GMOB Passing Score 2026: Exactly What You Need to Pass

The Number: 71% on 75 Questions

The GIAC Mobile Device Security Analyst (GMOB) exam has a minimum passing score of 71%. The exam is a single proctored, web-based test with 75 total questions and a 2-hour time limit. Those three facts frame everything else about how you should prepare, pace yourself, and organize your reference materials.

Two details are worth noting up front. First, the 71% passing-standard notice applies to exam versions released on or after December 24, 2016, which covers any version you are likely to be assigned today. Second, GIAC states that the objectives, format, and passing score shown on your assigned attempt page at exams.giac.org/pages/attempts take precedence over any other source. Always confirm your own attempt details before test day.

If you are still deciding whether to pursue the credential at all, our breakdown of how hard the GMOB exam is and the GMOB eligibility requirements cover the surrounding questions. This article stays focused on the score itself.

What 71% Means in Practice

On a 75-question exam, the 71% standard translates into a specific target. Multiplying 75 by 0.71 gives 53.25, so a candidate must answer at least 54 questions correctly to meet the minimum, assuming every question carries equal weight. That leaves room for roughly 21 missed questions. GIAC does not publicly document its exact scoring mechanics beyond the percentage, so treat 54 as a working planning figure rather than an official cutoff.

The practical implication is that you are not aiming for mastery of every obscure command-line flag or file path. You are aiming for broad, reliable competence across mobile security topics, with enough indexed reference material to recover on questions where your memory falls short.

Pacing matters as much as accuracy. Two hours for 75 questions works out to a little over one and a half minutes per question on average. Scenario-style items that ask you to interpret tool output or choose the right analysis step will consume more time than definitional ones, so bank time on the quick questions and avoid burning it on a single stubborn item.

Why the 11 Domains Carry No Published Weights

GIAC lists 11 objective headings for GMOB, reproduced here in the issuer's published order. Importantly, no official percentage weights are published for these headings. That means you cannot reliably budget your study time by assuming one domain accounts for a fixed share of the 75 questions.

1. Analyzing Mobile Applications
2. Attacking Encrypted Traffic
3. Managing Android Devices and Applications
4. Managing iOS Devices and Applications
5. Manipulating Mobile Application Behavior
6. Manipulating Network Traffic
7. Mitigating Against Mobile Malware
8. Mitigating Against Stolen Mobile Devices
9. Mobile Application Security Assessments
10. Reverse Engineering Mobile Applications
11. Unlocking and Rooting Mobile Devices

Because you need roughly 71% overall rather than 71% in each domain, a weak area does not automatically fail you. But with no weights published, a domain you skip entirely could plausibly cost you a meaningful number of questions. The safer reading is that every heading is fair game. For a deeper walk-through of each area, see our complete guide to all 11 GMOB content areas.

Exam Conditions That Affect Your Score

The rules of the exam environment directly shape how you reach 71%. These are the conditions GIAC publishes for GMOB:

• Proctored delivery. The exam is taken through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility.
• Open book, with limits. Hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
• No changing answers. Submitted answers cannot be changed, so confirm each response before moving on.
• Break time. You get 15 minutes of break time.

The prohibition on materials resembling practice or exam questions and answers is worth taking seriously. Your allowed notes should consist of concepts, command references, and your own explanations, not copied question banks. For a quick pre-exam sanity check on the facts above, the GMOB cheat sheet is a useful companion.

Building an Open-Book Index That Protects Your Score

Because the exam is open book, a well-built index is effectively a scoring tool. Candidates who treat it as an afterthought often discover that they know the material but cannot locate it within the time limit.

Index by question trigger, not by chapter

Organize entries around the phrases a question is likely to use: a tool name, an error condition, a file location, a platform feature. When a question mentions certificate pinning or an application sandbox, you want one lookup to land you on the right page.

Separate Android from iOS

Android and iOS differ in how apps are packaged, signed, stored, and inspected. Questions in the platform-management and reverse engineering areas often hinge on which platform is being discussed. Tag every index entry with the platform so you do not pull an Android answer for an iOS question.

Preparation sources

SANS Institute's SEC575, "iOS and Android Application Security Analysis and Penetration Testing," is the preparation course tied to this certification. Its sections are an unweighted curriculum and do not establish exhaustive exam coverage. Note also that the live SEC575 page references Android 14 and iOS 17, while its linked brochure references Android 12 and iOS 15. Those platform examples conflict with each other and do not identify which version your assigned exam draws on, so rely on your attempt page for scope rather than assuming either version.

Training is optional and recommended, not required. SEC575 suggests programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge, but those are course recommendations rather than GIAC eligibility rules. Our GMOB training overview and the GMOB study guide explain how to build your materials around the course.

Domain Readiness Checklist

Since weights are unpublished, the most defensible plan is to reach a baseline in all 11 areas and then deepen the ones where you are weakest. If you want a sequenced plan, here is one tied to the objective list rather than to generic study habits.

Revisit the weakest domain in a final review pass and run timed practice so the 2-hour limit feels familiar. You can use the GMOB practice tests to check how your accuracy compares with the roughly 54-correct working target.

The 120-Day Window and What a Retake Costs

Your attempt must be completed within 120 days from activation. That window is a real constraint on your study calendar: activate your attempt when you are close to ready, not months before. Our GMOB exam dates and scheduling guide goes deeper on timing.

These prices exclude applicable sales tax, and SANS training tuition is separate. The retake fee is lower than the initial attempt, but it is still a substantial cost, which is a strong argument for making your first attempt count. For the full financial picture, see the GMOB certification cost breakdown.

What Your Passing Result Gets You

Passing earns the GIAC Mobile Device Security Analyst credential, which is valid for four years. To renew, you need 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the standard $499 renewal fee.

The credential is aimed at practitioners who assess and secure mobile applications and devices, such as penetration testers, application security analysts, and mobile security engineers. If you are weighing the payoff, our GMOB ROI analysis, the salary guide, and the GMOB jobs overview lay out the career side without relying on inflated numbers.

A passing score is a pass or fail threshold, not a ranking. Whether you clear 71% narrowly or comfortably, the credential you receive is the same, so there is no need to chase a high score once you have cleared the standard. If you want to understand how the pass standard relates to real-world outcomes, see our discussion of the GMOB pass rate.

Frequently Asked Questions

For related background, see what GMOB certification is, or return to the main GMOB Exam Prep practice site to start testing yourself against the 71% standard.