GIAC (SANS)GIAC Critical Controls Certification
The GIAC Critical Controls Certification (GCCC) validates a practitioner's command of the CIS Critical Security Controls, a prioritized, risk-based approach to security. It is designed for security professionals, auditors, and risk officers who implement, execute, and audit these controls. Earning GCCC demonstrates you can operationalize standards and controls to effectively manage risk and defend your enterprise.
872 practice questions · Updated 2026-07-30
7Domains
18Objectives
152Concepts
872Questions
GCCC Curriculum
Every domain, objective, and concept the GCCC exam measures.
- CIS Controls Overview
- CIS Controls Versions and Evolution
- CIS Controls Implementation Groups
- Standards and Frameworks Landscape
- Governance in Cybersecurity
- CIS Controls and Governance Integration
- Service Provider Management Overview
- Vendor Risk Assessment
- Contractual Security Requirements
- Service Level Agreements (SLAs)
- Ongoing Monitoring and Review
- Incident Response Coordination
- Termination and Transition
- Inventory of Enterprise Assets
- Asset Discovery Techniques
- Asset Tracking and Maintenance
- Control of Enterprise Assets
- Asset Classification and Criticality
- Integration with Configuration Management
- Software Inventory Definition
- Inventory Discovery Methods
- Inventory Data Collection
- Inventory Centralization
- Software Asset Lifecycle
- Inventory Accuracy and Completeness
- Software Usage Tracking
- Integration with Configuration Management
- Automation of Inventory Processes
- Inventory Reporting and Visibility
- Secure Configuration Baselines
- Configuration Management Process
- Automated Configuration Enforcement
- Configuration Drift Detection
- Asset Inventory Integration
- Software Configuration Hardening
- Compliance and Audit Readiness
- Access Control Models
- Access Control Principles
- Authentication Methods
- Authorization Mechanisms
- Account Lifecycle Management
- Access Control Implementation
- Access Control Monitoring and Auditing
- Identity and Access Management (IAM)
- Account Lifecycle Management
- Account Provisioning
- Account Deprovisioning
- Account Maintenance and Review
- Privileged Account Management
- Service and Shared Accounts
- Account Authentication Controls
- Account Authorization Controls
- Account Monitoring and Auditing
- Account Lockout and Recovery
- Data Protection Fundamentals
- Data Classification
- Data Lifecycle Management
- Backup Strategies
- Recovery Point Objective (RPO)
- Recovery Time Objective (RTO)
- Data Encryption
- Data Masking and Redaction
- Data Retention Policies
- Data Disposal and Sanitization
- Data Availability Controls
- Data Integrity Verification
- Data Protection in Cloud Environments
- Data Protection Monitoring and Auditing
- Data Recovery Fundamentals
- Recovery Objectives (RPO and RTO)
- Backup Strategies
- Recovery Point and Time Trade-offs
- Recovery Procedures and Testing
- Disaster Recovery vs. Data Recovery
- Audit Log Fundamentals
- Audit Log Sources
- Log Collection and Aggregation
- Log Retention and Storage
- Log Integrity and Protection
- Audit Log Analysis
- Audit Log Review and Reporting
- Audit Log Management Best Practices
- Vulnerability Management Lifecycle
- Vulnerability Scanning
- Scanning Tools and Techniques
- Vulnerability Assessment vs. Penetration Testing
- Prioritization and Risk Scoring
- Remediation and Mitigation Strategies
- Reporting and Metrics
- Continuous Monitoring and Reassessment
- Network Monitoring Fundamentals
- Network Defense Mechanisms
- Monitoring Tools and Techniques
- Incident Detection and Response
- Log Management and Analysis
- Network Segmentation and Access Control
- Threat Intelligence Integration
- Continuous Improvement and Metrics
- Malware Types and Vectors
- Malware Defense Layers
- Signature-Based Detection
- Heuristic and Behavioral Analysis
- Sandboxing and Dynamic Analysis
- Application Whitelisting
- Patch and Vulnerability Management
- User Education and Awareness
- Incident Response for Malware
- Application Security Fundamentals
- Secure Software Development Lifecycle (SSDLC)
- Common Application Vulnerabilities
- Threat Modeling
- Secure Coding Practices
- Application Security Testing
- Web Application Firewalls (WAF)
- API Security
- Container and Orchestration Security
- Application Security Monitoring and Response
- Email Threat Landscape
- Email Authentication Protocols
- Email Filtering and Sandboxing
- User Awareness and Training
- Web Browser Security Features
- Web Filtering and Proxy Controls
- Secure Web Gateway (SWG)
- Browser Isolation
- URL and Content Reputation
- DNS Security
- Web Application Controls
- Incident Response for Email and Web
- Network Infrastructure Components
- Network Segmentation
- Secure Device Configuration
- Patch and Vulnerability Management
- Network Monitoring and Logging
- Access Control for Network Devices
- Redundancy and High Availability
- Network Hardening
- Incident Response for Network Infrastructure
- Incident Response Lifecycle
- Incident Response Team Roles
- Incident Classification and Triage
- Incident Detection and Reporting
- Containment, Eradication, and Recovery
- Post-Incident Activities
- Incident Response Testing and Exercises
- Penetration Testing Fundamentals
- Penetration Testing Methodologies
- Reconnaissance Techniques
- Vulnerability Scanning and Analysis
- Exploitation Techniques
- Post-Exploitation Activities
- Reporting and Remediation
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCCC, so none is invented.