- Ten Objectives, No Published Weights
- Which GSOC This Guide Covers
- Analytic Design, Tuning and Operational Improvement
- Blue Team Concepts and Endpoint Defense
- Network Traffic, HTTP(S) and Protocol Analysis
- Interpreting Events and Intrusion Triage
- SOC Management Systems
- Mapping SEC450 Preparation to the Ten Objectives
- Exam Mechanics That Shape How You Study
- Scheduling the Domains Across Your Prep
- Frequently Asked Questions
- GIAC publishes ten GSOC exam objectives but no official percentage weights, so never trust sites quoting per-domain question counts.
- The exam has 75 questions in 2 hours, with a 67% minimum passing score.
- Paper books and index are permitted; electronic references and practice-question materials are prohibited.
- SANS groups the ten objectives into five preparation areas, but the exam list stays at ten headings.
Ten Objectives, No Published Weights
The GIAC Security Operations Certified (GSOC) credential is organized around ten exam-objective headings on GIAC's public certification page. Unlike some vendors, GIAC does not number these as weighted domains, and the sources we retrieved publish no percentage weights, no highest-weight objective, and no per-objective question allocations. Any article, dump site or forum post claiming "Domain 4 is 15% of the exam" is inventing a number.
That matters for how you study. With 75 questions spread across ten headings and no official split, the safest assumption is that every objective can show up and that cross-cutting skills, such as reading a packet capture while reasoning about an alert, will blur the boundaries between them. This guide walks through each of the ten objectives by name, explains what a working SOC analyst needs to know in that area, and shows how to turn that knowledge into an index that works under a two-hour clock.
| # | Objective (as listed by GIAC) | Core theme |
|---|---|---|
| 1 | Analytic Design and Tuning | Building and refining detections |
| 2 | Blue Team Defense Concepts | Defensive models and strategy |
| 3 | Endpoint Defense | Host telemetry and protection |
| 4 | HTTP(S) Analysis and Attacks | Web traffic and web-borne threats |
| 5 | Interpreting Events | Making sense of alerts and logs |
| 6 | Intrusion Triage and Analysis | Prioritizing and investigating |
| 7 | Network Traffic Analysis | Packet and flow interpretation |
| 8 | Operational Improvement | Maturing SOC processes |
| 9 | Protocol Attacks and Analysis | Abuse of network protocols |
| 10 | SOC Management Systems | Tooling that runs the SOC |
Which GSOC This Guide Covers
"GSOC" is a crowded acronym. Google Summer of Code uses it, and many people use it as shorthand for a generic Global Security Operations Center. This site is about one credential only: GIAC Security Operations Certified (GSOC), administered by GIAC. If you need the basics first, our explainers on what GSOC certification is and what GSOC stands for cover the naming, and the GSOC requirements guide confirms there are no mandatory prerequisites to sit the exam, though preparation is recommended.
Analytic Design and Tuning, and Operational Improvement
These two objectives sit at opposite ends of the same loop: build a detection, watch how it performs, then improve the process around it.
Domain 1: Analytic Design and Tuning
Expect to reason about what makes a detection good or bad rather than recite tool menus. Candidates should be comfortable thinking through the following.
- How an analytic's logic maps to observable attacker behavior, and what data source it needs.
- Why a rule produces false positives, and which adjustments reduce noise without creating blind spots.
- The trade-off between broad detections that catch variants and narrow ones that are easy to triage.
- How detection content formats such as Sigma and YARA-style rules express logic portably.
Domain 8: Operational Improvement
This objective is about the SOC as a system that should get measurably better over time.
- Using incident outcomes to feed new or retuned detections.
- Identifying coverage gaps and prioritizing what to fix first.
- Process refinement: playbooks, handoffs, escalation criteria and feedback loops.
- Choosing sensible metrics and understanding what they can and cannot tell you.
A useful drill: take any alert you have seen and ask three questions. What behavior is this trying to detect? What benign activity could trigger it? What single change would reduce false positives while preserving the true-positive case? That habit covers both objectives at once.
Blue Team Defense Concepts and Endpoint Defense
Domain 2: Blue Team Defense Concepts
This is the conceptual backbone. Know how defenders structure their thinking before the tool-specific questions arrive.
- How attacker lifecycle models help you place an alert in context and anticipate the next step.
- Layered defense, visibility versus prevention, and where detection fits among other controls.
- The relationship between prevention, detection and response, and how a SOC supports each.
Domain 3: Endpoint Defense
Endpoints generate some of the richest evidence a SOC sees. Candidates should be fluent in the Windows and Linux artifacts that reveal malicious activity.
- Process creation, parent-child relationships and command-line arguments as indicators of abuse.
- Authentication and logon evidence on Windows and Linux hosts.
- Persistence mechanisms and how endpoint telemetry exposes them.
- What endpoint protection and detection tooling can and cannot see.
For endpoint questions, practice reading a short log excerpt and stating what happened in one sentence. If a process spawned from an unexpected parent with an encoded command line, say so plainly, then name the follow-up evidence you would pull. That workflow transfers directly to the harder scenario-style questions candidates describe.
Network Traffic, HTTP(S) and Protocol Analysis
Three objectives share a common skill: reading network evidence and understanding what normal looks like well enough to spot what is not.
Domain 7: Network Traffic Analysis
Be able to move from a flow summary or capture to a conclusion.
- Reading conversations, ports, directions and volumes to characterize behavior such as beaconing or bulk transfer.
- Using Wireshark-style display filters to isolate hosts, protocols and suspicious patterns.
- Knowing where full packet capture, flow records and logs each help and where they fall short.
Domain 4: HTTP(S) Analysis and Attacks
Web traffic is both the most common channel for legitimate business and a favorite for attackers.
- Request and response structure: methods, headers, status codes, cookies and user agents.
- Recognizing common web attack patterns in logs and captures.
- What encryption hides, what metadata remains visible, and how that changes your analysis options.
Domain 9: Protocol Attacks and Analysis
This objective rewards protocol mechanics knowledge, a topic candidates on public forums say they worry about most.
- How core protocols normally behave, so deviations stand out.
- Abuse of name resolution, authentication and file-sharing protocols.
- Mapping a protocol-level anomaly to the attacker technique it suggests.
Interpreting Events and Intrusion Triage
Domain 5: Interpreting Events
Raw events rarely announce what they mean. This objective tests whether you can read them correctly.
- Distinguishing normal administrative activity from attacker tradecraft that uses the same tools.
- Correlating timestamps, identities and hosts across multiple sources.
- Recognizing what a log line does not prove, and what corroboration you would seek.
Domain 6: Intrusion Triage and Analysis
Once something looks suspicious, the analyst must decide how worried to be and what to do next.
- Prioritizing by asset value, confidence and potential impact.
- Scoping: which other hosts, accounts and indicators are involved.
- Knowing when to escalate, contain or keep collecting evidence.
The two objectives form a pipeline: interpret, then triage. When you review a missed practice question, label which stage you failed at. Misreading the evidence is an Interpreting Events gap. Reading it correctly but choosing a poor next step is a Triage gap. The fixes are different.
SOC Management Systems
Domain 10: SOC Management Systems
This objective covers the platforms that hold a SOC together.
- SIEM concepts: ingestion, normalization, correlation, search and alerting.
- Case and ticket handling, and how automation and orchestration reduce repetitive work.
- Data quality: what happens downstream when logs are missing, mis-parsed or delayed.
Because this objective touches the tools behind everything else, it connects to Analytic Design and Tuning, since a detection is only as good as the data and platform behind it, and to Operational Improvement, since automation is a primary improvement lever.
Mapping SEC450 Preparation to the Ten Objectives
The affiliated SANS course is SEC450: AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation. SANS groups the GSOC objectives into five practical preparation areas, while GIAC itself lists ten headings. Both views are valid; they serve different purposes.
| Source | What it provides | Use it for |
|---|---|---|
| GIAC certification page | Ten exam objective headings, no weights | The authoritative scope of the exam |
| SANS preparation grouping | Five practical areas that bundle the objectives | Structuring your course study |
| SEC450 course content | Five instructor-led days, 30 self-paced hours, 19 labs, a MoneyMatrix Incident capstone | Training features, not exam specifications |
Training is optional; our overview of GSOC training options weighs the routes, and the GSOC certification cost breakdown separates exam fees from tuition so you can budget honestly.
Exam Mechanics That Shape How You Study
The exam is a single web-based proctored test delivered through Pearson VUE onsite or ProctorU remote, subject to attempt-specific restrictions. It contains 75 questions with a 2-hour limit, and you need 67% to pass. GIAC's current pages do not spell out the item-type mix or a scored/unscored breakdown, and no CyberLive component was verified for GSOC, so avoid planning around assumptions about hands-on lab tasks.
- Time math: 120 minutes across 75 questions averages just over a minute and a half each. Index lookups must be fast.
- Open-book, paper only: Printed books, notes and your index are permitted. Electronic and internet resources, and exam or practice-question references, are prohibited.
- No revisions after submission: Answers cannot be changed once submitted. A limited skip allowance and a 15-minute break allowance apply.
- Fees: The exam is USD 999 before tax, a failed-exam retake is USD 899, a 45-day extension is USD 479 and the official practice test is USD 399.
For the arithmetic behind the cut score, see the GSOC passing score guide. For scheduling windows and attempt deadlines, see GSOC exam dates and scheduling. Note that passing score and population pass rate are different things; the GSOC pass rate article explains why no verified population figure is available.
Building an index that matches the objectives
An index organized only by book and page forces you to guess where a concept lived. Instead, build entries keyed by what the question asks. For example: "beaconing indicators," "Windows logon event meanings," "HTTP status code classes," "detection tuning levers," "SIEM correlation concepts." Add a few worked mini-examples, such as a Wireshark filter you use to isolate a host or a command-line pattern you consider suspicious, beside the relevant entry. Our GSOC cheat sheet offers a one-page fact review to complement, not replace, your own index.
Practice material, used carefully
Official practice tests and independent learning questions serve different purposes, and neither guarantees a result. Use practice to find weak objectives, then return to your books and labs. Do not copy, photograph or retain GIAC exam question content, and be wary of dump-style sites. If you want realistic timed drills built around the ten objectives, start at our GSOC practice test hub.
Scheduling the Domains Across Your Prep
Because the objectives overlap, sequence them so that foundations come before the integrative skills. Here is one ordering, tied to the objectives rather than a generic template. The full method, including pacing and review loops, is in the GSOC study guide.
Foundations
- Blue Team Defense Concepts and SOC Management Systems: vocabulary, models and tooling you will assume everywhere else.
Evidence Sources
- Endpoint Defense and Interpreting Events: Windows and Linux artifacts, log reading, one-sentence summaries.
Network Layer
- Network Traffic Analysis, HTTP(S) Analysis and Attacks, and Protocol Attacks and Analysis: captures, filters, protocol mechanics.
Judgment and Improvement
- Intrusion Triage and Analysis, Analytic Design and Tuning, and Operational Improvement: scoped investigations, tuning exercises, finalizing the index and timed runs.
The reasoning: triage and tuning questions assume you can already read the underlying evidence, so they come last. Expand or compress the timeline to match your experience and the 120-day attempt window that applies to a standalone exam activation.
Key Takeaway
Study by objective, but practice by scenario. Take one piece of evidence, whether a capture, a log excerpt or an alert, and walk it through interpretation, triage and tuning. That mirrors how the ten objectives interlock on the real exam.
Careers and credential value
GSOC aligns with SOC analyst work: monitoring, triage, investigation and detection improvement. If you are weighing it against other credentials, remember that GCIH and Blue Team Level 1 are separate certifications with their own scope and format; do not assume their assessment styles apply to GSOC. For role and value discussion, see our pieces on GSOC jobs, earnings expectations and whether the certification is worth it. No representative GSOC-specific salary dataset or verified causal salary uplift currently exists, so treat any precise figure with suspicion.
The credential is valid for four years. Renewal requires 36 qualifying CPEs during the cycle or passing the renewal exam, with a USD 499 renewal fee.
Frequently Asked Questions
GIAC lists ten exam-objective headings: Analytic Design and Tuning, Blue Team Defense Concepts, Endpoint Defense, HTTP(S) Analysis and Attacks, Interpreting Events, Intrusion Triage and Analysis, Network Traffic Analysis, Operational Improvement, Protocol Attacks and Analysis, and SOC Management Systems. These are unweighted headings rather than an issuer-numbered weighted system.
No. The retrieved GIAC sources publish no per-objective weights, no highest-weight objective and no question allocations. Sites that quote percentages or equal per-domain question counts are inferring, not reporting issuer data.
No. AI and agentic-workflow topics are part of the current SEC450 preparation curriculum. They do not establish a new exam heading, weighting or separately versioned 2026 exam. The ten published objective headings define exam scope.
Paper books, notes and an index are permitted. Electronic and internet references are prohibited, as are exam or practice-question references. Your index should be organized by concept and question type so lookups take seconds.
The minimum passing score is 67% for exam versions released on or after August 28, 2021, on a 75-question, 2-hour exam. Your certification information page for a purchased attempt is the authority for that attempt's specifications.