- GMOB has no published fixed exam dates; you schedule an attempt, then book a Pearson VUE or ProctorU slot.
- Each activated attempt must be completed within 120 days, so your study plan should be built backward from that window.
- The exam is 75 questions in 2 hours, open book, with a 71% minimum passing score.
- A certification attempt costs USD $999 and a retake costs USD $899, excluding applicable sales tax.
There Is No Fixed GMOB Exam Calendar
If you searched for "GMOB exam dates 2026" hoping to find a list of testing days like a college entrance exam, here is the first thing to know: the GIAC Mobile Device Security Analyst (GMOB) exam does not run on a published national calendar. GIAC certification exams are delivered as individual proctored attempts. You register for an attempt, it is activated, and you then choose your own testing date and time within a defined completion window.
That distinction changes how you should think about "dates." The relevant deadlines are not seasonal cutoffs but personal ones: the day your attempt is activated, the day your 120-day window closes, and the day you book your proctoring appointment. This article walks through each of those and shows how to build a GMOB study plan around them. If you are still deciding whether to pursue the credential at all, our breakdown of whether the GMOB certification is worth it covers the career case, and What Is GMOB Certification? gives the basics.
How GMOB Scheduling Actually Works
Step 1: Register and Activate an Attempt
Your first move is registering for a certification attempt through GIAC. Activation starts the clock on your attempt-completion window, which is why many candidates delay activation until their preparation is well along. Registering early "just to lock something in" can quietly consume days you would rather spend studying.
Step 2: Choose Your Proctoring Method
GIAC exams are delivered through two proctoring routes, subject to attempt-specific eligibility:
- Pearson VUE: an onsite testing center experience where you sit the exam in a controlled facility.
- ProctorU: a remote option where you test from your own space under live or monitored proctoring.
Which options appear for your attempt depends on your specific eligibility, so check the details of your assigned attempt at the GIAC attempts page rather than assuming both are available. Onsite slots at a Pearson VUE center can fill up near busy periods, and remote slots depend on proctor availability, so booking a few weeks ahead is wise.
Step 3: Book Your Appointment Inside the Window
Once your attempt is active, you select a specific date and time. Because there is no group sitting, you can often choose a day that fits your own preparation, work schedule, and energy levels. Use that flexibility deliberately: pick a day when you are not coming off a long on-call rotation or a travel week.
The 120-Day Attempt Window
The single most important date rule for GMOB is the completion window: you have 120 days from activation to complete the attempt. That is roughly four months, which sounds generous until you factor in course material, lab practice, index building, and scheduling logistics.
Key Takeaway
Work backward from day 120. Reserve the final two to three weeks for index refinement and timed practice, and aim to book your proctoring slot no later than the midpoint of your window so you are not forced into whatever appointment is left.
Do not treat the 120 days as a deadline to hit exactly. Candidates who test in the final days of the window leave no margin for a technical problem, illness, or a proctoring reschedule. Build a buffer of at least a week. For a deeper look at how long preparation really takes, see our GMOB study guide.
If Your Window Closes
If the window lapses without a completed attempt, you should not assume it can be extended informally. Read the GIAC Candidate Agreement and the attempt-specific terms before you rely on any extension or reinstatement option, and contact GIAC directly with your situation. Policies on this can change, so the issuer's current wording takes precedence over any summary, including this one.
Fees, Retakes, and Timing Your Spend
Date planning and budget planning are linked, because each attempt carries its own fee and its own window. The figures below come from GIAC's published pricing and exclude applicable sales tax. SANS training tuition is a separate cost.
| Item | Cost (USD) | Timing Relevance |
|---|---|---|
| GMOB certification attempt | $999 | Starts a 120-day completion window on activation |
| Retake attempt | $899 | Carries its own window; plan the gap before rebooking |
| Official practice exam | $399 | Best used in the middle of your window, not the very end |
| Certification renewal | $499 | Due as your four-year validity period nears its end |
A sensible approach is to treat the official practice exam as a diagnostic checkpoint roughly halfway through your window. That leaves enough time to act on what it reveals. For the full cost picture, including training, read the GMOB certification cost breakdown.
What Awaits You on Exam Day
Knowing the format helps you choose a sensible time of day and prepare your reference materials before your date arrives.
- Questions and time: 75 questions in a 2-hour limit, which averages under two minutes per question.
- Passing score: 71% minimum. Our GMOB passing score guide explains how that translates to the number of questions you need to get right.
- Open book: hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
- No changing answers: submitted answers cannot be changed, so avoid submitting a response you intend to revisit.
- Breaks: 15 minutes of break time are allowed.
The open-book rule is the reason your preparation calendar matters so much. The exam rewards candidates who can find the right page quickly, which means your index must be finished well before test day, not assembled the night before. The 71% passing standard applies to exam versions released on or after December 24, 2016, but your assigned attempt's objectives, format, and passing score at the GIAC attempts page take precedence over any third-party summary.
Planning Your Window Around the 11 Domains
GIAC publishes eleven objective headings for GMOB, listed in the order below. No official percentage weights are published for them, so you should not budget study time based on invented weightings. Instead, allocate time by your own gaps and by how connected the topics are. For a fuller walkthrough, see GMOB Exam Domains 2026: Complete Guide to All 11 Content Areas.
- Analyzing Mobile Applications
- Attacking Encrypted Traffic
- Managing Android Devices and Applications
- Managing iOS Devices and Applications
- Manipulating Mobile Application Behavior
- Manipulating Network Traffic
- Mitigating Against Mobile Malware
- Mitigating Against Stolen Mobile Devices
- Mobile Application Security Assessments
- Reverse Engineering Mobile Applications
- Unlocking and Rooting Mobile Devices
Platform Foundations: Android and iOS Management
Managing Android Devices and Applications and Managing iOS Devices and Applications are the platform bedrock. Understand each operating system's security model, app sandboxing, permissions, and how apps are packaged and distributed.
- Compare Android and iOS security architecture side by side
- Know how each platform handles app installation and trust
- Study these early, since later domains assume this knowledge
Application Testing: Analysis, Behavior, and Assessment
Analyzing Mobile Applications, Manipulating Mobile Application Behavior, and Mobile Application Security Assessments form the core testing workflow. The assessment objective explicitly names the Mobile Application Security Verification Standard (MASVS), so be ready to reason about verification requirements, not only tools.
- Distinguish static analysis from dynamic analysis and when each applies
- Understand how runtime behavior can be altered during testing
- Learn how MASVS frames what a secure mobile app should do
Network Interception: Traffic and Encryption
Manipulating Network Traffic and Attacking Encrypted Traffic go together. Expect scenario thinking about how traffic is intercepted, why encryption protections can resist interception, and what conditions allow testers to observe protected communications.
- Practice the setup logic behind intercepting mobile traffic
- Understand how certificate validation affects what you can see
Device Risk: Malware, Theft, and Rooting
Mitigating Against Mobile Malware, Mitigating Against Stolen Mobile Devices, and Unlocking and Rooting Mobile Devices cover the defensive and offensive sides of device-level risk, while Reverse Engineering Mobile Applications ties into malware and app internals.
- Know protective controls for lost or stolen devices
- Understand what rooting and unlocking change about a device's security posture
- Be able to reason about how malicious apps behave and how to limit them
Because the scope heading names Android and iOS together, avoid specializing too narrowly. A candidate comfortable only with one platform can lose points across several domains. The official SANS preparation course, SEC575 (iOS and Android Application Security Analysis and Penetration Testing), is a common route, though training is optional and its platform examples vary by edition. Our page on GMOB training compares preparation paths.
A Sample Window Timeline
Here is one way to spread a 120-day attempt window across the domains. Treat it as a template to adapt, not a prescription; shorten or lengthen blocks based on your background. The sequencing logic matters more than the exact week counts: platforms first, testing workflow second, interception third, device risk last, with practice and index work running throughout.
Platform foundations
- Android and iOS device and application management
- Start the index skeleton: one entry per concept as you meet it
- Activate your attempt only when you are ready to commit
Application analysis and assessment
- Analyzing and manipulating mobile application behavior
- Reverse engineering mobile applications
- Mobile application security assessments and MASVS
Traffic and device risk
- Manipulating network traffic and attacking encrypted traffic
- Mobile malware and stolen-device mitigation
- Unlocking and rooting mobile devices
Practice, index polish, and booking buffer
- Sit the official practice exam as a diagnostic and fix weak areas
- Finalize the index and tab your books
- Hold your proctoring appointment with a week of slack before day 120
If you need a faster plan, compress the timeline but keep the buffer. If you want a quick-reference companion for the final stretch, our GMOB cheat sheet condenses the must-know facts, and you can pressure-test your recall with the GMOB practice tests.
After You Pass: Validity and Renewal Dates
Passing starts a second clock. GMOB certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year period or take a renewal exam, and in either case pay the standard USD $499 renewal fee. The candidates who avoid last-minute stress treat CPE collection as a steady habit rather than a final-year scramble: conference sessions, security research, and relevant training can all contribute, subject to GIAC's approval rules.
Check GIAC's CPE information and renewal guide for what counts and how to submit it, since acceptable activities and procedures are defined by the issuer. If you are weighing long-term value, our GMOB salary guide and GMOB jobs overview describe the roles where the credential tends to matter, such as mobile application security testing, penetration testing, and mobile device security operations.
Key Takeaway
GMOB has two kinds of dates: the short 120-day attempt window and the long four-year validity cycle. Plan the first around your index and practice work, and the second around steady CPE accumulation.
Frequently Asked Questions
No fixed national calendar is published. You register for an attempt, activate it, and then book a Pearson VUE onsite or ProctorU remote appointment within your 120-day completion window, subject to attempt-specific eligibility.
Each attempt must be completed within 120 days of activation. Plan to test with at least a week of buffer before the window closes so a reschedule or technical issue does not cost you the attempt.
A certification attempt is USD $999 and a retake is USD $899, excluding applicable sales tax. The official practice exam is USD $399, and SANS training tuition is separate. See the full cost breakdown for details.
There are no formal certification prerequisites, and training is optional though recommended. SEC575 suggests programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge, but those are course recommendations, not GIAC eligibility rules. See GMOB requirements for more.
Certification is valid for four years. Before it expires, earn 36 approved CPE credits during that period or take a renewal exam, and pay the standard USD $499 renewal fee. Start collecting CPEs early rather than in the final months.