GFACT Exam Domains 2026: Complete Guide to All 9 Content Areas

GFACT Exam Structure Overview

Before diving into content, it helps to understand what you're actually facing on test day. GFACT is a single proctored exam: 75 questions, a 2-hour time limit, and a passing score of 71 percent set through a psychometric standard-setting study for every version released on or after July 24, 2021. There's no prerequisite gate - GIAC built this credential specifically for career changers, students, new IT and cybersecurity hires, and re-skilling program participants, which is why the domain list leans so heavily on foundational technical literacy rather than specialized offensive or defensive tooling.

The nine domains listed below are pulled directly from GIAC's official Certification Objectives and Outcome Statements. If you want the full mechanics of registration, retakes, and renewal fees, see our GFACT Certification Cost breakdown. For a deeper look at how the exam feels under time pressure, our GFACT difficulty guide covers pacing and question style in more detail.

Domain 1: Computer Hardware & Virtualization

This domain tests whether you understand what's physically and logically happening inside a computer before you ever touch security tooling. Expect questions on CPU architecture basics, memory types, storage interfaces, and how virtualization abstracts hardware into hypervisors and virtual machines.

Domain 2: Exploitation & Mitigation

This is where GFACT starts introducing offensive concepts, but at a foundational level - no advanced exploit development is expected. You'll need to recognize common attack categories and match them to appropriate mitigations.

• Common vulnerability classes (buffer overflows, injection, misconfigurations)
• The relationship between a vulnerability, an exploit, and a payload
• Defense-in-depth mitigation strategies at a conceptual level
• Basic patch management and hardening rationale

Domain 3: Forensics & Post-Exploitation

Forensics questions on GFACT focus on evidence handling logic and what happens after a compromise - not deep tool mastery. You should understand chain of custody, artifact types, and why attackers pursue persistence or lateral movement.

Domain 4: Linux Foundations

Linux is one of the most hands-on-flavored domains in the objectives, reflecting the lab-heavy design of SANS SEC275. Even though the certification exam itself isn't CyberLive, questions will assume you've practiced actual command-line work.

• File system hierarchy and permission structures
• Common command-line utilities for navigation, search, and file manipulation
• Package management and process basics
• Shell scripting fundamentals

Domain 5: Logic & Programming

This domain surprises some career changers because it's genuinely about programming logic, not just security scripting. Expect coverage of variables, loops, conditionals, and basic data structures, along with how logic underpins automation and scripting in security contexts.

• Variables, data types, and control flow (if/else, loops)
• Functions and basic algorithmic thinking
• Reading and interpreting short code snippets
• How scripting supports security automation tasks

Domain 6: Networking & Servers

Networking is foundational to nearly every other domain, so expect a heavy concentration of TCP/IP, protocol, and server architecture questions here.

Domain 7: Operating Systems, The Web, & Data Storage

This domain bundles three related literacy areas: how operating systems manage resources, how web technologies function (HTTP, browsers, web servers), and how data gets stored and represented - from file systems to databases.

• OS scheduling, memory management, and process/thread basics
• HTTP/HTTPS request-response cycles and common web components
• Data storage concepts: files, databases, and basic data representation

Domain 8: Security Concepts

Security Concepts functions as the connective tissue for the entire exam. It covers the CIA triad, risk terminology, security frameworks, and the vocabulary you'll see referenced across every other domain.

• Confidentiality, Integrity, Availability (CIA triad)
• Risk, threat, vulnerability, and control terminology
• Authentication, authorization, and access control models
• Basic cryptography concepts (symmetric vs. asymmetric, hashing)

Domain 9: Windows Foundations

Mirroring the Linux domain, Windows Foundations expects practical familiarity with the operating system most enterprise environments still run - file systems, permissions, and administrative tooling.

• NTFS permissions and Windows file system structure
• Registry basics and common administrative utilities
• User account control and group policy concepts at an introductory level
• Command-line tools (Command Prompt/PowerShell basics)

Domain Weighting and What GIAC Actually Publishes

A common question candidates ask is which domains carry the most weight on the actual exam. GIAC does not publish percentage weightings for GFACT's nine domains - only the objectives and outcome statements themselves. That means the safest study posture is treating all nine areas as fair game rather than trying to guess a scoring curve.

For a full explanation of how the 71 percent threshold was set and what it means for your target score, read our dedicated GFACT Passing Score guide. If you're still deciding whether the credential fits your career goals given this domain spread, our GFACT ROI analysis weighs the ROI against the cost.

Scheduling Domain Study Around a 120-Day Window

Once you activate your GFACT attempt, the clock starts on a 120-day window to sit the exam. That's generous compared to some certifications, but it also means candidates who don't structure their review tend to drift. A domain-based approach works better than a generic weekly template because the nine areas naturally split into hands-on domains (Linux Foundations, Windows Foundations) and concept-heavy domains (Security Concepts, Exploitation & Mitigation).

This sequencing front-loads the domains that other domains depend on. Security Concepts terminology shows up inside networking and forensics questions, so mastering it early pays dividends later. For a more exhaustive week-by-week study plan tied to SEC275 material, see the GFACT Study Guide.

It's also worth understanding who's actually hiring for this credential before you commit study hours to all nine domains equally. Because GFACT maps to DoD 8140 directives and NIST NICE work roles, it's frequently used by organizations filling entry-level cybersecurity, IT support, and SOC analyst roles. If you're curious about real-world placement, our GFACT Jobs page and GFACT Salary Guide break down where this certification tends to open doors. And if you're still confirming basic eligibility before registering, the GFACT Requirements article confirms there are no prerequisites - anyone can sit for it.

Once you've mapped your study plan to these nine domains, the next practical step is timing your registration. Fee structure, retake costs, and scheduling windows are covered in the GFACT Exam Dates guide, and you can start testing your domain knowledge right now with practice questions on the main practice test site.

Frequently Asked Questions