- How GIAC Presents the 12 Domains
- Exam Mechanics That Shape Domain Prep
- Cluster 1: AWS and Azure Platform Domains
- Cluster 2: Recon, CLI, and Application Mapping
- Cluster 3: Containers, Kubernetes, and CI/CD
- Cluster 4: Attack Craft and Red Team Operations
- Domain-by-Domain Comparison Table
- Sequencing the Domains Across Your Prep
- Where These Domains Show Up in Real Roles
- Frequently Asked Questions
- GIAC publishes 12 objective headings for the Cloud Penetration Tester exam, but no official percentage weights for any of them.
- The exam is one proctored sitting: 75 questions in 2 hours, with a 70% minimum passing score.
- Domains span AWS, Azure, containers, Kubernetes, CI/CD, password attacks, obfuscation, and web application attacks.
- The exam is open book with paper references only; electronic materials and internet access are prohibited.
How GIAC Presents the 12 Domains
The GIAC Cloud Penetration Tester (GCPN) certification validates a practitioner's ability to assess cloud environments offensively. GIAC's public certification page lists twelve exam-objective headings, and this guide walks through every one of them. If you are brand new to the credential, start with What Is GCPN Certification? for the basics, then return here for the domain-level detail.
Two facts about the domain list matter before you build a study plan:
- No weights are published. GIAC's source page lists the headings but does not assign percentages to them. Any site claiming "Domain 8 is 14% of the exam" is inventing a number. Treat all twelve as fair game and prepare broadly.
- The list is alphabetical, not sequential. The headings appear in source order, which is alphabetical. "Cloud Penetration Testing Fundamentals" is Domain 5 in that ordering, but conceptually it is where you should begin. The numbering is a reference label, not a recommended learning path.
Exam Mechanics That Shape Domain Prep
Domain knowledge only converts into a pass if you can retrieve it under the exam's constraints. Here is what the format means for how you study each area.
| Exam Feature | Detail | Prep Implication |
|---|---|---|
| Question count | 75 questions | Roughly 1.6 minutes per question on average |
| Time limit | 2 hours | You cannot research every answer in your books |
| Passing score | 70% minimum (versions released on or after 2021-02-13) | Allows a limited number of misses across all domains |
| Reference policy | Open book, paper references only | A well-built paper index is a real asset |
| Prohibited | Electronic references, internet, materials containing exam or practice Q&A | Do not bring leaked or Q&A-style notes |
| Delivery | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality | Check your modality early in your account |
For a deeper look at the scoring threshold, see GCPN Passing Score 2026: Exactly What You Need to Pass. For how hard the exam feels in practice, read How Hard Is the GCPN Exam?
One important caveat: GIAC states that the Certification Information in your own GIAC account governs your purchased attempt's objectives, question types, format, and passing score. Always confirm those details in your account after purchase, because the public page is a summary.
Cluster 1: AWS and Azure Platform Domains
Three domains are explicitly tied to the two largest public cloud platforms. They reward hands-on familiarity with how identity and services actually behave, not just vocabulary.
Domain 1: AWS Authentication and Cloud Services
This domain covers how identities authenticate to Amazon Web Services and how core services expose attack surface.
- How credentials, keys, and temporary tokens are issued and where they leak
- What an attacker can enumerate once they hold a single set of valid credentials
- How common AWS services behave from an offensive perspective
- Reading policy and permission structures to identify privilege escalation paths
Domain 2: Azure Functions and Windows Containers
This is the most unusual pairing in the list. It combines serverless compute on Azure with Windows-based container technology.
- How Azure Functions are triggered, configured, and potentially abused
- Secrets and configuration exposure in function environments
- How Windows containers differ from the Linux containers most candidates know better
- Where the isolation boundary sits and what weakens it
Domain 8: Microsoft Azure Cloud Services and Attacks
Where Domain 2 is narrow, Domain 8 is broad Azure offensive tradecraft.
- Azure identity concepts and how tenants, subscriptions, and resources relate
- Enumerating Azure services from a foothold
- Typical attack paths against Azure-hosted workloads and identities
- Differences in mindset when moving from AWS to Azure
A practical note: many candidates arrive with stronger AWS exposure than Azure, or the reverse. Because both platforms are named in the headings, an honest gap assessment of your weaker platform should happen in week one, not week six.
Cluster 2: Recon, CLI, and Application Mapping
These domains cover how a tester finds things and interacts with cloud environments efficiently. They are the connective tissue between the platform-specific material.
Domain 3: Cloud CLI and Application Mapping
Cloud command-line interfaces are an attacker's primary workbench after obtaining credentials.
- Using provider CLIs to enumerate resources, identities, and configuration
- Mapping how an application is composed across cloud services
- Recognizing architecture from the outside and from a foothold inside
- Reading CLI output quickly, since exam questions often present snippets
Domain 7: Discovering Cloud Services and Data
Before attacking anything, you must know it exists. This domain addresses discovery.
- Finding externally exposed cloud assets and services
- Identifying storage and data repositories that may be misconfigured or exposed
- Understanding how naming conventions and metadata aid discovery
- Turning discovered services into prioritized targets
Domain 5: Cloud Penetration Testing Fundamentals
This is the conceptual foundation: how cloud testing differs from traditional network testing.
- Scope, rules of engagement, and provider policy considerations in cloud contexts
- The shared responsibility model and what it means for testable surface
- How cloud assessment methodology adapts classic penetration testing phases
Even though Domain 5 is numbered fifth, treat it as your entry point. Concepts from the fundamentals domain frame how to read questions in every other area.
Cluster 3: Containers, Kubernetes, and CI/CD
Modern cloud applications are increasingly built from containers and delivered through automated pipelines. Three domains reflect that reality.
Domain 6: Containers and Kubernetes Structure
The heading emphasizes structure, which signals that understanding architecture comes before exploitation.
- How containers are built, isolated, and run
- Kubernetes components: how the control plane, nodes, pods, and services relate
- Where credentials, secrets, and service accounts live inside a cluster
- Which architectural weaknesses create escape or lateral movement opportunities
Domain 4: Cloud Native Applications and CI/CD Pipelines
Build and deployment pipelines are high-value targets because they hold secrets and have broad deployment permissions.
- How cloud-native application architectures are assembled
- Where pipeline credentials and tokens are stored and exposed
- How compromising a pipeline can lead to compromising the environments it deploys to
- Source repositories, build systems, and artifact handling from an attacker's viewpoint
Cluster 4: Attack Craft and Red Team Operations
The final four domains focus on techniques and operational tradecraft that cut across platforms.
Domain 9: Password Attacks on Cloud Environments
Credentials remain the most common path into cloud accounts.
- Password spraying and guessing against cloud identity endpoints
- How cloud authentication differs from on-premises authentication for attack purposes
- Detection and lockout considerations that affect technique choice
Domain 12: Web Application Attacks
Web applications hosted in the cloud remain a primary entry vector.
- Classic web vulnerabilities in the context of cloud hosting
- How a web flaw can pivot into cloud credentials or metadata access
- Connecting application-layer findings to cloud-layer impact
Domain 11: Redirection and Attack Obfuscation
This domain addresses how testers route and conceal activity during an engagement.
- Using redirectors and intermediate infrastructure to protect attack origin
- Reducing detectability of testing traffic
- Why obfuscation matters for realistic adversary simulation
Domain 10: Red Team Penetration Testing of Cloud Environments
The capstone-style domain, combining earlier skills into goal-oriented operations.
- Chaining access across services and identities toward an objective
- Persistence and stealth considerations in cloud environments
- Thinking in terms of attack paths rather than isolated findings
Domain-by-Domain Comparison Table
Use this table as a quick planning aid. The "skill type" column reflects the nature of each heading as described above, not an official GIAC classification.
| # | Domain | Primary Skill Type |
|---|---|---|
| 1 | AWS Authentication and Cloud Services | Platform knowledge and identity |
| 2 | Azure Functions and Windows Containers | Platform knowledge, serverless and containers |
| 3 | Cloud CLI and Application Mapping | Tooling and enumeration |
| 4 | Cloud Native Applications and CI/CD Pipelines | Architecture and pipeline abuse |
| 5 | Cloud Penetration Testing Fundamentals | Methodology and concepts |
| 6 | Containers and Kubernetes Structure | Architecture |
| 7 | Discovering Cloud Services and Data | Reconnaissance |
| 8 | Microsoft Azure Cloud Services and Attacks | Platform attacks |
| 9 | Password Attacks on Cloud Environments | Credential attacks |
| 10 | Red Team Penetration Testing of Cloud Environments | Operations and chaining |
| 11 | Redirection and Attack Obfuscation | Operational tradecraft |
| 12 | Web Application Attacks | Application-layer attacks |
Sequencing the Domains Across Your Prep
Because GIAC publishes no weights, sequencing should follow dependency rather than importance. Foundations first, platform specifics next, operational chaining last. The plan below assumes a roughly six-week runway; stretch or compress it to fit your schedule. Standalone attempts have initial access of 120 days from activation, with extensions available, so you have flexibility. Our GCPN Study Guide covers overall pacing in more depth, and GCPN Exam Dates explains scheduling.
Foundations and Discovery
- Domain 5: Cloud Penetration Testing Fundamentals
- Domain 7: Discovering Cloud Services and Data
- Gap-check your AWS versus Azure comfort level
AWS Depth
- Domain 1: AWS Authentication and Cloud Services
- Domain 3: Cloud CLI and Application Mapping, using AWS CLI output as your practice material
Azure Depth
- Domain 8: Microsoft Azure Cloud Services and Attacks
- Domain 2: Azure Functions and Windows Containers
Cloud-Native Architecture
- Domain 6: Containers and Kubernetes Structure
- Domain 4: Cloud Native Applications and CI/CD Pipelines
Attack Techniques
- Domain 9: Password Attacks on Cloud Environments
- Domain 12: Web Application Attacks
Operations and Review
- Domain 11: Redirection and Attack Obfuscation
- Domain 10: Red Team Penetration Testing of Cloud Environments
- Finalize and test your paper index; run timed practice sets
Key Takeaway
Build your paper index as you go, not in the final week. Since the exam is open book with paper references only, an index organized by domain heading and tool or service name saves meaningful time across 75 questions in 2 hours. For a condensed review aid, see the GCPN Cheat Sheet, and use the GCPN practice tests to find which domains slow you down under time pressure.
Using SEC588 as a Domain Map
SANS SEC588: Cloud Penetration Testing is the recommended preparation course, and its public syllabus overlaps heavily with the topics above. Two cautions apply. First, SANS course sections are unweighted preparation curriculum; they do not establish exhaustive exam coverage or define the official domain count. Second, course hours, labs, and capstones are separate from the proctored exam time. Training is optional, and there are no prerequisites to begin the certification process, as detailed in GCPN Requirements. If you are weighing a course, see GCPN Training for options.
Where These Domains Show Up in Real Roles
The twelve domains map naturally onto job functions where offensive cloud skills are valued. Typical examples include:
- Penetration testers and security consultants who assess customer cloud environments, where Domains 1, 2, 8, and 12 provide the platform and application entry points.
- Red team operators who simulate adversaries, drawing on Domains 10 and 11 in particular.
- Cloud security engineers who need to understand attack paths in order to defend against them, especially Domains 4 and 6 for pipelines and clusters.
- DevSecOps and application security staff who secure build systems and containerized workloads.
For the job-market picture, read GCPN Jobs. For compensation and return on investment, see the GCPN Salary Guide and Is the GCPN Certification Worth It?
Cost and Renewal Context
The exam fee is USD 999, a retake is USD 899, an optional practice exam is USD 399, and renewal is USD 499, all excluding tax. The certification is valid for 4 years, and renewal requires 36 approved CPE credits earned in the cycle or a passing renewal exam, plus the renewal fee. A full breakdown is in GCPN Certification Cost 2026. One honest note on data: the exam source publishes a passing score, not a candidate pass rate, so the discussion in GCPN Pass Rate 2026 is necessarily qualitative.
Frequently Asked Questions
GIAC's public certification page lists 12 exam-objective headings, from AWS Authentication and Cloud Services through Web Application Attacks. GIAC does not publish percentage weights for them.
GIAC publishes no difficulty or weighting data, so it depends on your background. Candidates strong in AWS often find Azure Functions, Windows containers, and Kubernetes structure the biggest gaps, and the reverse is also common.
Yes, the exam is open book, but only paper references are allowed. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited under GIAC's proctoring rules.
No. Training is optional and no prerequisites are required to begin the certification process. SEC588 is recommended preparation, but its syllabus is not an official statement of exam coverage.
The exam has 75 questions in 2 hours, with a 70% minimum passing score for exam versions released on or after 2021-02-13. Confirm specifics in your GIAC account's Certification Information.
With all twelve domains mapped, your next step is turning knowledge into timed performance. Start with the domain overview as a checklist, then pressure-test yourself with the GCPN Exam Prep practice questions before you schedule your sitting.