- What "GMOB Training" Actually Covers
- The SEC575 Route and What It Teaches
- Turning the 11 Domains Into Hands-On Skills
- Building a Practice Lab for Mobile Analysis
- Training for an Open-Book Exam
- Course, Self-Study, or Both?
- Sequencing Your Training by Domain
- Money, Windows, and Exam-Day Mechanics
- After the Course: Practice Exams and Gap Checks
- Frequently Asked Questions
- GIAC lists no formal prerequisites for GMOB; training is optional but recommended, and SANS SEC575 is the primary course.
- The exam has 75 questions, a 2-hour limit, and a 71% minimum passing score.
- The objectives span 11 domains, from Analyzing Mobile Applications to Unlocking and Rooting Mobile Devices, with no published weights.
- The exam is open book with hardcopy materials only, so an index you build during training is a real asset.
What "GMOB Training" Actually Covers
When people search for GMOB training, they usually mean one of three things: a formal SANS course, a self-built lab curriculum, or a blend of both. Whichever route you choose, the target is the same credential: the GIAC Mobile Device Security Analyst (GMOB), issued by GIAC Certifications and aimed at practitioners who assess, attack, and defend mobile devices and applications on Android and iOS.
GIAC does not require any training to sit the exam. Its certification page lists no formal prerequisites, and training is described as optional and recommended. That distinction matters for planning, and our breakdown of GMOB requirements, eligibility, and prerequisites covers it in detail. In practice, the skills the exam measures are hands-on and tool-driven, so most candidates find that structured training shortens the road considerably.
If you are still orienting yourself to the credential, What Is GMOB Certification? gives the high-level picture. This article focuses on the practical question: how should you train so that you can pass?
The SEC575 Route and What It Teaches
The preparation course tied to this certification is SANS SEC575, "iOS and Android Application Security Analysis and Penetration Testing." It is the course most candidates mean when they talk about GMOB training, and it is the one the objectives most closely track. SANS tuition is billed separately from GIAC's exam fees, which is worth remembering when you read our GMOB certification cost breakdown.
SEC575 recommends a few background skills before you enroll:
- Programming experience, since you will read and modify code and scripts.
- Basic Linux and terminal familiarity, because much of the tooling lives on the command line.
- Some penetration-testing knowledge, so that concepts like proxying traffic and exploiting weaknesses are not brand new.
These are course recommendations, not GIAC eligibility rules. You can register for the exam without any of them, but you will study more efficiently if you close obvious gaps first.
Another important caveat: SEC575's sections are preparation curriculum, not an official map of the exam. They do not establish exhaustive exam coverage. Use the course to build skills, and use GIAC's published objectives to decide what you must be able to answer.
Turning the 11 Domains Into Hands-On Skills
GIAC publishes 11 objective headings for GMOB, in alphabetical order, without percentage weights. Because no weights are published, you cannot safely skip any domain on the assumption that it is lightly tested. Our complete guide to all 11 GMOB content areas walks through each heading; below is how to translate the headings into training activities.
Analyzing Mobile Applications & Reverse Engineering Mobile Applications
These two domains form the static-analysis backbone of the exam. Training should have you taking apart real application packages rather than reading about them.
- Unpack Android and iOS app packages and inspect their structure, manifests, and resources.
- Decompile and read code to find hardcoded secrets, insecure storage, and weak logic.
- Practice recognizing what an app does from its artifacts alone.
Manipulating Mobile Application Behavior
Dynamic analysis is where you change how a running app behaves.
- Hook running processes to observe and alter function behavior.
- Bypass client-side checks and controls during testing.
- Learn to reason about which controls an attacker on a rooted or jailbroken device can defeat.
Manipulating Network Traffic & Attacking Encrypted Traffic
Mobile apps are chatty, and interception is a core assessment skill.
- Route device traffic through an intercepting proxy and read API calls.
- Understand why encrypted traffic resists inspection and how testers work around certificate validation.
- Know how weak transport protections surface in findings.
Managing Android Devices and Applications & Managing iOS Devices and Applications
These platform domains test whether you understand each operating system's security model, not just its tools.
- Compare how Android and iOS handle permissions, sandboxing, and app signing.
- Understand enterprise management concepts and their security implications.
- Be ready to contrast the two platforms, since questions often hinge on a platform-specific behavior.
Mitigating Against Mobile Malware & Mitigating Against Stolen Mobile Devices
These are the defensive domains, and candidates with a purely offensive background sometimes underestimate them.
- Study how mobile malware is delivered, what it targets, and how it is contained.
- Review controls that limit the damage when a device is lost or stolen, such as encryption and remote response.
Mobile Application Security Assessments
GIAC's outcome statement for this heading explicitly names the Mobile Application Security Verification Standard (MASVS). That is a strong signal to learn the MASVS control categories and practice mapping findings to them.
- Walk an app through a structured assessment rather than an ad hoc poke.
- Practice describing findings against a recognized verification standard.
Unlocking and Rooting Mobile Devices
Training here covers how testers gain privileged access to devices, and what that access exposes.
- Understand the purpose and risks of rooting and jailbreaking for testing.
- Know how these states change the security assumptions of installed apps.
Building a Practice Lab for Mobile Analysis
The single biggest accelerator for GMOB training is a lab where you can break things safely. You do not need an elaborate setup, but you do need both platforms represented, because the exam treats Android and iOS as co-equal.
Minimum viable lab
- An analysis workstation running a Linux environment with a terminal you are comfortable in.
- An Android test target, either an emulator or a dedicated device you are willing to root.
- An iOS test target, ideally a dedicated device you can use for jailbreak-style testing, since iOS emulation is more limited.
- An intercepting proxy to capture and modify traffic between the device and the internet.
- Deliberately vulnerable practice apps that let you find real flaws legally.
Training for an Open-Book Exam
GMOB permits hardcopy books, notes, and an index. It prohibits internet access, personal electronic references, and any materials resembling practice or exam questions and answers. That last restriction is easy to overlook: you cannot bring in anything that looks like leaked or reproduced test items, so build your reference from course material and your own lab notes.
The format is one proctored, web-based exam with 75 questions and a 2-hour limit, which works out to well under two minutes per question. Submitted answers cannot be changed, and you get 15 minutes of break time. Open book does not mean easy; it means the exam rewards candidates who can find the right page quickly and who already understand the material well enough to recognize what a question is really asking. For a candid look at difficulty, see How Hard Is the GMOB Exam?
Key Takeaway
Train as if the book will not save you, then build the book anyway. With 75 questions in 2 hours and no ability to change submitted answers, speed of recall matters more than speed of lookup. Use your index to confirm, not to learn on the spot.
What a good index looks like for this exam
- Organized by the 11 domain headings, with a secondary alphabetical topic list.
- Entries pointing to book and page for each tool, technique, and platform concept.
- Quick-reference tables for Android versus iOS security behaviors.
- A short section for MASVS categories, given that the objectives name the standard directly.
If you want a condensed review companion once your index is drafted, our GMOB cheat sheet is a useful cross-check for must-know facts.
Course, Self-Study, or Both?
There is no single right answer. The comparison below summarizes the tradeoffs for this particular credential.
| Approach | Strengths | Tradeoffs |
|---|---|---|
| SANS SEC575 course | Structured curriculum aligned to the subject area, guided labs, and course books that double as exam references | Tuition is separate from GIAC's exam fees; course platform examples may not match your exam version |
| Self-directed lab study | Flexible pacing, lower direct cost, deep familiarity with tools you assemble yourself | You must map the 11 objectives to practice yourself and build your own reference materials |
| Course plus focused self-study | Guided foundation plus targeted reinforcement of weak domains | Highest total time and cost commitment |
Candidates with strong mobile security backgrounds sometimes go straight to the exam after reviewing the objectives. Newer practitioners generally benefit from the guided labs. If you are weighing whether the whole investment makes sense for your career, Is the GMOB Certification Worth It? and the GMOB salary guide examine the return, and GMOB Jobs looks at who hires for these skills.
Sequencing Your Training by Domain
The only study-planning advice worth giving here is about order. Because the objectives are listed alphabetically rather than by dependency, working top to bottom is not the best route. A sequence that builds knowledge in layers tends to work better:
Platform foundations
- Managing Android Devices and Applications
- Managing iOS Devices and Applications
- Establish the security models everything else builds on.
Static analysis
- Analyzing Mobile Applications
- Reverse Engineering Mobile Applications
- Practice reading app internals before you try to change them.
Dynamic analysis and traffic
- Manipulating Mobile Application Behavior
- Manipulating Network Traffic
- Attacking Encrypted Traffic
- Unlocking and Rooting Mobile Devices
Defense and structured assessment
- Mitigating Against Mobile Malware
- Mitigating Against Stolen Mobile Devices
- Mobile Application Security Assessments, including MASVS
Rooting and jailbreaking sit in Phase 3 because the dynamic techniques usually depend on a privileged test device. Assessments come last because they synthesize everything before them. For a broader weekly framework, see our GMOB study guide.
Money, Windows, and Exam-Day Mechanics
Training decisions interact with the exam's logistics, so plan them together.
- Fees: The certification attempt is USD $999, a retake is USD $899, and the official practice exam is USD $399. Prices exclude applicable sales tax, and SANS tuition is separate.
- Attempt window: You have 120 days from activation to complete your attempt, so do not activate until your preparation is largely done. See GMOB exam dates and scheduling for how timing works.
- Proctoring: Testing is available through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility.
- Passing score: The minimum is 71%. Our GMOB passing score guide explains how that applies to your attempt, and GIAC's attempt page takes precedence if details differ.
- Validity and renewal: The certification is valid for four years. Renewal takes 36 approved CPE credits earned during that period, or a renewal exam, plus the standard USD $499 renewal fee.
After the Course: Practice Exams and Gap Checks
Finishing a course is not the same as being exam-ready. Once your labs and index are in good shape, test yourself under realistic conditions: 75 questions, 2 hours, only the references you plan to bring. Timed practice reveals two things training alone cannot, namely which domains you answer slowly and which index entries you never actually find in time.
GIAC sells an official practice exam for USD $399, which is useful for judging readiness against the real format. You can also run additional timed sets on our GMOB practice test site. After each session, sort your misses by domain, return to the lab for the weakest area, and fix your index entries as you go. If your scores are inconsistent, the GMOB pass rate discussion offers realistic context on how to interpret your results, and a few more sets on our practice platform can confirm whether you are ready to activate your attempt.
Training for GMOB rewards candidates who treat it as a craft: break real apps, read real traffic, and write down what you learn in a form you can retrieve under time pressure. Do that across all 11 domains, and the exam becomes a structured demonstration of skills you already use.
Frequently Asked Questions
No. GIAC lists no formal certification prerequisites, and training is optional but recommended. SEC575 is the main associated preparation course, but you may prepare through other means, including self-directed lab work.
No. SANS tuition is separate from GIAC's certification attempt fee of USD $999. A retake costs USD $899, and the official practice exam is USD $399, with prices excluding applicable sales tax.
GIAC publishes 11 domains: Analyzing Mobile Applications, Attacking Encrypted Traffic, Managing Android Devices and Applications, Managing iOS Devices and Applications, Manipulating Mobile Application Behavior, Manipulating Network Traffic, Mitigating Against Mobile Malware, Mitigating Against Stolen Mobile Devices, Mobile Application Security Assessments, Reverse Engineering Mobile Applications, and Unlocking and Rooting Mobile Devices. No official weights are published.
Yes, in hardcopy form. The exam is open book with books, notes, and an index permitted. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
You have 120 days from activation to complete the attempt. The exam itself is 75 questions in 2 hours, with a minimum passing score of 71%, and answers cannot be changed once submitted. Confirm your assigned attempt's details on GIAC's attempt page, which takes precedence.