GIAC Certified Enterprise Defender (GCED) Exam Guide

1. Attack surface management: identify, assess, and prioritize attack surface exposures and vulnerabilities
2. Configuration management and automation workflows: maintain secure configurations and automate continuous hardening using modern defensive practices
3. Identity and infrastructure hardening: implement identity and network controls that reduce attack paths and limit attacker movement

Example scenario: An internet scan finds an old remote desktop gateway nobody claims. How would you decide whether to patch, restrict or remove it?

1. Engineered telemetry through defensive controls: implement and evaluate defensive controls that improve detection and reduce infrastructure exposure
2. Enterprise security operations: understand how security operations center (SOC) processes and personnel support detection and event monitoring workflows
3. Evidence collection and visibility: assess the accuracy and integrity of security records, baselines, and logs

Example scenario: Two servers' logs disagree by several minutes during an incident. How does that affect your timeline, and what would you fix?

1. Network traffic analysis and investigation: analyze network traffic and forensic evidence to investigate security events using a variety of tools
2. Identity and infrastructure records: analyze identity and network infrastructure records, including Active Directory, RADIUS, and TACACS+, to determine system and user activity

Example scenario: RADIUS logs show one VPN account authenticating from two countries an hour apart. What would you check before disabling it?

1. Incident investigation and analysis: collect and analyze evidence to determine the scope of an incident
2. Incident containment and recovery: recognize common obstacles that can complicate containment, eradication, and recovery efforts

Example scenario: You have removed malware from a file server, but the attacker's account still exists in the domain. What else belongs in eradication?

1. Malware identification and triage: identify malware characteristics and assess indicators of compromise to support malware triage
2. Malware analysis and defensive controls: determine when static and dynamic malware analysis is appropriate, characterize malicious behavior through interactive and network-based analysis, and apply analysis findings to improve threat detection and defensive controls across the enterprise

Example scenario: A sandbox shows a document dropping a file and contacting a domain registered yesterday. Which indicators would you turn into detections?