Employers keep raising the bar, and the GIAC Certified Enterprise Defender keeps rising with it. DumpStillValid matches that pace: the GCED question set — 90 strong — is refreshed throughout 2026.
GIAC GCED Exam Overview:
| Certification Vendor: | GIAC |
|---|---|
| Exam Name: | GIAC Certified Enterprise Defender |
| Exam Number: | GCED |
| Exam Format: | Proctored Exam, Multiple Choice |
| Related Certifications: | GIAC Certified Incident Handler (GCIH) GIAC Certified Intrusion Analyst (GCIA) GIAC Security Essentials (GSEC) |
| Exam Duration: | 180 minutes |
| Real Exam Qty: | 115 |
| Exam Price: | USD $999 |
| Available Languages: | English |
| Certificate Validity Period: | 4 years |
| Passing Score: | 69% |
| Sample Questions: |  |
| Exam Way: | Online remote proctoring (ProctorU) or onsite testing at Pearson VUE testing centers. |
| Pre Condition: | No formal prerequisite. Intermediate to advanced cybersecurity knowledge and hands-on security operations experience are recommended. |
| Official Syllabus URL: | https://www.giac.org/certifications/certified-enterprise-defender-gced |
GIAC GCED Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: Network and Cloud-Based Defensive Infrastructure | - Defensive Infrastructure and Tactics
|
| Topic 2: Network Monitoring, Forensics, and Logging | - Network Forensics
|
| Topic 3: Vulnerability Assessment and Penetration Testing | - Assessment Applications
|
| Topic 4: Packet Analysis, Intrusion Analysis, and Malware Analysis | - Intrusion Detection and Packet Analysis
|
The GIAC GCED Exam, Explained
The GIAC Certified Enterprise Defender syllabus is organized into 4 domains — including Network Monitoring, Forensics, and Logging, Network and Cloud-Based Defensive Infrastructure, Packet Analysis, Intrusion Analysis, and Malware Analysis. The percentages show where the exam concentrates its points; weight your revision the same way. The complete outline is listed above.
180 minutes for 115 questions — that's the official shape of the GCED exam. Divide your minutes per question before test day, flag and skip anything that stalls you, and rehearse full timed runs in the DumpStillValid engine until pacing is automatic.
Yes. The free GIAC Certified Enterprise Defender demo at DumpStillValid lets you judge the question quality before paying. Purchases include 365 days of free updates; after that, renew at half price.
The GIAC Certified Enterprise Defender is GIAC's certification exam for GIAC Information Security, a Professional-level credential. Employers value it because it verifies real skills, not attendance. Related credentials include GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Essentials (GSEC).
Delivery is instant: the moment payment succeeds, our system emails the product to your mailbox — typically within a minute — and you can install it on unlimited devices. Still nothing after 2 hours? Check spam, then reach our 24-hour online staff. If you take the corresponding GCED exam within 60 days of purchase and don't pass, we refund in full: send a scanned enrollment slip and the official Score Report PDF within 2 days of your exam, and processing completes within 7 days. Not covered: exams within 3 days of purchase, payer-name mismatches, and free or expired products. Or swap for two equal-value products free instead.
No formal prerequisite. Intermediate to advanced cybersecurity knowledge and hands-on security operations experience are recommended. Because vendors adjust eligibility rules from time to time, verify the current requirements on the official page (official GCED exam page) before you register.
USD $999 per attempt, 69% to pass. Retakes cost the full fee again, so treat the 90 practice questions from DumpStillValid as your dress rehearsal — and go in prepared the first time.
GIAC Certified Enterprise Defender Sample Questions:
What does the following WMIC command accomplish?
process where name='malicious.exe' delete
- A. Removes the executable 'malicious.exe' from the file system
- B. Stops the 'malicious.exe' process from running and being restarted at the next reboot
- C. Removes the 'malicious.exe' process form the Start menu and Run registry key
- D. Stops current process handles associated with the process named 'malicious.exe'
Correct Answer: D 🗳️
Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
- A. Bit-for-bit image from the infected host
- B. Media from the infected host, copied to the dedicated IR host
- C. Original media from the infected host
- D. Restored media from full backup of the infected host
Correct Answer: D 🗳️
Explanation: Only visible for DumpStillValid members. You can sign-up / login (it's free).
What would be the output of the following Google search?
filetype:doc inurl:ws_ftp
- A. Documents found on sites with ws_ftp in the web address
- B. Documents available on the ws_ftp.com domain
- C. Websites running ws_ftp that allow anonymous logins
- D. Websites hosting the ws_ftp installation program
Correct Answer: A 🗳️
Network administrators are often hesitant to patch the operating systems on CISCO router and switch operating systems, due to the possibility of causing network instability, mainly because of which of the following?
- A. Having to rebuild ARP tables
- B. Having to replace the kernel
- C. Having to rebuild all ACLs
- D. Having to rebuild the routing tables
- E. Having to re-IP the device
Correct Answer: B 🗳️
Explanation: Only visible for DumpStillValid members. You can sign-up / login (it's free).
You are responding to an incident involving a Windows server on your company's network. During the investigation you notice that the system downloaded and installed two files, iexplorer.exe and iexplorer.sys. Based on the behavior of the system you suspect that these files are part of a rootkit. If this is the case what is the likely purpose of the .sys file?
- A. It is a device driver used to load the rootkit
- B. It is a logfile used to collect usernames and passwords
- C. It is an executable used to configure a keylogger
- D. It is a configuration file used to open a backdoor
Correct Answer: A 🗳️
Viewing page 1 out of 18 pages.
Viewing questions 1-5 out of 90 questions.
Daisy 
Selena 
Gwendolyn 
Bella 
Chad 
Larry 
Hannah 
August 
Dale 
Boyd 
Ford 
Nigel 
Spencer 
