- What the GCSA Credential Certifies
- Exam Mechanics: Format, Fees, and Access
- The 18 Exam Objectives, Grouped by Theme
- How SEC540 Relates to the Exam
- Working With an Open-Book Exam
- Sequencing Your Preparation by Domain
- Who Benefits From This Certification
- Keeping the Credential Current
- Frequently Asked Questions
- GCSA is GIAC Cloud Security Automation: one proctored exam, 75 questions, 2 hours, 66% minimum passing score.
- GIAC publishes 18 exam objectives with no official percentage weights, so study breadth matters more than guessing emphasis.
- The exam fee is USD 999, a retake is USD 899, and renewal is USD 499 every four years.
- No prerequisites are required, and SANS SEC540 training is recommended but optional.
What the GCSA Credential Certifies
GCSA stands for GIAC Cloud Security Automation. It is issued by GIAC Certifications, administered by GIAC, LLC, and it targets a specific kind of practitioner: someone who builds security into cloud-native delivery pipelines rather than bolting it on afterward. The 18 published objectives span container orchestration, infrastructure as code, secrets handling, policy enforcement, software supply chain security, observability, and automated remediation.
If you are new to the acronym or want the basics framed from different angles, the site covers them in What Is GCSA Certification? and What Does GCSA Stand For?. This article focuses on what the credential actually tests and how to prepare for it.
Exam Mechanics: Format, Fees, and Access
Format and scoring
The GCSA exam is a single web-based, proctored exam with 75 questions and a 2-hour time limit. The minimum passing score is 66%, applicable to exam versions released on or after 2024-06-29. That date tells you which score standard applies; it is not an outline edition, and no separately versioned public exam outline is identified on GIAC's certification page. For a deeper look at scoring, see GCSA Passing Score 2026.
Two minutes per question is a workable pace, but it leaves little room to browse a paper index for every item. Questions you can answer from memory buy time for the ones that need a lookup.
Fees
| Item | Cost (USD, excluding tax) |
|---|---|
| Certification exam attempt | 999 |
| Retake | 899 |
| Optional practice exam | 399 |
| Renewal (every 4 years) | 499 |
Training costs are separate and not included in these figures. The full breakdown, including how the pieces add up, is in GCSA Certification Cost 2026.
Testing providers and access window
Exams are delivered through Pearson VUE (onsite) or ProctorU (remote), depending on the modality GIAC assigns to your attempt. For a standalone attempt, initial access runs 120 days from activation, and extensions are available under GIAC's certification attempt delivery policy. Because the window starts at activation, activate when your preparation is close to ready rather than months ahead. Scheduling details live in GCSA Exam Dates 2026.
The 18 Exam Objectives, Grouped by Theme
GIAC publishes 18 objective headings and assigns no official percentage weights. Anyone quoting "Domain X is 20% of the exam" is inventing it. The practical consequence: treat every objective as fair game and avoid skipping the ones that feel unglamorous. The grouping below is an organizing aid for study, not an official structure. For a full walkthrough, see GCSA Exam Domains 2026: Complete Guide to All 18 Content Areas.
Container orchestration cluster
Domains 1, 12, 13, and 18
Four objectives center on orchestration platforms: Architecture and Fundamentals of Container Orchestration; Risks, Authentication, and Access-Control of Container Orchestration; Runtime Security in Container Orchestration; and Workload Security in Container Orchestration.
- Know how the orchestrator's components fit together before studying how to defend them.
- Expect scenario questions that pair an architectural fact with a security consequence.
- Separate access-control concerns (who can do what to the cluster) from workload concerns (what a running container is allowed to do).
- Runtime security asks what you detect and enforce after deployment, which differs from build-time controls.
Pipeline and workflow cluster
Domains 14, 15, 16, and 17
These cover Securing the DevOps Workflow, Software Supply Chain Security, Understanding the DevOps Workflow, and Utilizing Configuration Management.
- Understanding the workflow comes first; the security domains assume you can reason about where controls fit in a pipeline.
- Supply chain questions tend to ask where trust is established and where it can be broken between source and deployed artifact.
- Configuration management objectives reward knowing how desired state is declared and enforced consistently.
Infrastructure, compliance, and policy cluster
Domains 3, 6, 11, and 2
Cloud Compliance as Code, Deploying Cloud Infrastructure as Code, Policy Enforcement, and Automated Cloud Remediation form a natural chain: define infrastructure in code, express compliance requirements as code, enforce policy automatically, and fix drift or violations without manual toil.
- Study these together; each makes more sense in light of the others.
- Be ready to distinguish detecting a violation from preventing one from deploying and from remediating one afterward.
Application and identity cluster
Domains 7, 8, 9, 10, 5, and 4
Edge Identity and Authentication, Managing Secrets, Microservice API Gateways, Microservices Architecture and Deployment, Container Lifecycle Security, and Cloud Native Observability.
- Gateway and edge identity topics connect: the gateway is often where authentication is enforced for service traffic.
- Secrets management is a recurring concern across pipelines, clusters, and applications, so expect it to surface in multiple question contexts.
- Observability supports detection and response; know what signals are worth collecting in a cloud-native environment.
- Container lifecycle security spans build, ship, and run, tying back to the supply chain and runtime objectives.
How SEC540 Relates to the Exam
The recommended preparation is the SANS course SEC540: Cloud Native Security and DevSecOps Automation. Training is optional, and no prerequisites are required to begin the certification process (see GCSA Requirements 2026). The relationship between course and exam deserves precision:
- The 18 domains are GIAC's exam objectives. SEC540's five teaching sections are supplemental preparation groupings, not the exam structure.
- SANS course sections are unweighted curriculum. They help inform what to study but do not establish exhaustive exam coverage.
- Course hours, labs, and capstones are separate from the proctored exam time.
- The public SEC540 webpage and the linked brochure use slightly different section labels in places, and the webpage's final observability bullet is truncated. None of that changes the 18 GIAC objectives, so build your checklist from the objectives, not from a course label.
Key Takeaway
Use the 18 objective headings as your master checklist and SEC540 materials as the teaching resource that fills in each one. If a topic appears in your course notes but maps to no objective, deprioritize it; if an objective has thin course coverage, find supplemental material for it.
More on training paths is in GCSA Training.
Working With an Open-Book Exam
GCSA is open book, but only for paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A content. Those restrictions are laid out in GIAC's Proctored Exam Reference Guide, and violating them is far costlier than any study shortcut.
Building a reference you can actually use
- Index by objective. Since the 18 objective names are fixed, organize your index around them and add subtopic entries beneath each.
- Write in your own words. Annotated notes you generated yourself are faster to search and remember than raw course text.
- Index terms, not pages. A term-to-page lookup beats rereading, especially across tool-heavy topics.
- Memorize the fast-lookup items. Anything you will need on many questions should live in your head, not your binder.
Sequencing Your Preparation by Domain
This is the one section on general planning, tied to GCSA's dependency structure. The logic: learn the platform and workflow foundations first, then the controls that sit on top of them, then the automation that ties everything together. Adjust the pacing to your own schedule; the order matters more than the week count.
Foundations
- Domain 16 (Understanding the DevOps Workflow) and Domain 1 (Architecture and Fundamentals of Container Orchestration).
- Domain 10 (Microservices Architecture and Deployment) to understand what is being secured.
Infrastructure and configuration
- Domain 6 (Deploying Cloud Infrastructure as Code) and Domain 17 (Utilizing Configuration Management).
- Domain 14 (Securing the DevOps Workflow) while the pipeline picture is fresh.
Supply chain, containers, and secrets
- Domain 15 (Software Supply Chain Security), Domain 5 (Container Lifecycle Security), Domain 8 (Managing Secrets).
Cluster and edge security
- Domains 12, 13, and 18 (orchestration risk, runtime, and workload security).
- Domains 7 and 9 (edge identity and API gateways).
Automation and assurance
- Domains 3, 11, and 2 (compliance as code, policy enforcement, automated remediation), then Domain 4 (observability).
- Finish with a full review against all 18 headings and a practice pass.
For a fuller plan, see the GCSA Study Guide 2026, and keep the GCSA Cheat Sheet handy for last-stage review. You can also test your recall with the practice questions on the main GCSA practice test site. GIAC sells an optional practice exam for USD 399, which some candidates use as a final calibration step.
Who Benefits From This Certification
The objectives map to roles where security and delivery automation overlap: DevSecOps engineers, cloud security engineers, platform and infrastructure engineers responsible for clusters and pipelines, and application security staff moving toward cloud-native systems. Security architects who need to review infrastructure-as-code and policy-as-code designs also fit the profile.
Be careful with hard numbers about compensation or job demand: none are published in the exam source, so any figure should be treated as unverified unless it cites a reputable survey. The site discusses market considerations qualitatively in GCSA Jobs and GCSA Salary Guide 2026, and weighs the investment in Is the GCSA Certification Worth It?. A reasonable rule: the credential carries the most weight when it corroborates hands-on pipeline, cluster, and policy work you can already describe in an interview.
Keeping the Credential Current
GCSA is valid for four years. To renew, you need either 36 approved CPE credits earned during the active four-year cycle or a passing renewal exam, plus the USD 499 renewal fee. Cloud-native tooling changes quickly, so CPE-eligible activity such as conference sessions, courses, and your own security automation work can keep your skills current while satisfying the requirement. GIAC's renewal how-to guide covers what qualifies and how to submit.
Frequently Asked Questions
GIAC Cloud Security Automation, a certification issued by GIAC Certifications and administered by GIAC, LLC. The same acronym is used by unrelated credentials, so confirm the issuer before relying on any fee or date. See What Is GCSA? for background.
The exam has 75 questions in a 2-hour window, with a minimum passing score of 66% for exam versions released on or after 2024-06-29. Your GIAC account's Certification Information governs the details of your specific attempt.
No. No prerequisites are required to begin the certification process, and training is optional. SEC540 is the recommended preparation, but the exam itself is based on the 18 published GIAC objectives.
Yes, paper references only. Electronic references, internet access, and materials containing exam or practice Q&A content are prohibited. Review GIAC's proctoring guidance before exam day, since your testing provider enforces these rules.
It is valid for four years. Renewal requires 36 approved CPE credits earned in that cycle or a passing renewal exam, plus the USD 499 renewal fee.