What Is GMOB Certification?

What GMOB Certification Actually Is

GMOB stands for GIAC Mobile Device Security Analyst. It is a hands-on-oriented security credential aimed at professionals who need to assess, attack, and defend smartphones, tablets, and the applications that run on them. If you have seen the acronym elsewhere and wondered whether it is the same thing, the short answer is that this article is about the GIAC credential and only the GIAC credential. For quick definitions of the acronym itself, see our pages on what GMOB stands for and the broader overview of GMOB.

What distinguishes this certification from general security credentials is its narrow, practical focus. Rather than surveying all of information security, it concentrates on the mobile attack surface: how Android and iOS are built, how apps store and transmit data, how traffic can be intercepted, how malware behaves on a handset, and what happens when a device is lost or stolen. The certifying body's published objectives name the Mobile Application Security Verification Standard (MASVS) explicitly in the mobile application security assessment outcome, which tells you something about the assessment mindset the exam expects.

Who Issues It and Who It Is For

The certification is issued by GIAC Certifications (formerly Global Information Assurance Certification), administered by GIAC, LLC. GIAC is known for credentials that are tied to specific technical skill areas rather than broad management frameworks. The exam is delivered through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility.

Typical candidates include:

• Penetration testers who are adding mobile application testing to a web and network skill set.
• Application security engineers responsible for reviewing Android and iOS builds before release.
• Mobile device management and enterprise security staff who must secure fleets of managed devices.
• Incident responders and forensic analysts who encounter compromised or stolen devices.

There are no formal certification prerequisites for the exam. That said, hands-on comfort with a Linux terminal, some programming exposure, and general penetration-testing knowledge will make the material far more approachable. We break down eligibility in more detail in our guide to GMOB requirements.

Exam Format and Rules at a Glance

The format is simple but the constraints matter. Here is how the essential parameters stack up:

Two details deserve emphasis. First, because submitted answers cannot be changed, you need a disciplined pace: 75 questions in 120 minutes leaves roughly 96 seconds per question on average, with no ability to circle back and revise after submitting. Second, the 71% standard applies to exam versions released on or after December 24, 2016, and the objectives, format, and passing score shown for your assigned attempt at the GIAC attempts page take precedence over any third-party summary, including this one. For the scoring details, read our breakdown of the GMOB passing score.

The 11 Domains the Exam Covers

GIAC publishes eleven objective headings for this certification. Importantly, no official percentage weights are published in the objective list, so you should not assume any domain is worth more than another based on third-party claims. The headings are listed here in the published order. For a deeper walk-through, see the full GMOB exam domains guide.

1. Analyzing Mobile Applications
2. Attacking Encrypted Traffic
3. Managing Android Devices and Applications
4. Managing iOS Devices and Applications
5. Manipulating Mobile Application Behavior
6. Manipulating Network Traffic
7. Mitigating Against Mobile Malware
8. Mitigating Against Stolen Mobile Devices
9. Mobile Application Security Assessments
10. Reverse Engineering Mobile Applications
11. Unlocking and Rooting Mobile Devices

Grouping the domains by the work they represent

It helps to cluster the headings by the kind of thinking each requires, rather than memorizing them as eleven unrelated bullets.

How SEC575 Relates to the Exam

The preparation source most closely associated with this certification is the SANS Institute course SEC575: iOS and Android Application Security Analysis and Penetration Testing. Training is optional and recommended, not required, and SANS tuition is separate from the GIAC exam fee. Our GMOB training overview compares learning paths in more detail.

A few cautions are worth keeping in mind:

• The course sections are an unweighted preparation curriculum. They do not establish exhaustive exam coverage or an official count of exam domains.
• SEC575 recommends programming experience, basic Linux and terminal familiarity, and penetration-testing knowledge. These are course recommendations, separate from GIAC certification eligibility.
• The live SEC575 page references Android 14 and iOS 17, while the linked brochure references Android 12 and iOS 15. Those conflicting platform examples do not identify which version your assigned exam reflects, so build understanding of concepts that persist across OS releases rather than memorizing version-specific screens.

Registration, Fees, and the 120-Day Window

GIAC prices are listed in US dollars and exclude applicable sales tax. The figures that matter:

Once your attempt is activated, you have 120 days to complete it. That window shapes your planning: activating too early, before you have built an index and worked through the material, can compress your study time into a deadline you did not intend. Activating too late is not a risk in the same way, so many candidates finish their preparation first and activate afterward. See our pages on GMOB exam dates and scheduling and the full GMOB certification cost breakdown for how these pieces fit together, including training costs that sit outside the exam fee.

Open-Book Strategy for a Mobile Security Exam

The open-book rule is often misunderstood. You may bring hardcopy books, notes, and an index, but you may not use the internet, personal electronic references, or materials resembling practice or exam questions and answers. That last restriction is significant: your notes should consist of concept explanations, command references, and organized summaries that you wrote or compiled yourself, not recycled question banks.

For a mobile security exam specifically, an effective index tends to be organized around tasks and tools rather than around chapter order. Consider building sections such as:

• Android versus iOS comparisons: storage locations, permission models, signing, and sandboxing.
• Traffic interception steps and the common reasons interception fails.
• Static versus dynamic analysis workflows and what each one surfaces.
• Malware indicators and the controls that mitigate them.
• Stolen-device scenarios: remote controls, encryption, and data exposure.
• Rooting and unlocking: what changes in the device's trust model.

Because there is no going back after you submit an answer, an index only helps if you can find entries quickly. Practice looking things up under time pressure before exam day. Our GMOB cheat sheet shows the kind of condensed fact list worth drafting in your own words, and our guide on how hard the GMOB exam is discusses where candidates tend to lose time.

Sequencing Your Preparation by Domain

You do not need a generic study system here, just a logical order. Concepts in this exam build on each other, so a sensible progression moves from platform fundamentals to attack techniques to defense. The timeline below is one way to arrange the eleven domains over a focused stretch; adjust the pace to your own experience.

The reasoning: platform knowledge underpins everything else, application analysis depends on it, traffic techniques build on application analysis, and the assessment and mitigation domains tie the earlier material together. Finish with a timed run through practice questions, then refine your index. For a longer-form plan, see the GMOB study guide, and try realistic timed questions on our GMOB practice test site.

Validity and Renewal

The certification is valid for four years. To renew, you either earn 36 approved CPE credits during the active four-year period or pass a renewal exam, and in both cases you pay the standard USD $499 renewal fee. This renewal model rewards staying engaged with the field, since the mobile threat landscape shifts continually. If you are weighing long-term value, our analysis of whether GMOB is worth it factors in renewal costs alongside the initial investment.

Who Hires for This Skill Set

Demand for mobile security skills sits in a few predictable places: consultancies and security firms that perform application assessments for clients, enterprises that build their own customer-facing mobile apps, organizations that manage large fleets of corporate devices, and teams that handle forensics and incident response. Roles that commonly benefit include penetration tester, application security analyst, mobile security engineer, and security consultant.

We deliberately avoid quoting specific pay figures here, since credible compensation numbers depend on region, seniority, and employer. For a measured discussion, see our GMOB salary guide and our overview of GMOB jobs. If you want to check readiness before committing to the exam fee, the practice tests at GMOB Exam Prep are a low-cost way to benchmark yourself, and our look at the GMOB pass rate explains why published figures should be treated cautiously.

Frequently Asked Questions