- How GIAC Organizes the GMOB Objectives
- Exam Mechanics That Shape How You Study
- Application Analysis, Behavior, and Reverse Engineering
- Network Traffic and Encrypted Traffic Domains
- Android and iOS Management Domains
- Malware, Stolen Devices, and Rooting
- Mobile Application Security Assessments and MASVS
- Scheduling the 11 Domains Across Your Prep
- Building an Index Around the Domain Names
- Where These Skills Show Up in Jobs
- Frequently Asked Questions
- GIAC publishes 11 GMOB objective headings in a fixed order, and no official percentage weights accompany them.
- The exam is open book: 75 questions, 2 hours, 71% to pass, with hardcopy books and an index allowed.
- Domain 9, Mobile Application Security Assessments, explicitly names the Mobile Application Security Verification Standard (MASVS).
- Android and iOS each get their own management domain, so neither platform can be neglected.
How GIAC Organizes the GMOB Objectives
The GIAC Mobile Device Security Analyst (GMOB) certification is administered by GIAC Certifications and tests whether you can assess, attack, defend, and manage mobile devices and applications on both Android and iOS. GIAC lists its exam objectives under the heading "Exam Certification Objectives & Outcome Statements," and that list contains exactly 11 domain headings. This guide walks through each one in the order GIAC publishes them.
Two caveats matter before you plan your study time. First, GIAC does not publish percentage weights for these headings in the objective list, so any article claiming "Domain 6 is 14% of the exam" is inventing a number. Treat all 11 as unweighted and prepare for each. Second, the objective list does not carry a stated edition or publication date. The 71% passing standard applies to exam versions released on or after December 24, 2016, but that is a scoring notice, not the date of the objective list. Your assigned attempt's objectives, format, and passing score at the GIAC attempts page take precedence over everything you read elsewhere.
If you are new to the credential itself, our explainers on what GMOB certification is and what GMOB stands for cover the basics, and you can pressure-test your knowledge anytime on the GMOB practice test site.
| # | GIAC Objective Heading | Primary Skill Type |
|---|---|---|
| 1 | Analyzing Mobile Applications | Static and dynamic analysis |
| 2 | Attacking Encrypted Traffic | Network attack |
| 3 | Managing Android Devices and Applications | Platform administration and security |
| 4 | Managing iOS Devices and Applications | Platform administration and security |
| 5 | Manipulating Mobile Application Behavior | Runtime tampering |
| 6 | Manipulating Network Traffic | Interception and modification |
| 7 | Mitigating Against Mobile Malware | Defense |
| 8 | Mitigating Against Stolen Mobile Devices | Defense and policy |
| 9 | Mobile Application Security Assessments | Methodology and standards |
| 10 | Reverse Engineering Mobile Applications | Binary analysis |
| 11 | Unlocking and Rooting Mobile Devices | Device compromise |
Exam Mechanics That Shape How You Study
The domains only make sense in the context of how GMOB is delivered. The exam is a single proctored, web-based test with 75 questions and a 2-hour time limit. The minimum passing score is 71%. It is open book: you may bring hardcopy books, notes, and an index, but internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited. Submitted answers cannot be changed, and you are allowed 15 minutes of break time.
Testing runs through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility. You have 120 days from activation to complete your attempt. There are no formal certification prerequisites, and training is optional but recommended. For the full eligibility picture, see GMOB requirements, and for scoring details, see GMOB passing score.
Application Analysis, Behavior, and Reverse Engineering
Four of the 11 headings revolve around taking a mobile app apart: Analyzing Mobile Applications, Manipulating Mobile Application Behavior, Reverse Engineering Mobile Applications, and, in a methodological sense, Mobile Application Security Assessments. The first three are the hands-on core of the credential.
Domain 1: Analyzing Mobile Applications
Analyzing Mobile Applications
GIAC's objectives cover static and dynamic application analysis. Expect questions that ask what a given technique reveals and which tool category suits a situation.
- Static analysis: inspecting an application package without running it, including manifests, permissions, embedded resources, and hardcoded secrets
- Dynamic analysis: observing the app while it executes, including file system writes, local storage, logs, and inter-process communication
- Knowing the differences in package structure between Android and iOS applications
- Recognizing insecure data storage patterns such as plaintext credentials in app sandboxes
Domain 5: Manipulating Mobile Application Behavior
Manipulating Mobile Application Behavior
This domain is about changing what an app does at runtime or by modification, typically to bypass client-side controls.
- Runtime instrumentation and hooking concepts, and why client-side checks (such as jailbreak or root detection, or local authentication logic) are never a security boundary on their own
- Repackaging and modifying applications, and the signing implications on each platform
- Understanding how attackers bypass certificate validation or license checks inside an app
Domain 10: Reverse Engineering Mobile Applications
Reverse Engineering Mobile Applications
Where Domain 1 observes behavior, this domain interprets code.
- Decompilation and disassembly of Android and iOS application binaries
- Reading intermediate representations versus native code, and understanding what obfuscation does and does not prevent
- Locating sensitive logic: key handling, API endpoints, authentication flows
These three domains reward candidates with hands-on lab time. The SANS course most associated with this certification, SEC575: iOS and Android Application Security Analysis and Penetration Testing, is organized around exactly this kind of practice. Note that SEC575's sections are unweighted preparation curriculum and do not establish exhaustive exam coverage, so use it as a learning path rather than a syllabus guarantee. More on training options is in our GMOB training overview.
Network Traffic and Encrypted Traffic Domains
Two headings deal with traffic: Attacking Encrypted Traffic (Domain 2) and Manipulating Network Traffic (Domain 6). They are related but distinct, and exam questions often test whether you can tell them apart.
Domain 2: Attacking Encrypted Traffic
This domain focuses on defeating or sidestepping transport protections that mobile apps rely on.
- How TLS interception works with a proxy, and why the device must trust the proxy's certificate authority
- Certificate pinning: what it is, why it blocks naive interception, and how testers bypass it during an assessment
- Weak or misconfigured transport security, including apps that accept any certificate
Domain 6: Manipulating Network Traffic
Once you can see traffic, you can alter it. GIAC's objectives include traffic interception as a core skill.
- Configuring a device to route traffic through an intercepting proxy
- Modifying requests and responses to test server-side validation and business logic
- Handling non-HTTP protocols that a standard web proxy misses
Android and iOS Management Domains
Domains 3 and 4 give each platform its own heading: Managing Android Devices and Applications and Managing iOS Devices and Applications. This is a useful signal about the exam's philosophy. GMOB does not let you specialize in one operating system and skate by.
Android-Specific Ground
- The Android permission model, application sandboxing, and how components such as activities, services, and content providers can be exposed
- Debugging and device-communication tooling used to interact with a device from a workstation
- App signing, installation sources, and enterprise management concepts
iOS-Specific Ground
- The iOS security architecture, code signing, and the sandbox model
- Data protection and keychain behavior, including when stored items are accessible
- Enterprise deployment and device management concepts
Platform versions move quickly, and course materials reflect that. The live SEC575 page references Android 14 and iOS 17, while its linked brochure references Android 12 and iOS 15. Those conflicting examples do not identify which version your assigned exam tests, so concentrate on durable security concepts, such as sandboxing, signing, and permission models, rather than version-specific menu paths.
Malware, Stolen Devices, and Rooting
Three headings cover threats to the device itself, and notably they split into defense and offense.
Domain 7: Mitigating Against Mobile Malware
GIAC's objectives include malware as an explicit topic. Expect scenario questions about how malicious apps behave and how organizations contain them.
- Typical mobile malware behaviors: overlay attacks, excessive permission abuse, data exfiltration, and persistence
- Controls such as application vetting, restricting install sources, and mobile device management policies
- Indicators that analysis of a suspicious package should look for
Domain 8: Mitigating Against Stolen Mobile Devices
Stolen-device risk is named directly in GIAC's objectives. This is the policy-and-configuration domain.
- Full-device encryption, strong passcodes, and lock-screen and biometric considerations
- Remote lock and remote wipe, and their dependency on connectivity
- What an attacker with physical possession can realistically extract, and how configuration limits it
Domain 11: Unlocking and Rooting Mobile Devices
This is the offensive counterpart to Domain 8, and the two pair well when studied together.
- Bootloader unlocking, rooting on Android, and jailbreaking on iOS, including tethered versus untethered concepts
- The security trade-offs these processes introduce, such as disabled protections and increased attack surface
- Why a rooted or jailbroken device is a compliance concern in managed environments
A productive habit: for every protection in Domain 8, ask which technique in Domain 11 defeats it, and for every technique in Domain 11, ask which Domain 8 control reduces its impact. Exam questions frequently live in that overlap.
Mobile Application Security Assessments and MASVS
Domain 9, Mobile Application Security Assessments, is the structural heading that ties the technical domains together. GIAC's outcome statement for this objective explicitly names the Mobile Application Security Verification Standard (MASVS). That is a concrete, checkable fact, and it tells you something important: you should be comfortable thinking about assessments in terms of a verification framework, not just a pile of tools.
Mobile Application Security Assessments
This domain expects you to organize findings and testing into a repeatable methodology.
- Know what MASVS is for: a standard of security requirements used to verify mobile apps, and how its categories map to testing activities such as storage, cryptography, authentication, network communication, and platform interaction
- Connect static analysis, dynamic analysis, and traffic interception to the requirements they help verify
- Understand how to scope an assessment and report findings in a way developers can act on
Key Takeaway
Read the MASVS categories end to end before exam day and write a one-line mapping from each category to the technical domain (1, 2, 5, 6, 10) that tests it. That single page doubles as an index entry you can reach for when a question describes an assessment goal rather than a tool.
Scheduling the 11 Domains Across Your Prep
Because GIAC publishes no weights, sequence your study by dependency rather than by perceived importance. Here is one ordering that front-loads foundations and pairs offense with defense. For a broader plan, see our GMOB study guide.
Platform Foundations
- Domain 3 (Android) and Domain 4 (iOS): sandboxing, signing, permission and data-protection models
- Build your index skeleton by platform
Analysis Core
- Domain 1 (Analyzing), Domain 10 (Reverse Engineering), Domain 5 (Manipulating Behavior)
- Hands-on lab work with both platforms, since these domains depend on tool fluency
Traffic and Assessment Method
- Domain 6 (Manipulating Traffic), then Domain 2 (Attacking Encrypted Traffic)
- Domain 9 (Assessments) and MASVS mapping to tie everything together
Threats and Review
- Domain 7 (Malware), Domain 8 (Stolen Devices), Domain 11 (Unlocking and Rooting) studied as offense/defense pairs
- Timed practice sets to confirm you can answer in about 96 seconds per question
If your exam window is tight, remember the 120-day completion period from activation, and check GMOB exam dates and scheduling for how that interacts with testing availability.
Building an Index Around the Domain Names
Since hardcopy books, notes, and an index are permitted, structure your index so the 11 GIAC headings act as your top-level navigation. Under each heading, list topics, tool names, command syntax, and the page where each appears in your materials. Keep these principles in mind:
- Index by question trigger, not by chapter. A question that says "the app rejects the proxy certificate" should lead you to a "pinning" entry, wherever it lives in your books.
- Add cross-references between paired domains. Link Domain 8 entries to Domain 11 entries and Domain 2 to Domain 6.
- Prepare your own materials only. Anything that resembles practice or exam questions and answers is prohibited in the exam, so your index should hold your own notes and course-derived concepts rather than copied question banks.
- Verify the rules for your attempt. The GIAC proctored exam reference guide and your attempt page govern what is allowed on test day.
For a compact companion to your index, our GMOB cheat sheet summarizes must-know facts, and you can validate your retrieval speed with timed questions on the GMOB Exam Prep practice tests.
Where These Skills Show Up in Jobs
The domain list reads like a job description for several overlapping roles: mobile application penetration tester, application security engineer reviewing iOS and Android builds, enterprise mobility security analyst, and incident responder handling compromised or lost devices. Domains 1, 5, 6, 9, and 10 map most directly to offensive and assessment roles, while Domains 3, 4, 7, and 8 map to defensive and management roles. Domain 11 serves both sides.
Pay and demand vary by region, employer, and experience, and we do not publish unsourced figures here. If you want the earnings and career discussion, see GMOB salary guide, GMOB jobs, and whether GMOB is worth it. On the cost side, the certification attempt is USD $999, a retake is USD $899, and the official practice exam is USD $399, all excluding applicable sales tax and separate from SANS training tuition. The certification is valid for four years, and renewal requires 36 approved CPE credits or a renewal exam, plus the standard USD $499 renewal fee. Our GMOB certification cost breakdown covers the full picture, and how hard the GMOB exam is discusses difficulty in context.
Frequently Asked Questions
GIAC's published objective list for the GIAC Mobile Device Security Analyst (GMOB) contains 11 domain headings, from Analyzing Mobile Applications through Unlocking and Rooting Mobile Devices. GIAC does not publish percentage weights for them, so prepare for all 11.
Not in the public objective list. The headings appear unweighted, so you cannot reliably predict how many of the 75 questions come from any single domain. Balanced preparation across Android, iOS, analysis, traffic, and threat domains is the safest approach.
GIAC's outcome statement for the Mobile Application Security Assessments objective explicitly names the Mobile Application Security Verification Standard (MASVS). You should understand its purpose and how its requirement categories relate to testing activities.
Yes. The exam is open book with hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited, and submitted answers cannot be changed.
The minimum passing score is 71% on a 75-question exam with a 2-hour time limit and 15 minutes of allowed break time. Your assigned attempt page at exams.giac.org takes precedence if any detail differs from published summaries.
No. There are no formal certification prerequisites, and training is optional but recommended. SEC575 is a common preparation source, but its sections are unweighted curriculum and do not guarantee exhaustive exam coverage.