- The Short Answer: What GMOB Stands For
- Who Issues the Credential
- What the Credential Actually Proves
- The 11 Objective Areas Behind the Name
- How the Exam Is Built
- Fees, Scheduling, and Attempt Windows
- Validity and Renewal
- Who Benefits From Holding GMOB
- Preparation Path Tied to the Domains
- A Caution About the Acronym
- Frequently Asked Questions
- GMOB means GIAC Mobile Device Security Analyst, a GIAC certification focused on Android and iOS security.
- The exam is one proctored session: 75 questions, 2 hours, 71% minimum to pass.
- GIAC's objective list contains 11 domains, from Analyzing Mobile Applications to Unlocking and Rooting Mobile Devices.
- The exam is open book with hardcopy materials only; internet access and personal electronic references are prohibited.
The Short Answer: What GMOB Stands For
GMOB is the exam code for the GIAC Mobile Device Security Analyst certification. The letters are a GIAC naming convention: the "G" marks it as a GIAC credential, and "MOB" signals the mobile device focus. If you have landed here after searching for the meaning, that is the whole answer in one sentence. The rest of this article explains what sits behind the name, because the title alone does not tell you what the exam demands or whether it fits your career.
For companion explanations written for the same search intent, see our pages on what GMOB stands for, the GMOB meaning, and what GMOB certification is. This article goes further by walking through the actual exam objectives and mechanics.
Who Issues the Credential
GMOB is issued by GIAC Certifications, which was formerly known as Global Information Assurance Certification and is administered by GIAC, LLC. GIAC is the certification body closely associated with SANS Institute training, although the two roles are distinct. SANS sells the courses; GIAC sells and administers the exams. That separation matters for budgeting, because course tuition and exam fees are billed independently.
The exam is delivered through Pearson VUE, either at a testing center or remotely through ProctorU, subject to the eligibility rules attached to your specific attempt. Always check the terms of your assigned attempt on the GIAC attempts page, since that page takes precedence over any general summary, including this one.
What the Credential Actually Proves
GMOB is a hands-on-oriented analyst credential for people who assess and defend mobile platforms. It tests whether you understand how Android and iOS security models work, how mobile applications can be analyzed and attacked, and how organizations reduce mobile risk. The scope spans offensive techniques (traffic interception, runtime manipulation, reverse engineering, rooting and unlocking) and defensive practice (malware mitigation, stolen-device risk, device and application management).
If you want to weigh whether that mix is worth the investment, our GMOB ROI analysis covers the decision in detail.
The 11 Objective Areas Behind the Name
GIAC publishes the exam objectives as 11 headings. The list below reproduces them in the published order. GIAC does not publish percentage weights for these headings, so treat them as an unweighted map of what can appear rather than a guide to how many questions each area carries. A fuller breakdown lives in our complete guide to all 11 GMOB content areas.
| # | Domain | Theme |
|---|---|---|
| 1 | Analyzing Mobile Applications | Examining app behavior and structure |
| 2 | Attacking Encrypted Traffic | Defeating transport protections for analysis |
| 3 | Managing Android Devices and Applications | Android platform administration and controls |
| 4 | Managing iOS Devices and Applications | iOS platform administration and controls |
| 5 | Manipulating Mobile Application Behavior | Runtime and logic tampering |
| 6 | Manipulating Network Traffic | Interception and modification of app traffic |
| 7 | Mitigating Against Mobile Malware | Defending against malicious apps |
| 8 | Mitigating Against Stolen Mobile Devices | Reducing data exposure from loss or theft |
| 9 | Mobile Application Security Assessments | Structured assessment, including MASVS |
| 10 | Reverse Engineering Mobile Applications | Decompiling and understanding app internals |
| 11 | Unlocking and Rooting Mobile Devices | Bypassing platform restrictions for analysis |
How the domains cluster
Reading the list as a candidate, three natural clusters emerge. Understanding them makes the title feel less abstract.
Platform fundamentals: Domains 3, 4, and 11
You need a working grasp of how Android and iOS enforce their security models, how devices and apps are managed, and what changes when a device is unlocked or rooted.
- Know the differences between the two platforms' trust and sandboxing approaches.
- Understand why rooting or unlocking is both an analyst tool and a risk indicator.
- Be able to reason about management controls on each platform.
Application and traffic analysis: Domains 1, 2, 5, 6, and 10
This is the offensive-technique core: static and dynamic analysis, reverse engineering, behavior manipulation, and interception of network communications, including encrypted traffic.
- Practice the logic of static versus dynamic analysis, not just tool names.
- Understand how and why traffic interception works against encrypted channels.
- Be comfortable reasoning about what an attacker can alter at runtime.
Risk, assessment, and defense: Domains 7, 8, and 9
These areas turn technique into organizational value: handling malware, planning for stolen devices, and conducting assessments against a recognized standard.
- Connect each attack technique to a mitigation you could recommend.
- Know what MASVS is for and how it frames an assessment.
- Think in terms of data exposure when a device leaves your control.
How the Exam Is Built
The GMOB exam is a single proctored, web-based test with 75 questions and a 2-hour time limit. The minimum passing score is 71%. The 71% standard applies to exam versions released on or after December 24, 2016, and your own attempt's terms are the final authority. For more on scoring, see our passing score breakdown.
Several rules shape how you should prepare:
- Open book, with limits. Hardcopy books, notes, and an index are allowed. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
- No changing answers. Submitted answers cannot be changed, so you cannot return to revise a response after submitting it.
- Break time. You are allowed 15 minutes of break time.
- No formal prerequisites. There are no formal certification prerequisites, and training is optional but recommended.
For a candid look at difficulty, read how hard the GMOB exam is. GIAC does not publish a pass rate in the materials we verified, so we do not quote one here; our pass rate article discusses what can and cannot be said responsibly.
Fees, Scheduling, and Attempt Windows
| Item | Detail |
|---|---|
| Certification attempt | USD $999 |
| Retake | USD $899 |
| Official practice exam | USD $399 |
| Renewal fee | USD $499 |
| Completion window | 120 days from activation |
| Taxes | Prices exclude applicable sales tax |
| SANS training tuition | Separate from exam fees |
The 120-day window begins when your attempt is activated, so plan your reading and index-building before you activate rather than after. Our scheduling and deadlines guide explains how to time activation, and the pricing breakdown shows how the fee components stack up alongside optional training.
On eligibility, there are no formal prerequisites for the certification itself. That is separate from course recommendations: SANS recommends programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge for its SEC575 course. Those are advice for course success, not conditions for sitting the exam. Details are in our requirements guide.
Validity and Renewal
A GMOB certification is valid for four years. To renew, you earn 36 approved CPE credits during the active four-year period, or you pass a renewal exam, and in either case you pay the standard USD $499 renewal fee. Mobile platforms change quickly, so the renewal cycle is more than paperwork: it nudges you to stay current with new OS versions and attack techniques.
Who Benefits From Holding GMOB
The credential suits professionals whose work touches mobile platforms. Typical fits include penetration testers who assess mobile apps, application security engineers reviewing Android and iOS builds, security analysts responsible for mobile device risk, and enterprise teams that manage fleets of corporate and employee devices. Consultancies and organizations that ship consumer or employee-facing mobile apps are natural places where this skill set is applied.
We deliberately avoid quoting salary numbers here because none are established in the verified source material for this credential. For a qualitative discussion of earnings and role types, see the GMOB salary guide and our overview of GMOB jobs.
Preparation Path Tied to the Domains
The most commonly associated preparation source is the SANS course SEC575: iOS and Android Application Security Analysis and Penetration Testing. Its sections are an unweighted preparation curriculum; they do not establish exhaustive exam coverage. One practical wrinkle: the live course page references Android 14 and iOS 17, while its linked brochure references Android 12 and iOS 15. These conflicting platform examples do not tell you which version your assigned exam uses, so rely on the objective headings and your attempt terms rather than any single OS version.
If you take the training route, our GMOB training overview compares options. Either way, a domain-driven schedule works better than a linear read-through. Here is one sequencing idea built around the domain clusters:
Platform foundations
- Domains 3, 4, and 11: Android and iOS management, security models, rooting and unlocking.
- Start the index with platform-specific terms and concepts.
Application internals
- Domains 1 and 10: analyzing and reverse engineering apps.
- Index static and dynamic analysis techniques with page references.
Traffic and runtime manipulation
- Domains 2, 5, and 6: encrypted traffic attacks, behavior manipulation, network interception.
- Cross-reference each technique to the defensive control that counters it.
Defense, assessment, and practice
- Domains 7, 8, and 9: malware, stolen devices, MASVS-based assessments.
- Run timed practice at 75 questions in 2 hours and patch index gaps.
Adjust the pacing to your background, but keep the logic: platform knowledge first, because every later domain assumes it. Our full GMOB study guide expands this into a detailed plan, and the one-page cheat sheet is useful for a final skim. When you are ready to test yourself under realistic conditions, try the GMOB practice tests.
A Caution About the Acronym
Acronyms get reused across the certification world, and a search for "GMOB" may surface unrelated credentials, terms, or products. On this site, GMOB refers only to the GIAC Mobile Device Security Analyst certification described above. If you are comparing details such as fees, exam length, or objectives, confirm that every source you rely on is describing the GIAC credential, and verify against GIAC's own certification page and your attempt terms. Mixing facts from different credentials is a surprisingly easy way to plan an exam attempt around the wrong rules.
Key Takeaway
"GMOB" is shorthand for a specific, verifiable thing: a GIAC exam of 75 questions in 2 hours with a 71% minimum, covering 11 mobile-security domains. Anchor your preparation to that objective list and your assigned attempt terms, not to the acronym alone.
Frequently Asked Questions
GMOB is the exam code for the GIAC Mobile Device Security Analyst certification, issued by GIAC Certifications. It focuses on securing, analyzing, and assessing Android and iOS devices and applications.
Yes, with restrictions. Hardcopy books, notes, and an index are permitted, while internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
The exam has 75 questions with a 2-hour time limit, and the minimum passing score is 71%. Your assigned attempt's terms on the GIAC attempts page take precedence if anything differs.
No. There are no formal certification prerequisites, and training is optional but recommended. The SEC575 course suggests programming, Linux, and penetration-testing familiarity, but those are course recommendations rather than eligibility requirements.
It is valid for four years. You renew by earning 36 approved CPE credits during that period or by taking a renewal exam, plus paying the standard USD $499 renewal fee.
Still comparing similar questions? Our pages on what GMOB is and the GMOB certification cover related angles of the same topic.