GMOB Certification

What the GMOB Certification Actually Certifies

The GMOB certification is issued by GIAC Certifications and validates a practitioner's ability to assess and defend mobile devices and mobile applications. This page covers GIAC Mobile Device Security Analyst specifically, so if you have seen the same four letters attached to a different credential elsewhere, set those facts aside. Everything below refers to the GIAC exam only. If you want the short-form definition first, see What Is GMOB Certification? or What Does GMOB Stand For?.

GIAC's published objectives describe a credential that sits at the intersection of mobile platform administration and offensive-minded security analysis. That is an unusual blend. A candidate is expected to understand how Android and iOS are secured and managed, and also how those protections are probed: analyzing apps, intercepting traffic, reverse engineering binaries, and understanding the risks when a device is lost or stolen.

Exam Format and Rules of the Room

The GMOB exam is a single proctored, web-based test. The numbers worth memorizing are short:

A pacing note follows directly from the arithmetic: 75 questions in 120 minutes leaves roughly 96 seconds per question on average. That is generous for definition-style items and tight for anything that requires you to locate a page in your materials. Because submitted answers cannot be changed, the open-book advantage is real but not unlimited. You need to know the material well enough that your index confirms what you remember rather than teaching it to you on the clock.

For a deeper look at the cutoff, read GMOB Passing Score 2026. Note that the 71% standard applies to exam versions released on or after December 24, 2016, which is a statement about scoring policy, not about when the objective list was published.

What is not allowed

Internet access and personal electronic references are prohibited. So are materials resembling practice or exam questions and answers. That last restriction matters for how you build your index: do not paste in practice-test question banks or anything that functions as a memorized answer key. Your reference set should consist of course books, your own notes, and an organized index of concepts. The GIAC Candidate Agreement (updated February 18, 2025) is the document that governs these conduct rules, and it is worth reading before test day.

The 11 Objective Headings, Grouped by How You Will Study Them

GIAC publishes 11 objective headings and does not publish percentage weights for them. That means you cannot reliably budget study time by weight, and any article claiming exact domain percentages for this exam is importing numbers from somewhere else. Treat all 11 as potentially examinable. The full breakdown lives in our GMOB exam domains guide; here is a working grouping to organize your preparation.

Platform management and defense

Analysis and attack techniques

Network-focused headings

The assessment umbrella

Why MASVS-Style Assessment Thinking Matters

Most certification objective lists are a bag of topics. This one contains a framework reference. GIAC's current heading "Mobile Application Security Assessments" explicitly names MASVS in its outcome statement, which signals that the exam expects you to think about assessment as structured verification against a standard rather than as ad hoc poking at an app.

This framing also helps with the Android and iOS management headings. A control is easier to remember when you can state what weakness it addresses and how an assessor would confirm it is working.

Registration, Fees, and the 120-Day Window

Costs are straightforward but add up when you include training. GIAC's published figures, which exclude applicable sales tax:

• Certification attempt: USD $999
• Retake: USD $899
• Official practice exam: USD $399
• SANS training tuition: separate and not included in the attempt fee

Once your attempt is activated, you have 120 days to complete it. That window is both a deadline and a planning tool: activate when your preparation is nearly finished, not when you are just starting the course. Our GMOB exam dates guide covers scheduling mechanics, and the GMOB certification cost breakdown walks through the full budget including optional extras.

Proctoring is handled through Pearson VUE onsite or ProctorU remotely, depending on attempt-specific eligibility. If you plan to test remotely, review the GIAC proctoring pages and the Proctored Exam Reference Guide well ahead of time so the room, equipment, and identification requirements do not surprise you.

Eligibility

There are no formal certification prerequisites. Training is optional and recommended. That distinction matters: SEC575 itself recommends programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge, but those are course recommendations, not GIAC eligibility rules. See GMOB requirements for the full picture.

SANS SEC575 and Other Preparation Sources

The preparation source most closely associated with this credential is SANS SEC575, "iOS and Android Application Security Analysis and Penetration Testing." It maps conceptually onto the objective headings: mobile platform security, application analysis, traffic interception, and assessment technique. Two cautions are worth stating plainly.

• Course sections are not the exam blueprint. Course material is unweighted preparation curriculum. It does not establish exhaustive exam coverage, so use the GIAC objective headings as your checklist and the course as one way to learn them.
• Platform versions differ across sources. The live SEC575 page references Android 14 and iOS 17, while its linked brochure references Android 12 and iOS 15. Neither tells you which platform version your assigned exam reflects, so learn the underlying security models rather than version-specific screenshots.

For a structured approach built around these sources, see the GMOB study guide and our overview of GMOB training options. To practice applying what you read under timed conditions, the GMOB practice test site is built for exactly that.

Building an Open-Book Index That Works

Open book is the feature that most changes how candidates prepare for GIAC exams. Done well, an index turns your books into a fast lookup system. Done poorly, it becomes a time sink that eats your 96-seconds-per-question average.

1. Index by concept, not by chapter. A question will describe a situation; you need to jump from the concept to the page.
2. Add cross-references between headings. Reverse engineering, manipulating app behavior, and application analysis overlap heavily. Link them in your index.
3. Record your own weak points. If you keep confusing an Android mechanism with its iOS equivalent, give each its own entry and a one-line contrast.
4. Keep it hardcopy. Personal electronic references are prohibited, so everything you rely on must be printed or bound.
5. Avoid question-and-answer material. Anything resembling practice or exam questions and answers is not permitted in the room.

For a compact complement to your index, the GMOB cheat sheet summarizes high-yield facts, though remember that anything you bring into the exam must follow GIAC's materials rules.

Scheduling Domains in a Sensible Order

Because no official weights exist, a good schedule is built on dependencies: learn platform fundamentals first, then the analysis techniques that rely on them, then the network and assessment layers. Here is one way to sequence the 11 headings across a six-week run, adjustable to your 120-day window.

The ordering is deliberate. Rooting and malware come before app analysis because you will want to understand device trust boundaries before manipulating what runs on them. Network headings come after app analysis because intercepting traffic is easier to reason about once you know what the app is sending and why.

Where the Credential Fits and How Renewal Works

The skills in the objective list point toward roles such as mobile application security testing, penetration testing with a mobile focus, and enterprise mobile security. Employers who need someone to evaluate iOS and Android apps, assess how corporate devices are managed, or advise on mobile loss and malware scenarios are the natural audience. For hiring context, see GMOB jobs, and for compensation discussion, the GMOB salary guide. If you are weighing the investment overall, the GMOB ROI analysis takes you through it. We avoid quoting salary numbers here because no verified figures for this credential are part of GIAC's published materials.

Validity and renewal

The certification is valid for four years. To renew, you either earn 36 approved CPE credits during the active four-year period or take a renewal exam, and in either case pay the standard USD $499 renewal fee. GIAC's CPE Information and renewal how-to pages explain which activities qualify. Starting CPE collection early in the cycle is far easier than scrambling in year four.

Frequently Asked Questions

If you are earlier in your research, the pages on what GMOB is and how hard the exam is are good next stops, and the GMOB pass rate discussion explains what can and cannot be said about success rates. When you are ready to test your recall under time pressure, head to GMOB Exam Prep for practice questions that mirror the exam's scenario-driven style.