- How the GCSA Outline Is Organized
- Exam Format and Registration Mechanics
- Container Orchestration Domains (1, 12, 13, 18)
- DevOps Workflow and Pipeline Domains (14, 16, 17, 6)
- Supply Chain and Container Lifecycle (5, 15)
- Identity, Secrets, and API Gateways (7, 8, 9)
- Microservices and Observability (4, 10)
- Policy, Compliance, and Remediation (2, 3, 11)
- Sequencing Your Preparation Around the Domains
- Where These Skills Show Up in Hiring
- Frequently Asked Questions
- GIAC Cloud Security Automation publishes 18 exam objectives, and GIAC assigns no official percentage weights to any of them.
- The exam is one proctored, web-based sitting: 75 questions, 2 hours, minimum passing score of 66%.
- The exam is open book with paper references only; electronic materials and practice-question content are prohibited.
- SANS SEC540 is the recommended preparation, but its five teaching sections are not the same as the 18 exam objectives.
How the GCSA Outline Is Organized
The GIAC Cloud Security Automation (GCSA) certification, administered by GIAC Certifications, publishes its scope as a list of 18 exam objectives with outcome statements. Unlike some vendor exams, GIAC does not attach percentage weights to these headings on its public page. That matters for how you study: you cannot rank domains by exam share, so breadth beats betting on a few favorites.
The 18 headings fall naturally into a handful of themes: container orchestration, DevOps workflow, supply chain, identity and secrets, microservices and observability, and policy and compliance automation. This article groups them that way so related ideas reinforce each other. If you are new to the credential itself, start with What Is GCSA Certification? or the overview at GCSA Certification, then return here.
Exam Format and Registration Mechanics
Before diving into domains, know the container they are tested in. The GCSA exam is a single web-based proctored exam of 75 questions in 2 hours, with a minimum passing score of 66% for exam versions released on or after 2024-06-29. That works out to roughly 96 seconds per question, which is tight if you lean on reference books for every item. Your account's Certification Information page on GIAC's portal governs the exact objectives, question types, and format of your purchased attempt, so check it once you activate.
| Item | GCSA Detail |
|---|---|
| Governing body | GIAC Certifications (GIAC, LLC administers) |
| Questions / time | 75 questions, 2 hours |
| Minimum passing score | 66% (versions released on or after 2024-06-29) |
| Exam fee | USD 999 (retake USD 899; optional practice exam USD 399; excludes tax) |
| Renewal | USD 499 plus 36 CPE credits, or pass a renewal exam |
| Validity | 4 years |
| Proctoring | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality |
| Standalone attempt access | 120 days from activation; extensions available |
| Prerequisites | None required; training is optional |
The exam is open book with paper references. Electronic references and internet access are prohibited, as are materials containing exam or practice Q&A. Because you can bring printed notes, your preparation should include building an index keyed to the 18 domains, a topic that pairs well with the GCSA cheat sheet. For fee details, see the GCSA certification cost breakdown, and for eligibility questions, GCSA requirements. Score details live in the GCSA passing score guide, and the cited source publishes a passing score rather than a candidate pass rate (see what the data shows on GCSA pass rate).
Container Orchestration Domains (1, 12, 13, 18)
Four of the 18 objectives center on securing orchestrated containers. Read together, they trace a lifecycle: understand the architecture, secure access to it, secure the workloads on it, and watch them at runtime.
Domain 1: Architecture and Fundamentals of Container Orchestration
The foundation. You need a working mental model of how an orchestrator schedules, networks, and manages containers before any security control makes sense.
- Control plane versus worker node responsibilities
- How workloads, services, and configuration objects relate
- Where the attack surface sits in a cluster
Domain 12: Risks, Authentication, and Access-Control of Container Orchestration
Focuses on who and what can talk to the orchestrator, and what they can do once they can.
- Authentication paths into the cluster API
- Role-based access control and least-privilege design
- Common misconfiguration risks that expose a cluster
Domain 18: Workload Security in Container Orchestration
Hardening what runs inside the cluster rather than the cluster itself.
- Pod and container security settings
- Limiting privileges and capabilities of running workloads
- Isolation between workloads
Domain 13: Runtime Security in Container Orchestration
Detecting and responding to behavior that deviates from what a workload should do.
- Monitoring running containers for anomalous activity
- Responding to compromised workloads
- Connecting runtime signals to automated response
Domains 12, 18, and 13 overlap on purpose: access control limits who can deploy, workload security limits what a deployed container can do, and runtime security catches what slips past both. Expect scenario-style questions that make you pick the right layer for a given problem.
DevOps Workflow and Pipeline Domains (14, 16, 17, 6)
The "automation" in the certification name lives here. GIAC separates understanding the DevOps workflow (Domain 16) from securing it (Domain 14), a split worth respecting in your studying.
Understanding versus securing the workflow
Domain 16, Understanding the DevOps Workflow, is about the mechanics: how code moves from commit to deployment, and what each stage produces. Domain 14, Securing the DevOps Workflow, asks where to insert security checks and how to protect the pipeline itself, since the pipeline holds credentials and deploy rights that attackers value.
Infrastructure and configuration as code
Domain 6, Deploying Cloud Infrastructure as Code, and Domain 17, Utilizing Configuration Management, cover the declarative side. The security angle is repeatability: if infrastructure and configuration are defined in version-controlled code, you can review, test, and scan them before they reach production.
Supply Chain and Container Lifecycle (5, 15)
Domain 15: Software Supply Chain Security
Covers trust in the components and build process that produce your software.
- Dependency and third-party component risk
- Integrity and provenance of build artifacts
- Protecting the build and delivery path from tampering
Domain 5: Container Lifecycle Security
Follows a container from image creation to retirement.
- Building minimal, hardened images
- Scanning and storing images in registries
- Controlling what is allowed to deploy
These two domains share an artifact: the container image. Supply chain security asks whether you can trust what went into the image; lifecycle security asks whether you can trust the image as it is stored, promoted, and run. Studying them together prevents you from treating image scanning as a one-time gate.
Identity, Secrets, and API Gateways (7, 8, 9)
Domain 7: Edge Identity and Authentication
Establishing who is calling your services at the boundary of your environment.
- Authenticating users and clients at the edge
- Token-based approaches to conveying identity
- How edge identity feeds downstream authorization
Domain 9: Microservice API Gateways
The gateway as a control point for traffic into a microservice system.
- Centralizing authentication, routing, and rate controls
- Gateway placement within the architecture
- Limits of the gateway as a security boundary
Domain 8: Managing Secrets
Keeping credentials, keys, and tokens out of code and out of reach.
- Why secrets in repositories and images are a recurring failure
- Delivering secrets to workloads at runtime
- Rotation and lifecycle of sensitive values
Domains 7 and 9 are closely linked: the gateway is frequently where edge identity is enforced. Domain 8 touches nearly everything else, because pipelines, workloads, and infrastructure code all consume secrets.
Microservices and Observability (4, 10)
Domain 10, Microservices Architecture and Deployment, covers how distributed services are structured and shipped, and the security consequences of that design: more network paths, more service-to-service trust decisions, and more deployments to control. Domain 4, Cloud Native Observability, covers the logs, metrics, and traces that let you see what those services are doing.
Observability is the bridge to Domain 13: runtime security needs telemetry, and telemetry needs deliberate design. One caveat from the preparation material: the public SEC540 webpage has a truncated final observability bullet, and no missing wording should be assumed. Rely on GIAC's published objective heading, not on inferred course content.
Policy, Compliance, and Remediation (2, 3, 11)
Domain 11: Policy Enforcement
Turning security rules into automated gates that block noncompliant changes.
- Admission-time and pipeline-time enforcement points
- Expressing policy in machine-readable form
- Balancing strict enforcement with developer workflow
Domain 3: Cloud Compliance as Code
Encoding compliance requirements so they can be checked continuously rather than audited occasionally.
- Translating requirements into automated checks
- Continuous evaluation of cloud resources against rules
- Producing evidence from automated results
Domain 2: Automated Cloud Remediation
Closing the loop: when a check fails or a finding appears, fix it automatically where it is safe to do so.
- Event-driven responses to misconfiguration
- Deciding what to automate versus escalate
- Avoiding remediation that breaks production
These three form a chain: policy defines the rule (11), compliance as code measures adherence (3), and remediation corrects drift (2). Candidates who see them as one feedback loop answer scenario questions faster than those who memorize them in isolation.
Key Takeaway
Because GIAC publishes no domain weights, build a one-page open-book index with all 18 domain names as headings. Under each, list the tools, concepts, and page references from your course materials so you can find answers within the 2-hour limit.
Sequencing Your Preparation Around the Domains
You do not need a generic schedule, only an order that respects dependencies between domains. The sequence below assumes you are using SEC540 or equivalent material and adjusts to your own timeline. For a fuller plan, see the GCSA study guide.
Orchestration foundations
- Domain 1 first, since Domains 12, 13, and 18 depend on it
- Domain 16 to learn the pipeline vocabulary
Pipeline and code
- Domains 14, 6, and 17
- Start the open-book index
Artifacts and trust
- Domains 15 and 5 together
- Domain 8 on secrets
Cluster security and identity
- Domains 12, 18, and 13
- Domains 7 and 9
Services, visibility, and automation
- Domains 10 and 4
- Domains 11, 3, and 2 as one loop
- Timed practice using our practice tests
Your attempt window matters too: standalone access begins at activation and lasts 120 days, with extensions available, so schedule against that clock. See GCSA exam dates and scheduling for planning details. If you are still gauging effort, how hard the GCSA exam is explains what makes it demanding, and drilling with practice questions against your index is the best way to test whether it actually works under time pressure.
Where These Skills Show Up in Hiring
The 18 domains map onto roles that sit between development, operations, and security: cloud security engineers, DevSecOps engineers, platform and Kubernetes security specialists, and security automation engineers. Job descriptions for these roles tend to name the same themes as the objectives: pipeline security, infrastructure as code, secrets handling, policy enforcement, and runtime detection. For role patterns, see GCSA jobs. For compensation context, the GCSA salary guide and the ROI analysis take a closer look; no salary figures are asserted here.
Since there are no prerequisites and training is optional, the credential suits practitioners who already work in DevOps or cloud security and want to validate automation skills, as well as people crossing over from adjacent roles. If you want training specifics, see GCSA training.
Frequently Asked Questions
GIAC publishes 18 exam objectives for the GIAC Cloud Security Automation certification. They span container orchestration, DevOps workflow, supply chain, identity, secrets, policy, compliance, and remediation. GIAC does not publish percentage weights for them.
No. SEC540's five sections are a supplemental teaching structure. The 18 exam objectives are separate, and the course does not establish exhaustive exam coverage or the official domain count. Public course pages also use slightly varying section labels.
Yes, paper references are allowed because the exam is open book. Electronic references, internet access, and any materials containing exam or practice questions and answers are prohibited, per GIAC's proctoring rules.
The minimum passing score is 66% for exam versions released on or after 2024-06-29, across 75 questions in 2 hours. Your GIAC account's Certification Information governs the details of your specific attempt.
It is valid for 4 years. Renewal requires 36 approved CPE credits earned during the cycle, or passing a renewal exam, plus the USD 499 renewal fee. See What Is GCSA? for background on the credential.