |
| Fixed percentage weight for each domain | GIAC publishes none; those splits are inferred or borrowed |
| A set number of questions per objective | Not published |
| Practice banks of 100 or 160 questions mirror the exam | Vendor bank sizes are not the official question count |
| GSOC pass rate or salary premium figures | No representative GSOC-specific pass-rate or salary dataset was found |
Be especially careful with pass-rate and salary numbers, since unrelated programs sharing the acronym generate misleading statistics. The honest picture is in GSOC Pass Rate 2026 and GSOC Salary Guide 2026. If you are weighing the investment, Is the GSOC Certification Worth It? covers the decision without invented figures, and How Hard Is the GSOC Exam? addresses difficulty.
On comparisons: GCIH and Blue Team Level 1 are separate credentials with their own formats and rules. Do not assume their practical components, durations, or question counts apply here, and do not treat candidate opinions as proof of equivalence.
Validity and Renewal
- Validity: 4 years.
- Renewal route: 36 qualifying CPEs within the active four-year cycle, or pass the renewal exam.
- Fee: USD 499; an additional renewal within 2 years of a full-price renewal costs USD 249.
- Deadline: CPE documentation and payment are due before expiry.
Note that the 30 CPEs attached to SEC450 are a training feature and are not described as a renewal requirement. Looking toward careers, GSOC Jobs outlines where SOC-focused roles tend to appear.
FAQ
GIAC lists 75 questions with a 2-hour time limit. Vendor practice banks may be larger, but their size does not reflect the real exam.
The minimum passing score is 67% for exam versions released on or after August 28, 2021. A population-wide pass rate has not been published.
Yes. Paper books, notes, and an index are permitted. Electronic or internet references and exam or practice-question references are prohibited.
No. GIAC publishes ten objective headings without percentage weights or per-objective question counts, so cover all ten rather than trusting a third-party split.
No. GIAC lists no mandatory education, experience, or training prerequisites. SEC450 is the affiliated preparation course, not a requirement, and its materials are not proof of exhaustive exam coverage.
Use this sheet as a fact check before you commit to a plan, then confirm anything attempt-specific on your own GIAC attempt page. When you are ready to test your recall under time pressure, head to the GSOC Exam Prep practice site, and keep this page bookmarked alongside the GSOC certification overview.