Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
GIAC (SANS)

GIAC Defending Advanced Threats

GDAT

The GIAC Defending Advanced Threats (GDAT) certification validates a practitioner’s command of both offensive and defensive security domains in depth. It prepares blue, red, and purple team professionals to prevent, detect, and respond to traditional and APT-style attacks by understanding how advanced adversaries operate. Earning GDAT demonstrates you can improve your IT environment to better defend against sophisticated threats.

Practice Free Questions

417 practice questions · Updated 2026-07-30

5Domains
10Objectives
60Concepts
417Questions

GDAT Curriculum

Every domain, objective, and concept the GDAT exam measures.

Payload Delivery

6 concepts · 33 questions
  1. Payload Delivery Mechanisms
  2. Exploit Kits and Malvertising
  3. Watering Hole Attacks
  4. Removable Media and Physical Delivery
  5. Payload Obfuscation and Evasion
  6. Payload Execution and Persistence

Payload Execution

6 concepts · 44 questions
  1. Payload Execution Fundamentals
  2. Execution Techniques
  3. Process Injection Methods
  4. Memory-Based Execution
  5. Execution Evasion Strategies
  6. Detection and Mitigation

Application Exploitation

4 concepts · 44 questions
  1. Application Exploitation Fundamentals
  2. Common Vulnerability Classes
  3. Exploitation Techniques
  4. Mitigation and Defense Strategies

Installation

5 concepts · 43 questions
  1. Installation Planning
  2. Tool Acquisition
  3. Environment Preparation
  4. Deployment Execution
  5. Post-Installation Verification

Lateral Movement

4 concepts · 42 questions
  1. Lateral Movement Fundamentals
  2. Lateral Movement Techniques
  3. Lateral Movement Detection
  4. Lateral Movement Mitigation

Active Directory/Domains

10 concepts · 38 questions
  1. Active Directory Domain Fundamentals
  2. Domain Enumeration Techniques
  3. Kerberos Authentication Flow
  4. NTLM Authentication and Relay
  5. Domain Trust Relationships
  6. Group Policy Objects (GPO) Exploitation
  7. Domain Privilege Escalation
  8. Lateral Movement via Scheduled Tasks and Services
  9. Credential Dumping and Reuse
  10. Domain Persistence Mechanisms

Administrative Access

7 concepts · 40 questions
  1. Administrative Access Principles
  2. Privileged Account Types
  3. Credential Management for Admins
  4. Multi-Factor Authentication for Admins
  5. Just-in-Time and Just-Enough Administration
  6. Monitoring and Auditing Admin Activity
  7. Admin Access Controls and Policies

Data Exfiltration

4 concepts · 45 questions
  1. Exfiltration Techniques
  2. Exfiltration Detection
  3. Exfiltration Prevention
  4. Exfiltration Response

Adversary Emulation

5 concepts · 35 questions
  1. Adversary Emulation Fundamentals
  2. Adversary Emulation Frameworks
  3. Emulation Planning
  4. Executing Emulation Scenarios
  5. Measuring Emulation Effectiveness

Reconnaissance, Threat Handling, and Incident Response

9 concepts · 53 questions
  1. Reconnaissance Fundamentals
  2. Reconnaissance Techniques
  3. Threat Handling Process
  4. Incident Response Lifecycle
  5. Threat Intelligence Integration
  6. Indicators of Compromise
  7. Containment Strategies
  8. Eradication and Recovery
  9. Lessons Learned and Reporting
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GDAT, so none is invented.