Group Purchasing
Group Purchasing

What Is the GCTD Certification?

The GIAC Cloud Threat Detection (GCTD) certification validates a practitioner's ability to detect and investigate suspicious activity in cloud infrastructure. GCTD certification holders are experienced professionals in cyber threat intelligence, secure cloud configuration, and key practices for defending cloud solutions and services.

By the numbers

2 hrs

Exam duration

75

Questions

70%

Min. passing score

What GCTD Covers

GIAC publishes 12 exam objectives for GCTD. They group into five practical domains.

Cloud and Network Detection

Covers Cloud Monitoring Fundamentals, Network and Flow Monitoring, and Cyber Threat Intelligence for the Cloud.

Compute and Application Monitoring

Covers Host OS Monitoring, Containers and Orchestration, Application and Proxy Monitoring, and Data and Storage Monitoring.

Security Services and AWS Investigation

Covers Cloud Vulnerability Analysis and Investigating AWS Environments.

Azure Investigation

Covers Investigating Azure Environments.

Log Centralization and Automation

Covers Log Centralization and Automated Detection and Response.

Prepare With This Course

SEC541: Cloud Security Threat Detection

How SEC541 Prepares You for GCTD

SEC541 is built around the exam objectives that make up the GCTD certification: 

  • Section 1, Detection of Cloud API and Network Attacks builds skills tested under Cloud Monitoring Fundamentals, Network and Flow Monitoring, and Cyber Threat Intelligence for the Cloud.
  • Section 2, Compute and Application Attacks aligns with Host OS Monitoring, Containers and Orchestration, Application and Proxy Monitoring, and Data and Storage Monitoring.
  • Section 3, Security Services and Investigations aligns with Cloud Vulnerability Analysis and Investigating AWS Environments.
  • Section 4, Microsoft Ecosystem builds skills tested under Investigating Azure Environments.
  • Section 5, Data Shipping, Automation and CloudWars aligns with Log Centralization and Automated Detection and Response.

Across all 5 sections, 22 hands-on labs and the CloudWars capstone Capture the Flag challenge give you the chance to apply each skill in live AWS and Azure environments before you sit the exam. 

Read the full GCTD certification overview 

SEC541 Course Authors

Who Should Pursue GCTD

Security Analysts and SOC Operators

Security Engineers and Threat Detection Engineers

Security Architects and Vulnerability Assessors

Incident Responders

Anyone Responsible for Cloud Logging

Frequently Asked Questions

The GIAC Cloud Threat Detection (GCTD) certification validates a practitioner's ability to detect and investigate suspicious activity in cloud infrastructure. Holders are experienced in cyber threat intelligence, secure cloud configuration, and key practices for defending cloud solutions and services. 

The GCTD exam is one proctored exam with 75 questions and a 2-hour time limit. The minimum passing score is 70%. GIAC may update exam specifications, so check the Certification Information section of your GIAC account for the format that applies to your attempt. 

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page. 

GIAC lists security analysts, security engineers, security architects, vulnerability assessors, and incident responders, along with anyone who performs monitoring, threat detection, or incident response and anyone responsible for logging in a cloud environment. 

SEC541: Cloud Security Threat Detection provides great training if you're thinking of pursuing GCTD. The course includes 22 hands-on labs and a CloudWars capstone Capture the Flag challenge in SANS-provided AWS and Azure accounts, and its five sections map to the GCTD exam objectives. 

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GCTD certification?

Add the GCTD exam attempt when you register for SEC541.

GIAC Cloud Threat Detection Certification (GCTD) | SANS Institute