GIAC Security Essentials (GSEC)
Demonstrate broad active defense, cryptographic implementation, network architecture security, Linux server hardening, Windows Active Directory defense, incident handling, and web application security.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
GSEC is an internationally recognized cybersecurity certification offered by GIAC (SANS Institute) validating practical, hands-on understanding of information security beyond basic terminology.
The exam consists of 106 to 180 questions (including CyberLive hands-on lab simulation questions) to be completed within 4 to 5 hours, administered open-book at Pearson VUE centers.
The passing scaled score is 73%. Scoring results are provided immediately upon exam completion.
Domains include: (1) Active Defense, (2) Cryptography & PKI, (3) Incident Handling & Computer Crime, (4) Linux Security Hardening, (5) Network Architecture & Protocols, (6) Web Communication Security, and (7) Windows Security & Active Directory.
CyberLive questions test real-world practical skills on actual virtual machines in the exam environment (e.g. configuring Linux firewalls, querying Windows logs, inspecting packet captures via command line).
Active defense employs security mechanisms (honeytokens, canary files, deception technology, sinkholing) that actively detect, divert, and analyze adversary actions inside the network.
Linux permissions (SUID/SGID, sticky bit, umask), file integrity monitoring (Tripwire, AIDE), PAM authentication modules, auditd daemon, and kernel parameter tuning via sysctl.
Active Directory architecture, Group Policy Objects (GPOs), Kerberos authentication, User Account Control (UAC), BitLocker, PowerShell execution policies, and Windows Defender Application Control (WDAC).
Deep inspection of IP packet headers, TCP flag states, routing protocols, modern firewall architectures, proxy servers, TLS termination, and 802.1X network access control.
Security+ is a foundational, entry-level certification. GSEC is an in-depth, hands-on technical practitioner certification accompanied by SANS SEC401 training with rigorous command-line testing.
Practical implementation of symmetric ciphers (AES), asymmetric algorithms (RSA, ECC), cryptographic hashing (SHA-256), digital certificates, certificate lifecycles, and TLS configuration.
Security practitioners, systems administrators, network engineers, forensic analysts, security managers, and military/government personnel requiring advanced technical baseline validation.