- The One-Glance Exam Snapshot
- Open-Book Rules That Shape Your Prep
- Fees, Windows, and the Renewal Clock
- The 11-Domain Fact Sheet
- Android vs. iOS: Side-by-Side Reference
- Network Traffic and Encryption Quick Reference
- Assessments, MASVS, and Reporting
- Malware and Stolen-Device Essentials
- Building an Index That Actually Works
- A Domain-Ordered Study Sequence
- Where the Credential Gets Used
- Quick-Answer FAQ
- The exam is 75 questions in 2 hours, with a minimum passing score of 71%.
- It is open book: hardcopy books, notes, and an index allowed; internet and electronic references are prohibited.
- Submitted answers cannot be changed, so commit only after you have checked your index.
- The published objectives list 11 unweighted domains, so prepare evenly rather than betting on one area.
The One-Glance Exam Snapshot
The GIAC Mobile Device Security Analyst (GMOB) certification validates hands-on ability to assess, attack, and defend iOS and Android devices and applications. This page condenses the facts you need into a single review. If you want the long-form version of any item, the GMOB study guide and the complete guide to all 11 content areas expand each topic.
| Item | Fact |
|---|---|
| Issuer | GIAC Certifications, administered by GIAC, LLC |
| Format | One proctored, web-based exam |
| Questions | 75 total |
| Time limit | 2 hours |
| Minimum passing score | 71% |
| Delivery | Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
| Prerequisites | None formal; training is optional and recommended |
| Completion window | 120 days from activation |
| Validity | Four years |
Seventy-one percent of 75 questions works out to roughly 54 correct answers if every question is weighted equally. Treat that as a planning figure rather than an official conversion, since GIAC publishes the percentage, not a raw-score cutoff. The GMOB passing score breakdown covers how to think about that margin.
Open-Book Rules That Shape Your Prep
GMOB is open book, but the rules are strict. Allowed materials are hardcopy books, handwritten or printed notes, and an index. Prohibited items include internet access, personal electronic references, and any materials resembling practice or exam questions and answers.
- Submitted answers cannot be changed. There is no flag-and-return safety net after you submit, so resolve uncertainty before you click.
- Break time totals 15 minutes. Plan when you will use it rather than burning it early.
- Two hours for 75 questions averages about 96 seconds per question, which is tight if you look up every answer. Your index should rescue hard questions, not carry every question.
Key Takeaway
Open book does not mean easy. Candidates who rely on looking everything up run out of time. Know the concepts well enough to answer a majority of questions directly, and use your index for command syntax, tool flags, file paths, and obscure specifics. The difficulty guide explains why time pressure, not recall alone, is the usual obstacle.
Fees, Windows, and the Renewal Clock
| Cost Item | Amount (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee | $499 |
Prices exclude applicable sales tax, and SANS training tuition is a separate expense. For a full breakdown of what a realistic total looks like, see the GMOB certification cost guide.
Timeline Facts
- You have 120 days from activation to complete your attempt. Scheduling logistics are covered in the GMOB exam dates guide.
- The certification stays valid for four years.
- Renewal requires either 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the standard $499 renewal fee.
The 11-Domain Fact Sheet
GIAC publishes eleven objective headings in a fixed order. No official percentage weights accompany them, so you cannot safely skip any heading. Below is each domain with the practical themes worth reviewing, based on the objective headings and the broader scope GIAC describes: Android and iOS security, static and dynamic application analysis, traffic interception, malware, and stolen-device risk.
Domain 1: Analyzing Mobile Applications
Understand how to examine an app's structure, permissions, storage, and behavior.
- Static versus dynamic analysis: what each reveals and what each misses
- Where apps keep data on each platform and why local storage choices matter
Domain 2: Attacking Encrypted Traffic
Know how TLS-protected app traffic gets intercepted during testing.
- Certificate trust chains and how a proxy certificate gets accepted
- Why certificate pinning exists and how testers work around it
Domain 3: Managing Android Devices and Applications
Android's permission model, application sandboxing, and management tooling.
- Package structure, manifest declarations, and component exposure
- Device management controls available to enterprises
Domain 4: Managing iOS Devices and Applications
iOS app sandboxing, signing, entitlements, and enterprise management.
- Code signing and provisioning concepts
- How iOS data protection classes affect stored data
Domain 5: Manipulating Mobile Application Behavior
Runtime modification of apps to observe or alter logic.
- Instrumentation and hooking concepts
- Bypassing client-side controls and what that implies for server-side design
Domain 6: Manipulating Network Traffic
Intercepting, modifying, and replaying traffic between app and back end.
- Proxy configuration on devices and emulators
- Tampering with parameters to test server-side validation
Domain 7: Mitigating Against Mobile Malware
How mobile malware behaves and what defenders can do about it.
- Distribution paths, common capabilities, and detection approaches
- Platform controls that limit installation of untrusted code
Domain 8: Mitigating Against Stolen Mobile Devices
Reducing risk when a device is lost or stolen.
- Encryption at rest, screen locks, and remote wipe
- Policy controls an organization can enforce
Domain 9: Mobile Application Security Assessments
Structuring a repeatable assessment and reporting results. GIAC's outcome statement here explicitly names the Mobile Application Security Verification Standard (MASVS).
- Mapping findings to a verification standard
- Scoping, methodology, and communicating risk
Domain 10: Reverse Engineering Mobile Applications
Decompiling and inspecting app binaries to understand logic and find secrets.
- Recovering readable code from packaged apps
- Spotting hard-coded keys, endpoints, and weak logic
Domain 11: Unlocking and Rooting Mobile Devices
Gaining privileged access for testing and understanding the associated risk.
- Rooting and jailbreaking concepts and why testers use them
- Security implications for a compromised device and how apps detect it
Android vs. iOS: Side-by-Side Reference
A common source of lost points is mixing up platform-specific behavior. Use this table to anchor the conceptual differences, then fill in exact paths, tools, and commands in your own notes from your course materials.
| Concept | Android | iOS |
|---|---|---|
| App package concept | Packaged archive containing manifest and compiled code | Signed app bundle with property lists |
| Permission model | Declared in manifest, granted by user at install or runtime | Entitlements plus user-prompted privacy permissions |
| Privileged access term | Rooting | Jailbreaking |
| Trust model | Signing with developer-held keys; flexible installation sources | Code signing tied to Apple's ecosystem |
| Management domain | Domain 3 | Domain 4 |
Network Traffic and Encryption Quick Reference
Domains 2 and 6 reward candidates who understand the traffic path end to end, not just tool buttons. Be ready to reason about the following.
Interception Workflow Logic
- The device or emulator routes traffic through a testing proxy.
- The proxy's certificate must be trusted by the device or app for TLS interception to succeed.
- If the app enforces pinning, the trusted proxy certificate alone is not enough and the pinning check must be addressed.
- Once traffic is visible, parameters can be modified and replayed to probe server-side behavior.
Questions to Ask Yourself
- Why can one app be intercepted trivially while another resists the same setup?
- What does a successful bypass of a client-side check tell you about where validation should live?
- Which findings in intercepted traffic belong in an assessment report?
Assessments, MASVS, and Reporting
Domain 9, Mobile Application Security Assessments, is the domain where GIAC explicitly names the Mobile Application Security Verification Standard. Expect scenario thinking: given an app and a finding, how does it map to verification requirements, and how severe is it? Review the standard's overall structure so you can place any finding into the right category quickly, and build index entries that point to those categories.
Key Takeaway
Because no official weights are published, treat the assessment domain as a connective tissue for the rest. Static analysis, dynamic analysis, traffic work, and reverse engineering all produce findings that must be organized and justified. Practicing the write-up step makes the technical domains easier to recall.
Malware and Stolen-Device Essentials
Domains 7 and 8 are the defensive counterweights to the offensive material. Questions tend to ask which control best addresses a described risk.
Malware Review Points
- How malicious apps reach devices and which platform controls reduce that exposure
- What behaviors distinguish a malicious app from a legitimate one during analysis
- How enterprise management can limit installation sources
Stolen-Device Review Points
- Device encryption and strong authentication as the first line of defense
- Remote locate, lock, and wipe capabilities and their limits
- Policy decisions: what data should be allowed on a device at all
Building an Index That Actually Works
Because the exam is open book and you have about 96 seconds per question on average, your index is a speed tool. Organize it so a lookup takes seconds.
- Index by keyword, not by chapter. Tool names, file locations, flags, platform terms, and acronyms should each be a row.
- Add the domain name (for example, "Manipulating Network Traffic") beside each entry so you can see which domain a term belongs to.
- Record the book and page for every entry, and keep one consistent format.
- Do not index prohibited material. Anything resembling practice or exam questions and answers is not allowed in the room, so build notes from your course content and your own lab work.
The GMOB practice tests are useful for exposing which index entries you reach for repeatedly and which you never use. Use the results to prune and sharpen your index, not to copy question content into it.
A Domain-Ordered Study Sequence
There is a logical order to the eleven domains: platform foundations first, then analysis, then attack techniques, then defense and assessment. This sequence assumes a six-week plan inside your 120-day window; stretch or compress as needed.
Platform Foundations
- Domain 3 (Android management) and Domain 4 (iOS management)
- Build your Android vs. iOS comparison sheet
Analysis Basics
- Domain 1 (Analyzing Mobile Applications)
- Domain 10 (Reverse Engineering Mobile Applications)
Traffic Work
- Domain 6 (Manipulating Network Traffic)
- Domain 2 (Attacking Encrypted Traffic)
Runtime and Privilege
- Domain 5 (Manipulating Mobile Application Behavior)
- Domain 11 (Unlocking and Rooting Mobile Devices)
Defense and Assessment
- Domain 7 (malware) and Domain 8 (stolen devices)
- Domain 9 (assessments and MASVS)
Timed Rehearsal
- Full 75-question, 2-hour timed runs using your index
- Fix weak domains and tighten index entries
Where the Credential Gets Used
The skills map most directly to roles that assess or defend mobile technology: penetration testers who include mobile apps in scope, application security engineers, mobile security analysts, and security teams responsible for enterprise device fleets. Consultancies that deliver mobile application assessments and organizations that build their own apps tend to value hands-on mobile expertise. For a look at how the roles are described, see the GMOB jobs overview, and for compensation discussion without invented numbers, the salary guide. Whether the investment pays off for your situation is the subject of the ROI analysis.
Quick-Answer FAQ
The exam has 75 questions with a 2-hour time limit. You also get 15 minutes of break time, and submitted answers cannot be changed.
The minimum passing score is 71%. This standard applies to exam versions released on or after December 24, 2016, and your assigned attempt's details at exams.giac.org take precedence.
Yes. Hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
No. GIAC's objective list publishes eleven headings in order without percentage weights, so prepare across all of them rather than guessing which will dominate.
It is valid for four years. Renewal requires 36 approved CPE credits earned during that period or a renewal exam, plus the $499 renewal fee.