- The Short Answer: GIAC Mobile Device Security Analyst
- Breaking Down Each Word in the Name
- Who Issues It: GIAC and the SANS Connection
- What the Credential Actually Covers
- The 11 Objective Headings, Explained
- How the Exam Is Built
- Fees, Timing, and Validity
- Who Pursues This Credential
- Sequencing Your Prep Around the Domains
- Avoiding Acronym Confusion
- Frequently Asked Questions
- GMOB stands for GIAC Mobile Device Security Analyst, a credential issued by GIAC Certifications.
- The exam is one proctored, open-book test: 75 questions, 2 hours, 71% minimum to pass.
- GIAC publishes 11 objective headings, from Analyzing Mobile Applications to Unlocking and Rooting Mobile Devices.
- A certification attempt costs USD $999, and the credential stays valid for four years.
The Short Answer: GIAC Mobile Device Security Analyst
GMOB stands for GIAC Mobile Device Security Analyst. It is a professional certification that validates a candidate's ability to assess, attack, and defend mobile devices and mobile applications, with a focus on the two dominant platforms, Android and iOS. If you have landed here after seeing the four-letter acronym on a job posting, a course page, or a colleague's email signature, that is the credential being referenced throughout this site.
The acronym is built from the first letters of the credential family and its subject: the "G" comes from GIAC, the "MOB" from "mobile." That is how GIAC names many of its credentials, pairing a "G" with a short subject abbreviation. For a deeper look at how this naming plays out in practice, see our companion pieces on GMOB meaning and what GMOB is.
Breaking Down Each Word in the Name
The full title is more informative than the acronym, and each word signals something about what the exam rewards.
GIAC
The issuing body. GIAC Certifications was formerly known as Global Information Assurance Certification, and the credential is administered by GIAC, LLC. The name matters because it tells you the exam is a vendor-neutral, skills-focused assessment rather than a product certification tied to one device maker.
Mobile Device
The subject platform. "Mobile device" here means smartphones and tablets running Android and iOS. The exam objectives do not stop at the device itself; they extend to the applications installed on it, the traffic those applications send, the malware that targets them, and the risks created when a device is lost or stolen.
Security Analyst
The role the credential aims to validate. An analyst is expected to examine, test, and recommend, not just configure. That is why the objective headings lean heavily toward verbs such as analyzing, attacking, manipulating, mitigating, and reverse engineering.
Who Issues It: GIAC and the SANS Connection
GIAC administers the exam. SANS Institute, a separate organization, offers the training most commonly associated with it. The preparation source tied to this credential is SANS SEC575, "iOS and Android Application Security Analysis and Penetration Testing." The two are related in practice, but they are distinct: GIAC certifies, SANS trains, and training tuition is billed separately from the exam fee.
Training is optional and recommended rather than required. If you are weighing whether to take the course, our GMOB training overview covers the options, and the GMOB requirements guide explains what eligibility actually looks like.
What the Credential Actually Covers
Understanding what the letters stand for is only the first step. The more useful question is what the credential tests. According to GIAC's published objectives, the scope spans Android and iOS security, static and dynamic application analysis, traffic interception, malware, and stolen-device risk. The objective heading "Mobile Application Security Assessments" explicitly names the Mobile Application Security Verification Standard (MASVS) in its outcome statement, so familiarity with that standard is worth building.
Two observations help frame the scope:
- It is application-heavy. Several headings concern how apps behave, how they can be reverse engineered, and how their runtime behavior can be manipulated.
- It is traffic-aware. Two separate headings address encrypted and unencrypted network traffic, reflecting how much of mobile security depends on what leaves the device.
The 11 Objective Headings, Explained
GIAC lists 11 objective headings. These are reproduced in the issuer's published order and carry no official percentage weights, so you should not assume any one area dominates the exam. For a fuller walkthrough, see the complete guide to all 11 GMOB content areas. Below is a practical orientation to each.
Domains 1, 9 and 10: The Application Core
Analyzing Mobile Applications, Mobile Application Security Assessments, and Reverse Engineering Mobile Applications form the heart of the credential.
- Static analysis examines an app's code and packaging without running it.
- Dynamic analysis observes the app while it executes.
- Assessments are framed around MASVS, so know how that standard organizes security requirements.
- Reverse engineering asks you to understand app internals well enough to reason about weaknesses.
Domains 2 and 6: Network Traffic
Attacking Encrypted Traffic and Manipulating Network Traffic address what mobile apps transmit and how an analyst can observe or alter it.
- Interception is a core assessment technique for mobile apps.
- Encrypted traffic raises distinct challenges compared with cleartext traffic.
- Expect to reason about how apps trust, or fail to validate, the connections they make.
Domains 3 and 4: Platform Management
Managing Android Devices and Applications and Managing iOS Devices and Applications cover the two platforms individually.
- Each platform has its own security model, app packaging, and permission behavior.
- Candidates should be comfortable moving between both ecosystems rather than specializing in one.
Domains 5 and 11: Hands-On Manipulation
Manipulating Mobile Application Behavior and Unlocking and Rooting Mobile Devices cover techniques that give an analyst deeper access.
- Altering app behavior at runtime is central to dynamic testing.
- Unlocking and rooting concerns gaining the elevated access that thorough testing often requires.
Domains 7 and 8: Defensive Risk
Mitigating Against Mobile Malware and Mitigating Against Stolen Mobile Devices focus on protection rather than attack.
- Malware coverage addresses how threats reach and behave on mobile devices.
- Stolen-device risk covers what happens to data and access when physical control is lost.
How the Exam Is Built
The GMOB exam is a single proctored, web-based test. Here is how the structure breaks down:
| Feature | Detail |
|---|---|
| Questions | 75 total |
| Time limit | 2 hours |
| Minimum passing score | 71% |
| Open-book policy | Hardcopy books, notes, and an index allowed |
| Prohibited | Internet access, personal electronic references, materials resembling practice or exam questions and answers |
| Answer changes | Submitted answers cannot be changed |
| Breaks | 15 minutes of break time allowed |
| Delivery | Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
The open-book rule is the detail that most shapes preparation. Because you may bring hardcopy books, notes, and an index, many candidates build a personal index keyed to the 11 domains so they can locate material quickly. Because answers cannot be changed once submitted, there is no room for a "come back later" strategy on individual items. Details on scoring are in our GMOB passing score breakdown, and for a sense of the challenge, see how hard the GMOB exam is.
Fees, Timing, and Validity
Knowing the logistics helps you plan. These figures come from GIAC's published pricing and exclude applicable sales tax:
- Certification attempt: USD $999
- Retake: USD $899
- Official practice exam: USD $399
- Renewal fee: USD $499 (standard)
Once your attempt is activated, you have a 120-day window to complete it. After you pass, the certification remains valid for four years. Renewal requires either 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the renewal fee. SANS training tuition is separate from all of the above. The full GMOB certification cost breakdown and the GMOB exam dates and scheduling guide go deeper on budgeting and timing.
Who Pursues This Credential
Because the name includes "security analyst," it is natural to ask which jobs the credential supports. The objective list points toward roles where someone must evaluate mobile apps and devices for weaknesses:
- Application security and penetration testing roles that include mobile assessments alongside web and network work.
- Security engineers responsible for reviewing the mobile apps their organization builds or deploys.
- Incident response and forensics staff who encounter compromised or stolen phones.
- Mobile administrators and enterprise security teams managing fleets of Android and iOS devices and weighing malware and lost-device risk.
SEC575 recommends programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge. Those are course recommendations, not GIAC eligibility rules, since the certification itself has no formal prerequisites. For employer-side detail, see GMOB jobs, and for compensation context see the GMOB salary guide. If you are deciding whether the investment pays off, the ROI analysis can help.
Sequencing Your Prep Around the Domains
Rather than a generic schedule, it helps to order the domains by dependency: later topics assume you already understand earlier ones. One reasonable sequence follows.
Platform foundations
- Managing Android Devices and Applications
- Managing iOS Devices and Applications
- Learn how each platform packages and secures apps, since everything later builds on this.
Application analysis
- Analyzing Mobile Applications
- Reverse Engineering Mobile Applications
- Practice static versus dynamic approaches and note which tools fit each.
Traffic and runtime manipulation
- Manipulating Network Traffic
- Attacking Encrypted Traffic
- Manipulating Mobile Application Behavior
- Unlocking and Rooting Mobile Devices
Assessment and defense
- Mobile Application Security Assessments, including MASVS
- Mitigating Against Mobile Malware
- Mitigating Against Stolen Mobile Devices
- Finish your open-book index and run timed practice.
Because the exam is open book, the final week should go toward refining your index so you can find topics fast under a 2-hour limit. For a full plan, read the GMOB study guide and keep the GMOB cheat sheet handy for quick review. You can also test yourself with timed questions on our GMOB practice test site.
Avoiding Acronym Confusion
Short acronyms are rarely unique, and "GMOB" is no exception. Other organizations and credentials have used similar letter combinations for different purposes. On this site, and throughout this article, GMOB refers only to the GIAC Mobile Device Security Analyst certification described above. When you research the credential, check that any fee, exam length, or objective list you find names GIAC as the issuer and mentions Android and iOS security. If a source cites a different certifying body, it is describing something else.
Key Takeaway
When verifying any GMOB fact, confirm the source names GIAC and the GIAC Mobile Device Security Analyst title. Use GIAC's own certification page and your assigned attempt page as the final authority on objectives, format, and scoring.
For additional phrasing variations people search for, see our pages on what GMOB stands for, what GMOB means, what a GMOB is, and what GMOB certification is. For a broader look at the credential itself, visit GMOB certification, and explore pass-rate context in what the data shows on GMOB pass rates. When you are ready to practice, the GMOB Exam Prep homepage is the place to start.
Frequently Asked Questions
GMOB stands for GIAC Mobile Device Security Analyst. It is a certification issued by GIAC Certifications that validates skills in assessing and securing Android and iOS devices and applications.
No formal certification prerequisites exist. Training is optional and recommended. The related SANS SEC575 course suggests programming experience, basic Linux familiarity, and penetration-testing knowledge, but these are course recommendations rather than eligibility requirements.
The exam has 75 questions with a 2-hour time limit. The minimum passing score is 71%. It is a proctored, web-based, open-book exam, though internet access and personal electronic references are prohibited.
The certification is valid for four years. To renew, you need 36 approved CPE credits earned during that period or a renewal exam, plus the standard USD $499 renewal fee.
GIAC publishes 11 objective headings but no official percentage weights, so you should not assume any single area carries more weight. Prepare across all of them, with extra attention to application analysis and MASVS-based assessments.