- What "9 Domains" Actually Means for GPCS
- The Exam Frame That Surrounds the Objectives
- Domains 1 and 2: Protecting Data and Controlling Identity
- Domains 3 and 4: Benchmarking, Integration and Multicloud Credentials
- Domains 5 and 6: Access Paths and Application Platforms
- Domains 7, 8 and 9: Storage, Serverless and Network Visibility
- Mapping the Nine Objectives to SEC510
- Sequencing the Domains Across Your Prep Weeks
- Building an Open-Book Index Around Domains
- Frequently Asked Questions
- GIAC publishes nine exam-objective headings for GPCS, but no official percentage weights, so never trust a site quoting weighted domains.
- The exam is 75 questions in 2 hours with a 64% minimum passing score.
- Paper books, notes and an index are allowed; electronic and internet references are prohibited.
- Cross-cloud topics like identity and logging span several domains, so index by concept, not just by book.
What "9 Domains" Actually Means for GPCS
If you search for the GIAC Public Cloud Security (GPCS) exam domains, you will find plenty of pages presenting tidy percentage breakdowns. Be skeptical. GIAC's official certification page lists nine sequential exam-objective headings with outcome statements, but it does not publish percentage weights, a highest-weight objective, or a separately numbered domain blueprint. The "nine domains" in this guide are those nine objective headings, listed in the order GIAC presents them.
That distinction matters for how you study. Without official weights, you cannot rationally skip a domain because you assume it is "only 5% of the exam." Equal per-objective question allocations are not published either, so any claim that each domain contributes a fixed number of your 75 questions is an inference, not a fact. The safe strategy is broad competence across all nine areas, with extra depth where your professional background is thinnest.
For a broader orientation to the credential itself, see our explainer on what GPCS certification is, and for the cost side of the equation, the GPCS certification cost breakdown.
The Exam Frame That Surrounds the Objectives
Before diving into each domain, anchor the logistics, because they shape how you must prepare for the content:
| Item | Verified GPCS detail |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 64% (exam versions released on or after August 16, 2021) |
| Delivery | Proctored, web-based; Pearson VUE onsite or ProctorU remote, subject to attempt-specific modality restrictions |
| Exam fee | USD 999 before tax |
| Failed-exam retake | USD 899 |
| Validity | 4 years; renewal via 36 CPEs or renewal exam |
| Reference materials | Paper books, notes and index permitted; electronic and internet references prohibited |
Two hours for 75 questions works out to well under two minutes per item on average, which is the practical reason the open-book index matters so much. GIAC also states that answers cannot be revised after submission, offers a limited skip allowance, and provides 15 minutes of break time. The item mix (multiple choice versus case-study or performance-based) and the scored/unscored split are not published for this credential, and CyberLive is not verified for GPCS, so avoid planning around any specific lab format. Your purchased attempt's certification-information page is the authority for that attempt's specifications.
For a deeper look at the numbers, read our guides to the GPCS passing score and the GPCS pass rate. Note that the 64% minimum passing score is not the same thing as a population pass rate, and GIAC does not publish a verified pass rate in the sources we reviewed.
Domains 1 and 2: Protecting Data and Controlling Identity
Domain 1: Cloud Data Protection
This objective centers on how data is protected across its lifecycle in public cloud environments. Expect to reason about where encryption is applied, who holds the keys, and how protection choices differ between providers.
- Encryption at rest and in transit, and the difference between provider-managed and customer-managed keys
- Key management services, key rotation and the blast radius of a compromised key
- Data classification and how it drives control selection
- Why a control that works in one provider may map to a differently named service in another
Domain 2: Cloud Identity and Access Management
Identity is the control plane of public cloud. This domain tests whether you can design and troubleshoot who can do what, to which resources, under which conditions.
- Principals, roles, policies and the evaluation logic that decides allow versus deny
- Least privilege, permission boundaries and separation of duties
- Federation and single sign-on between an enterprise identity provider and cloud accounts
- Multi-factor authentication and the handling of privileged and break-glass access
These two domains are foundational and bleed into everything else. A scenario about serverless functions or storage buckets will almost always hinge on an identity policy or an encryption decision. Candidates who treat Domains 1 and 2 as isolated chapters often struggle when the exam blends them. Our GPCS difficulty guide discusses why integrated scenarios, rather than isolated facts, tend to be the hard part.
Domains 3 and 4: Benchmarking, Integration and Multicloud Credentials
Domain 3: Cloud Integration and Benchmarking
This area is about measuring your cloud posture against recognized baselines and integrating security tooling into how cloud environments are built and operated.
- Security benchmarks and how to interpret findings against them
- Automated assessment of configuration drift versus one-time audits
- Integrating security checks into build and deployment workflows
- Turning benchmark output into prioritized remediation rather than a raw list of findings
Domain 4: Multicloud and Credential Management Fundamentals
Organizations rarely live in one cloud. This domain asks you to think about consistency, and about the credentials that bind systems together.
- Differences in terminology and default behavior across major public cloud providers
- Secrets and credential storage, rotation and the hazards of long-lived static credentials
- Short-lived, federated credentials as a replacement for embedded keys
- Maintaining a consistent control objective when each provider implements it differently
Domains 5 and 6: Access Paths and Application Platforms
Domain 5: Securely Accessing Cloud Services
How do administrators, developers and workloads reach cloud services, and how do you make those paths safe? This domain is about the entry points.
- Management console, command-line and API access, and how each is authenticated and logged
- Private connectivity options versus exposure over the public internet
- Protecting administrative sessions and limiting where privileged access can originate
- Service-to-service access patterns and the credentials they rely on
Domain 6: Securing Cloud Application Service Platforms
Here the focus shifts to the platforms on which applications run and the managed services around them.
- Shared responsibility: what the provider secures versus what you must configure
- Hardening managed application platforms and reviewing their default settings
- Secure configuration of application-facing services and their dependencies
- Patching and configuration responsibilities that change depending on how managed the platform is
The shared-responsibility model is the thread that ties Domain 6 together. A recurring question pattern is deciding whether a given risk belongs to the provider or to you, so practice stating the boundary for each service model out loud. Our GPCS study guide covers how to turn this kind of reasoning into daily practice.
Domains 7, 8 and 9: Storage, Serverless and Network Visibility
Domain 7: Securing Cloud Storage Platforms
Cloud storage misconfiguration is one of the most visible failure modes in public cloud, so expect concrete, configuration-level reasoning.
- Access control layers on object and file storage and how they interact
- Preventing unintended public exposure and detecting it when it happens
- Encryption, versioning and retention controls for stored data
- Auditing who accessed what, and when
Domain 8: Securing Serverless Functions
Serverless shifts the attack surface from servers to code, permissions and event sources.
- Function execution roles and why over-permissioned roles are the dominant risk
- Event triggers as an input-validation and abuse concern
- Handling secrets and environment configuration inside functions
- Monitoring ephemeral execution where there is no host to inspect
Domain 9: Virtual Network Security and Logging
The final objective pairs network controls with the visibility needed to detect misuse.
- Segmentation, security groups, network access controls and routing in virtual networks
- Controlling ingress and egress to limit lateral movement
- Flow logs, audit trails and centralized log collection
- Using logs to detect misconfiguration and investigate incidents
Notice how Domain 9's logging theme reappears everywhere else: you cannot verify a storage policy, a function role or an administrative session without an audit trail. When you build your notes, cross-reference logging into each of the other eight domains.
Mapping the Nine Objectives to SEC510
SANS SEC510, Cloud Security Engineering and Controls, is the affiliated course associated with the certification. SANS groups the nine objectives into five practical course domains. Because neither SANS nor GIAC publishes weights for these groupings, treat the mapping below as a study aid, not a blueprint.
A useful way to think about the relationship is by theme rather than by a rigid one-to-one table:
- Identity and credentials: Domains 2 and 4 belong together mentally, since both revolve around who or what is trusted.
- Data and storage: Domains 1 and 7 share encryption and access-control reasoning.
- Compute and application layers: Domains 6 and 8 cover managed platforms and serverless execution.
- Network and access paths: Domains 5 and 9 cover how things connect and how that is observed.
- Assurance and consistency: Domain 3 benchmarking cuts across all the rest.
The course page reports 38 CPEs while the linked brochure reports 30; these are training credits and do not change the two-hour exam or the 36-CPE renewal requirement. SEC510 is optional: GIAC lists no mandatory education, experience hours or training for sitting the exam, a point we expand on in our GPCS requirements guide. Tuition is separate from the exam fee, which is detailed in the pricing breakdown.
Key Takeaway
Use the five-group SEC510 themes to organize your notes, but let the nine GIAC objective headings be your completeness checklist. If a topic cannot be tied to one of the nine headings, it is lower priority for the exam even if it appeared in a course lecture.
Sequencing the Domains Across Your Prep Weeks
This is the only study-planning section in this article, and it is deliberately tied to the domains. The logic: learn the shared foundations first, then the services built on them, then the visibility layer that verifies everything. Your standalone attempt window is 120 days from activation, so a compact plan fits comfortably inside it.
Identity and data foundations
- Domain 2 (IAM) first, because every later domain depends on policy logic
- Domain 1 (data protection) alongside it for key and encryption concepts
Credentials and multicloud translation
- Domain 4 (multicloud and credential management)
- Start your cross-provider terminology table
Access paths and platforms
- Domain 5 (secure access) and Domain 6 (application platforms)
- Practice shared-responsibility boundary questions
Storage and serverless
- Domain 7 (storage) and Domain 8 (serverless)
- Revisit IAM through the lens of function roles and bucket policies
Network, logging and benchmarking
- Domain 9 (virtual network security and logging)
- Domain 3 (integration and benchmarking) to tie findings back to controls
Timed integration
- Full-length timed practice under two-hour conditions
- Finalize and tab your index
Adjust the order based on your background. A network engineer may compress Week 5 and expand Week 1, while an identity specialist may do the reverse. For a broader planning framework, see our GPCS study guide, and when you are ready to test yourself, use the practice tests on the main site.
Building an Open-Book Index Around Domains
Because paper books, notes and an index are permitted, your index is effectively a tenth study domain. The recurring difficulty is that concepts such as identity policies, logging and encryption appear in several books and across several of the nine objectives. A purely book-by-book index forces you to hunt through multiple volumes under time pressure.
- Index by concept first, location second. Create one entry per concept (for example, "execution role") and list every book and page where it appears.
- Add a provider column. Record the equivalent term for each major cloud so a renamed control still lands on the right entry.
- Tag each entry with its objective number. This helps you see which domains are thinly covered in your notes.
- Keep it paper. Electronic and internet references are prohibited, and exam or practice-question references are not allowed either.
- Test it under the clock. If you cannot find an entry in well under a minute, restructure it.
An index will not substitute for understanding, and nobody has validated a magic page-count or question-count formula for passing. Use it as a safety net for specifics, such as exact option names, while relying on comprehension for scenario reasoning. If you want a compact companion, our GPCS cheat sheet distills the must-know facts.
Frequently Asked Questions
No. GIAC lists nine exam-objective headings with outcome statements but does not publish percentage weights or a highest-weight objective in the sources reviewed. Treat any site quoting precise domain percentages with caution and prepare for all nine areas.
The exam has 75 questions with a 2-hour time limit, and the minimum passing score is 64% for exam versions released on or after August 16, 2021. Some third-party sites list three hours or different thresholds; those conflict with GIAC's published figures.
Paper books, notes and an index are permitted, while electronic and internet references and exam or practice-question references are prohibited. This is why a concept-based index spanning the nine domains is so valuable. Confirm details on your attempt's certification-information page.
No. GIAC lists no mandatory education, experience hours or training for the exam, though preparation is recommended. SEC510 is affiliated preparation with separate tuition; it is not proof of exhaustive exam coverage. See the requirements guide for details.
The exam fee is USD 999 before tax, with a USD 899 failed-exam retake. The certification is valid for 4 years and renews through 36 CPEs or a renewal exam, with a USD 499 renewal fee. Full details are in the cost breakdown.