GIAC GSOC Certification: Ten Objectives, No Weightings

What does GSOC examine, and how is it different from GSOM?

GSOC examines running the console. Triage, log interpretation, traffic and protocol analysis, endpoint attacks, and the systems a SOC runs on. GSOM, the GIAC Security Operations Manager credential, examines running the team. They are separate exams for separate jobs, and they are routinely confused with one another.

The confusion is not the reader’s fault. Search data shows people looking for a SOC manager course under the GSOC name, and GIAC’s own GSOC page currently carries an instructor testimonial that talks about GSOM rather than GSOC. If you want leadership, process frameworks and team structure, GSOM is the credential. If you want the analytical work, this is the one.

Within that scope GSOC is broad rather than deep. Ten objectives cover analytic design and tuning, blue team defence concepts, endpoint defence, HTTPS analysis, interpreting events, intrusion triage, network traffic analysis, operational improvement, protocol attacks, and SOC management systems. GIAC frames the outcome as being able to defend an enterprise using blue-team incident response tools and techniques, and to help run a security operations centre.

What are the GSOC exam facts?

GSOC is one proctored exam of 75 questions in 120 minutes, with a minimum passing score of 67 percent. It costs 999 USD and is associated with the SEC450 SOC analyst course. Ten objectives are published, and GIAC attaches no weighting to any of them.

Two of those rows are easy to skim past and expensive to miss. Proctoring is mandatory and comes in two forms, remote or onsite, which is a scheduling decision rather than a formality. And the attempt expires: you have 120 days from the moment GIAC activates it in your account, so buying early and preparing slowly has a deadline attached. Both are stated on the official GSOC page.

The pass mark deserves a note as well. GIAC set 67 percent through a psychometric standard-setting study, applying to exam versions released on or after 28 August 2021, and it says it reviews specifications periodically. The practical advice GIAC itself gives is to confirm the format and pass mark for your own attempt in your account rather than trusting any third-party figure, including this one.

Every figure above was checked against GIAC directly and matches the exam catalogue exactly, which is not always the case. The one field GIAC does not publish on that page is the price, so confirm 999 USD at the point of purchase.

What does 999 USD actually buy?

One proctored attempt, and nothing else. No course, no lab, no practice material beyond what you buy separately. At roughly three times the price of a mainstream vendor-neutral security exam, the cost is the single most common reason people stop and reconsider, and search data shows them asking about it directly.

The number makes more sense once you see how GIAC certifications are normally bought. The exam is tied to the SEC450 course, and most candidates take the two together as a package funded by an employer, where the attempt is a component of a much larger training spend rather than a standalone purchase. Bought on its own, 999 USD is the price of the assessment alone.

That leads to the honest framing. If your employer is funding SEC450, the certification attempt is the natural end of it and the price is not really your decision. If you are paying yourself, compare it against what you are actually buying: a recognised blue-team credential assessed at analyst depth, versus cheaper credentials that cover similar ground with less specificity. Neither answer is wrong, but they are different purchases.

One practical consequence of the price: there is little room for a casual first attempt. The 120-day window and the cost together argue for preparing before activation rather than activating and then starting to study.

How do the ten objectives map to a shift?

Almost exactly. Rather than a pyramid with one dominant domain, the objectives are ten roughly parallel competencies that together describe analytical SOC work. With 75 questions across ten areas, that is about seven or eight questions each, and no area is small enough to write off.

Read top to bottom that is a shift: understand the mission, build and tune the detections, read what they produce, work out what the endpoint did, decide how urgent it is, and then widen out to the network and the protocols carrying the activity. The last two rows are the infrastructure and the improvement loop around all of it.

Because nothing is weighted, the only sensible planning method is coverage. Work through a set of GSOC sample questions early and treat the result as a map of which objectives you have never really touched, rather than as a score.

Detection, endpoints and interpreting events

Four objectives sit at the centre of the exam and of the job: analytic design and tuning, interpreting events, endpoint defence, and intrusion triage. They are the ones where experience shows most clearly, and where a candidate who has only read about SOC work will come unstuck.

Analytics are designed, not just consumed

The wording matters here. The objective expects you to design, enrich, test, share and improve analytics, not merely to respond to alerts somebody else wrote. Enrichment and testing are the parts most often skipped in practice: an analytic that has never been tested against a known-bad sample is a hypothesis, and one without enrichment produces alerts nobody can action.

Events, logs and files

Interpreting events covers common Windows and Linux events, how they are represented, where they live in logs, and how to extract information from potentially malicious files. Know which Windows event identifiers matter and what their Linux equivalents look like, because questions will describe a log line rather than name the event for you.

Endpoints and triage

Endpoint defence pairs attack knowledge with logging knowledge, which is the combination that lets you tell what actually happened after the fact. Intrusion triage then adds the part most technical material leaves out: prioritising by organisational factors. The same technical indicator on a test box and on a payment system are not the same incident, and the exam expects you to say so. The CIS Controls are a useful reference for the baseline a SOC is usually monitoring against.

What do the traffic and protocol objectives expect?

A working understanding of how enterprise traffic is monitored and how common protocols are abused, rather than packet-level mastery. GIAC frames network traffic analysis as high-level architecture and monitoring, reviewing traffic, and identifying and protecting against DNS attacks specifically.

DNS is singled out for good reason. It is the protocol most reliably present, least reliably inspected, and most often used for command and control or exfiltration. Expect to recognise the shapes that matter: queries to domains nobody has resolved before, request volumes that do not match a human, and responses carrying more data than a name lookup should.

The protocol objective names six by title: SMTP, SMB, DHCP, ICMP, FTP and SSH. For each, know what it is for, how an attacker uses it, and what a defence looks like. SMB and SSH tend to appear as lateral movement, SMTP as delivery, ICMP and DNS as covert channels, DHCP as a foothold for interception, and FTP as plaintext credential exposure.

HTTPS analysis completes the set, covering attacks carried over web traffic and the defences against them. The practical difficulty is that the traffic is encrypted, so much of the skill is reasoning from what remains visible: destinations, timing, volumes and certificate details rather than payloads.

Operational improvement, the newest objective

This is the objective that dates the exam to the current era of SOC work, and the one most likely to be under-prepared. It asks how blue team efficiency is improved through automation of tasks, orchestration of response, and training, which is a management-adjacent competency assessed at analyst level.

Automation and orchestration are not the same thing, and the distinction is examinable. Automating a task removes manual effort from one step, such as enriching an alert with reputation data. Orchestrating a response coordinates several systems and decisions into a defined workflow. The first saves minutes; the second changes how the team handles a class of incident.

Training as an examinable outcome surprises people, but it follows from the rest: a SOC improves when its analysts improve, and deciding what the team needs to learn is part of operating one. This is also where GSOC comes closest to GSOM without crossing into it, since the analyst is asked to improve the work rather than to lead the people. Frameworks such as the FIRST CSIRT services framework set out the wider service model this improvement loop sits inside.

SOC management systems sit alongside it, covering the role and function of incident management systems, threat intelligence platforms and SIEMs. The examinable knowledge is what each type of system is for and how it fits with the others, not how to operate any particular product.

Who should take GSOC?

Working blue-team practitioners, and GIAC is unusually specific about it. Its own list covers security analysts, incident investigators, security engineers and architects, technical security managers, SOC managers wanting a technical perspective on improving analysis quality and reducing turnover, and people starting a career on the blue team.

That last group needs a caveat the list does not carry. Starting on the blue team is a reasonable time to aim at GSOC, but ten objectives at analyst depth and a 999 USD attempt make it an expensive first credential. The people who get most from it are those already sitting shifts who want the breadth formalised, and engineers or architects who build for a SOC without having worked in one.

It fits poorly in two cases. If you want to lead a security operations team, GSOM is the credential and this one will answer a different question. And if your interest is offensive work, almost nothing here transfers: the entire paper is written from the defender’s side of the console. Analysts wanting to go deeper on intrusion detection specifically may find the GCIA intrusion analyst route a closer match to that narrower interest.

How should you prepare?

Cover all ten objectives before deepening any of them, and build the index you will actually use. With no weightings published and roughly seven or eight questions per objective, a gap in one area costs more than extra depth in another can recover.

1. List the ten objectives and rate yourself honestly against each, because the list is the only study plan GIAC provides.
2. Work a set of sample questions early and treat the output as a coverage map rather than a score.
3. Spend your first sessions on the objectives you rated lowest, not on the ones you enjoy.
4. Practise reading raw log lines from Windows and Linux until you can name the event without being told what it is.
5. Learn the six named protocols as attack surfaces, one at a time, with a defence for each.
6. Separate automation from orchestration in your own words, since the distinction is examinable and easy to blur.
7. Decide your proctoring route and book it before activating the attempt, because the 120-day window starts on activation.

If you are coming from threat intelligence rather than operations, invert the emphasis. The analytic design, triage and management-systems objectives will feel familiar, while endpoint logging and protocol-level analysis will not, and those are where the questions will find you. A view of the adjacent intelligence discipline appears in the GCTI objectives breakdown.

Frequently Asked Questions

How many questions are on the GSOC exam?

Seventy five questions in 120 minutes, which is about 96 seconds each.

What is the passing score for GSOC?

Sixty seven percent minimum. GIAC set that figure through a psychometric standard-setting study for exam versions released on or after 28 August 2021.

How much does GSOC cost?

Nine hundred and ninety nine US dollars for the certification attempt. GIAC does not publish a price on its own certification page, so confirm the figure at the point of purchase.

Are the ten objectives weighted?

No. GIAC publishes no weightings for GSOC, so plan by objective rather than by percentage. Seventy five questions across ten objectives averages seven or eight each.

What is the difference between GSOC and GSOM?

GSOC is the analyst credential covering triage, log interpretation and traffic analysis. GSOM is the SOC manager credential covering leadership, process and team structure. They are separate exams for separate roles.

Does GSOC mean Google Summer of Code?

That acronym is used for Google Summer of Code and for a Global Security Operations Centre as well, but in the certification context GSOC is GIAC Security Operations Certified.

How is the exam delivered?

As one web-based proctored exam. Proctoring is mandatory and available either remotely through ProctorU or onsite through Pearson VUE.

How long do I have to sit it after buying?

One hundred and twenty days from the date GIAC activates the attempt in your account.

Do I need the SEC450 course to pass?

The course is the associated training and most candidates take the two together, usually employer funded, but the certification attempt is sold as its own product.

How long is the certification valid?

GIAC does not publish a renewal period on the GSOC certification page, so this guide states none. Check the renewal requirements in your GIAC account.

Conclusion

GSOC is the analyst’s blue-team exam, not the manager’s. Seventy five questions, 120 minutes, 67 percent to pass, 999 USD, and ten objectives that GIAC declines to weight because they are roughly parallel parts of the same job.

Plan for coverage rather than depth. Seven or eight questions per objective means a skipped area costs more than extra study in a strong one can win back, and the objectives most often neglected are operational improvement and protocol-level analysis rather than the triage work people practise naturally.

Settle the practical questions before you activate anything: which proctoring route you want, and whether the attempt is being funded alongside the course or bought on its own. The 120-day window starts when GIAC activates it, not when you feel ready, and at this price that is the detail worth getting right first.