GIAC (SANS)GIAC Cloud Security Architecture and Design
The GIAC Cloud Security Architecture and Design (GCAD) certification validates your ability to secure cloud environments using zero-trust strategies and foundational architecture principles. It is designed for cloud architects, engineers, and security professionals who design and implement secure cloud architectures. Earning GCAD demonstrates expertise in identity and access management, network security, data protection, and centralized monitoring across cloud providers.
744 practice questions · Updated 2026-07-30
5Domains
18Objectives
152Concepts
744Questions
GCAD Curriculum
Every domain, objective, and concept the GCAD exam measures.
- Cloud Identity Fundamentals
- Identity Providers (IdPs)
- Federated Identity
- Identity Lifecycle Management
- Cloud Identity Security Controls
- Customer Identity and Access Management (CIAM) Fundamentals
- CIAM vs. Traditional IAM
- Customer Identity Lifecycle Management
- Authentication Methods for Customers
- Authorization and Access Control for Customers
- Customer Consent and Privacy Compliance
- CIAM Architecture and Integration
- Security and Risk Management in CIAM
- Customer Experience and Self-Service
- CIAM Analytics and Insights
- Federated Identity Concepts
- SSO Fundamentals
- SAML 2.0
- OAuth 2.0 and OpenID Connect
- WS-Federation
- Identity Provider (IdP) and Service Provider (SP) Roles
- Trust Relationships and Metadata
- Federation Protocols Comparison
- SAML Assertions and Attributes
- Token Formats and Claims
- Federation Security Considerations
- SSO Implementation Patterns
- Session Management in SSO
- Federation with Cloud Providers
- Identity Federation Standards and Interoperability
- Conditional Access Policy Fundamentals
- Policy Components
- Assignments and Conditions
- Access Controls
- Policy Evaluation and Enforcement
- Design Considerations
- Monitoring and Troubleshooting
- Cross-Cloud Identity Challenges
- Federated Identity Models
- Standards for Cross-Cloud Identity
- Identity Provider (IdP) Strategies
- Directory Synchronization and Provisioning
- Cross-Cloud Trust Relationships
- Policy and Attribute Mapping
- Security and Compliance Considerations
- Micro-segmentation fundamentals
- Zero trust model
- Segmentation techniques
- Security group and policy design
- Distributed firewall architecture
- Service-to-service communication control
- Implementation strategies
- Monitoring and management
- Firewall Placement Strategies
- Stateful vs Stateless Firewalls
- Next-Generation Firewall (NGFW) Capabilities
- Cloud-Native Firewall Services
- Traffic Inspection Methods
- Firewall Policy Management
- Logging and Monitoring of Firewall Traffic
- Cloud Network Scaling Challenges
- Network Segmentation Strategies
- Automated Network Provisioning
- Centralized Network Management
- Scalable Connectivity Options
- Performance Optimization at Scale
- Security and Compliance at Scale
- Monitoring and Troubleshooting
- Cost Management for Network Resources
- Disaster Recovery and High Availability
- Data Classification
- Data Lifecycle Management
- Data Encryption
- Data Masking and Tokenization
- Data Loss Prevention (DLP)
- Data Retention and Disposal
- Data Access Controls
- Data Integrity and Non-Repudiation
- Data Privacy and Compliance
- Data Security in Cloud Environments
- Data Classification and Labeling
- Encryption Key Management
- Data Masking and Tokenization
- Data Loss Prevention (DLP)
- Secure Data Storage Architectures
- Data Lifecycle Management
- Data Residency and Sovereignty
- Cloud Access and Data Permissions
- Key Management Fundamentals
- Key Lifecycle Management
- Key Storage and Protection
- Key Distribution and Exchange
- Key Rotation and Retirement
- Key Management in Cloud Environments
- Compliance and Auditing of Key Management
- Data Classification Fundamentals
- Classification Categories and Levels
- Classification Process and Ownership
- Resource Tagging Basics
- Tagging Strategies and Best Practices
- Integration of Classification and Tagging
- Logging Architecture
- Log Sources and Types
- Log Aggregation Methods
- Log Retention and Compliance
- Log Integrity and Tamper-Proofing
- Correlation and Analysis
- Centralized Log Management Tools
- Logging for Incident Response
- Log Integration Architecture
- Log Source Onboarding
- Log Normalization and Parsing
- Log Enrichment
- Log Correlation and Analysis
- Log Retention and Storage Optimization
- Log Integration Security
- Operational Dashboards and Alerting
- Automation and Orchestration of Log Workflows
- Compliance and Audit Readiness
- Cloud Incident Response Lifecycle
- Cloud-Specific Incident Response Challenges
- Incident Response in Shared Responsibility Model
- Cloud Incident Detection and Alerting
- Cloud Forensic Evidence Collection
- Containment and Isolation in Cloud
- Eradication and Recovery in Cloud
- Cloud Incident Response Automation
- Post-Incident Activity and Lessons Learned
- Zero Trust Architecture Principles
- Zero Trust Components
- Zero Trust Implementation Strategies
- Zero Trust Governance
- Zero Trust Maturity Model
- Hierarchical Cloud Structure Definition
- Cloud Hierarchy Levels
- Policy Inheritance in Hierarchies
- Resource Organization and Management
- Access Control in Hierarchies
- Governance and Compliance Mapping
- Hierarchy Design Best Practices
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCAD, so none is invented.