What Is A GMOB?

What a GMOB Actually Is

Search for the acronym and you may find several unrelated credentials sharing the same four letters. On this site, GMOB means one thing only: the GIAC Mobile Device Security Analyst certification. It validates that a practitioner can assess, attack, defend, and manage mobile devices and the applications that run on them, with a clear emphasis on both Android and iOS.

If you want the short version of the naming question, our companion pieces on what GMOB stands for and the meaning of GMOB cover the terminology. This article goes further: what the credential tests, how the exam is run, and what you need to know before you commit.

The credential is practitioner-oriented. It is not a general awareness certificate about "mobile security trends." The objective headings name concrete activities: analyzing mobile applications, manipulating network traffic, reverse engineering, unlocking and rooting devices, and mitigating malware. A candidate is expected to understand how those activities work technically, not merely define them.

Who Issues It and Who It Is For

GMOB is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. GIAC is the certification body most people associate with the SANS Institute's training ecosystem, though the two are distinct: SANS provides courses, while GIAC runs the proctored exams and grants the credentials.

There are no formal certification prerequisites. Anyone may register for an attempt. That said, the recommended preparation course, SANS SEC575, suggests programming experience, basic Linux and terminal familiarity, and some penetration-testing knowledge. Those are course recommendations, not GIAC eligibility rules. If you are weighing whether you qualify, see our guide to GMOB requirements and eligibility.

The people who tend to benefit most are those whose daily work touches mobile risk:

• Penetration testers who are adding mobile application assessments to their service lines
• Application security engineers reviewing iOS and Android builds before release
• Mobile device management and enterprise security staff who set policy for managed fleets
• Incident responders and analysts who deal with mobile malware or lost and stolen devices
• Reverse engineers curious about how mobile apps are packaged and protected

How the Exam Works

The mechanics are straightforward, and knowing them in advance removes a lot of test-day anxiety.

Two details deserve emphasis. First, the inability to change a submitted answer means you should commit only when you are ready, and use your index to resolve doubts before submitting. Second, the 120-day window starts at activation, so schedule your preparation backward from that date. Our GMOB exam dates and scheduling guide walks through the timing logistics, and the passing score breakdown explains how the 71% threshold plays out across 75 questions.

The 11 Domains in Plain Language

GIAC publishes its exam scope as 11 objective headings. Importantly, no official percentage weights are published for these headings, so you cannot safely skip any of them on the theory that a domain is "small." The headings, in GIAC's published order, are:

1. Analyzing Mobile Applications
2. Attacking Encrypted Traffic
3. Managing Android Devices and Applications
4. Managing iOS Devices and Applications
5. Manipulating Mobile Application Behavior
6. Manipulating Network Traffic
7. Mitigating Against Mobile Malware
8. Mitigating Against Stolen Mobile Devices
9. Mobile Application Security Assessments
10. Reverse Engineering Mobile Applications
11. Unlocking and Rooting Mobile Devices

Read as a whole, the list splits into three working clusters. For a deeper domain-by-domain treatment, see the complete guide to all 11 GMOB content areas.

Why Application Assessment Sits at the Core

GIAC's current objective heading is Mobile Application Security Assessments, and its outcome statement explicitly names the Mobile Application Security Verification Standard (MASVS). That naming matters for how you study. It signals that the exam expects you to think in terms of a structured assessment framework, not just ad hoc tricks.

In practice, this means a candidate should be comfortable moving between questions like these:

• What does static analysis of an application package reveal, and what does it miss?
• What can dynamic analysis observe at runtime that static review cannot?
• How does an analyst intercept an app's traffic, and what changes when the app protects that traffic?
• Given a finding, how does it map to a verification requirement?

The objectives also reach beyond application testing into Android and iOS security fundamentals, mobile malware, and stolen-device risk. A candidate who only practices app teardown will be exposed on the management and defense domains, and the reverse is equally true.

The SANS SEC575 Connection

The most commonly cited preparation path is SANS SEC575, titled "iOS and Android Application Security Analysis and Penetration Testing." Training is optional and recommended, never required, and tuition is separate from the exam fee. The course is a curriculum for building the skills, not a statement of exact exam coverage: its sections are unweighted and do not establish exhaustive exam scope or an official domain count.

One practical caution is version drift. The live SEC575 page references Android 14 and iOS 17, while its linked brochure references Android 12 and iOS 15. Neither tells you which platform versions your assigned exam reflects. Build understanding of underlying concepts, such as how each platform sandboxes apps, signs code, stores data, and handles trust, rather than memorizing version-specific menus or tool behavior that may change. Our GMOB training overview compares the preparation options in more detail.

Open Book Does Not Mean Easy

GMOB allows hardcopy books, notes, and an index. It prohibits internet access, personal electronic references, and any materials resembling practice or exam questions and answers. That last rule is the one candidates most often underestimate: a stack of printed practice-question dumps is not a legal study aid at your desk, and bringing one risks your attempt.

The real skill the open-book format rewards is retrieval speed. With 75 questions in 2 hours, you have well under two minutes per item on average. You cannot afford to hunt through a poorly organized pile of notes. A good index lets you locate a concept, a command pattern, or a platform behavior in seconds. Candidates who build the index as they study, rather than the night before, tend to retain far more because indexing forces them to categorize what they learn.

For a sense of how demanding this balance is, see how hard the GMOB exam really is. If you want a condensed refresher format, the GMOB cheat sheet distills the must-know facts, and you can pressure-test your recall with the practice questions on the main GMOB practice test site.

Fees, Validity, and Renewal

Budget matters, so here are the figures GIAC publishes. All prices exclude applicable sales tax.

SANS training tuition is separate and is not included in any of those numbers. If you plan to take the course, add it to your total. The GMOB certification cost breakdown lays out the full spending picture, and the ROI analysis helps you decide whether the investment fits your career plan.

Renewal rewards ongoing activity. Rather than treating the four-year mark as a cliff, many professionals log relevant CPE-eligible work such as conference attendance, training, and security research as they go, so that reaching 36 approved credits is a matter of record-keeping rather than a scramble.

Where the Credential Fits in Real Jobs

GMOB speaks to employers who need mobile-specific depth. Generalist security certifications often treat mobile as a single chapter; this credential treats it as the whole discipline. That makes it relevant in a few hiring contexts:

• Offensive security consultancies that sell mobile application penetration tests and want staff who can credibly scope and execute them
• Product and application security teams at organizations shipping iOS and Android apps
• Enterprise security and mobility teams responsible for managed device fleets, lost-device response, and malware defense
• Digital forensics and response groups that encounter compromised or stolen mobile devices

We do not publish invented hiring statistics here. For a grounded look at the market, our GMOB jobs overview and the GMOB salary guide discuss roles and compensation context in qualitative terms. Compensation varies widely by region, seniority, and employer, so treat any single headline number with skepticism.

Sequencing Your Preparation Around the Domains

Because GIAC publishes no weights, the sensible approach is full coverage with deliberate ordering. Foundations first, then offense, then integration. The sequence below is one reasonable layout across six weeks, tied directly to the domain headings.

The reasoning is simple: platform fundamentals make the offensive material intelligible, and the defensive domains make more sense once you have seen how attacks work. For a fuller plan with resource suggestions, read our GMOB study guide. If you want to learn what the data says about outcomes, we also discuss the GMOB pass rate, though GIAC does not publish an official figure in the sources we reference.

Frequently Asked Questions