GDSA Certification

What the GDSA Credential Actually Is

GDSA stands for GIAC Defensible Security Architecture, a certification administered by GIAC Certifications. GIAC's current certification page titles the same credential the "GIAC Defensible Security Architect Certification," while its pricing table and the affiliated SANS course materials use the shorter "Defensible Security Architecture" wording. Both names describe one credential, and this article uses them interchangeably. If you are still sorting out the terminology, our explainers on what GDSA certification is and what GDSA stands for cover the naming in more detail.

The certification validates whether a practitioner can design and justify the controls that make an enterprise defensible: network segmentation, filtering, encryption, identity-aware access, endpoint trust, data protection, and cloud security patterns. The emphasis is on architecture and engineering decisions rather than incident response or offensive technique. A candidate is expected to reason about where a control belongs and why, not just recite how a product is configured.

Exam Format and Mechanics

GIAC publishes the exam specification clearly. The GDSA is a single proctored, web-based exam with 75 questions and a 2-hour time limit. The minimum passing score is 63%. GIAC applies that passing-score specification to exam versions released on or after August 3, 2019. That date is a scoring applicability marker, not a syllabus revision date, so do not read it as "the year the content last changed."

Two caveats matter. First, the 63% figure is a minimum passing score, not a pass rate; GIAC has not published a candidate pass rate that we could verify, so treat any number you see circulating with suspicion. Our piece on the GDSA pass rate explains what can and cannot be said from the available data, and the GDSA passing score article walks through what 63% means in practice (roughly the proportion of scored items you must answer correctly, subject to how GIAC scores your specific form).

Second, GIAC states that your own candidate account at its attempts page is the authority for attempt-specific objectives, question types, format, and passing score. The public specification is a guide; your assigned exam version governs. Check your account before you finalize a study plan.

The 13 Published Objective Areas

GIAC's public outline lists 13 objective areas. It does not publish percentage weights, so nobody can honestly tell you that one domain is "worth" a specific share of your score. Plan for breadth. The list below follows the published order. For a fuller walkthrough, see our complete guide to all 13 GDSA content areas.

How the Domains Fit Together Architecturally

Reading the 13 headings as a flat list undersells the exam. They form roughly three layers of thinking, and questions often cross layer boundaries.

The classic network defense layer

Layer 1/Layer 2 defense, fundamental Layer 3 defense, IPv6, network defenses, and proxies and firewalls (Domains 4, 6, 7, 8, 10) are the established mechanics of controlling traffic. This is where candidates with a strong networking background feel at home, and where IPv6 tends to expose gaps, since many practitioners know IPv4 filtering deeply and IPv6 only superficially.

The modernization layer

Zero Trust fundamentals, Zero Trust networking, Zero Trust endpoints, and network encryption and remote access (Domains 9, 11, 12, 13) ask how those older controls change when identity, device posture, and context become the primary decision inputs. A question might describe a VPN-dependent flat network and ask which redesign step best reduces implicit trust.

The data and platform layer

Cloud-based security architecture, data discovery and governance, and data-centric security (Domains 1, 2, 3) shift the focus from the network path to where data lives and who can touch it. Domain 5 sits underneath all of it as the conceptual glue.

Preparing for an Open-Book Exam

GIAC permits hardcopy books, notes, and an index during the exam. Electronic references and practice or exam question-and-answer materials are prohibited. With 75 questions in 2 hours, you have well under two minutes per question on average, so the book is a lookup tool for precise details, not a substitute for understanding. If you are searching an index for the concept itself, you will run out of time.

An effective GDSA index is organized by architectural concept and by the specific terms you expect to be asked about, with page references to where each is explained. Build it while you study, not the week before the exam, because the act of indexing is itself a form of review. Our GDSA cheat sheet gives a condensed view of the facts worth having at your fingertips, and the GDSA study guide covers how to structure your materials. For a realistic read on workload, see how hard the GDSA exam is.

You can rehearse timing and question style with the practice questions on the main GDSA practice test site. Keep in mind the prohibition on practice or exam Q&A materials applies inside the exam room, so those resources belong in your preparation, not your reference stack.

Fees, Access Window, and Testing Logistics

These prices exclude applicable sales tax and any training tuition. The 120-day window starts at activation, so activate only when you are ready to schedule seriously. Testing is available through Pearson VUE at a test center or through ProctorU remotely, subject to GIAC's modality rules, so confirm which options apply to your attempt before booking. For the full financial picture, including how training tuition changes the total, see the GDSA certification cost breakdown, and for scheduling specifics see GDSA exam dates and scheduling.

There are no formal certification prerequisites. That said, an honest look at the GDSA requirements shows that "no prerequisite" is not the same as "no background needed"; the domains assume comfort with networking, firewalls, and basic cryptography.

The SEC530 Course Connection

The affiliated preparation path is SANS SEC530, "Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise." Taking it is recommended but not required. Choosing the SANS-associated attempt keeps the exam price at USD 999, with course tuition on top.

One caution is worth stating plainly. The current SEC530 web page and the linked brochure PDF differ in section names and content, and the live page includes expanded AI-era material. That material is preparation content, not evidence that a new version of the GDSA exam has been released. Likewise, course sections, labs, and capstones do not establish official exam-domain counts, weights, or exhaustive exam coverage. Treat GIAC's published objectives as the authoritative scope and the course as one way to learn it. For options beyond the official course, our overview of GDSA training compares approaches.

Roles Where the Credential Fits

The skills tested map most naturally to people who design or evaluate security controls rather than only operate them. Typical fits include security architects, security engineers, network security engineers, cloud security engineers, and technical leads responsible for segmentation, remote access, or Zero Trust programs. Consultants who assess client architectures also find the vocabulary useful.

Hiring demand varies by employer, region, and seniority, and we do not cite specific salary figures here because none are published in the certification's public specifications. If you want to explore the market, review GDSA jobs and the GDSA salary guide, and weigh them against your own situation using the GDSA ROI analysis. Job postings that mention Zero Trust, segmentation, or hybrid-enterprise architecture are the clearest signal that the credential's content aligns with an employer's needs.

A Domain-Ordered Study Sequence

Rather than a generic schedule, order your preparation by dependency. Foundations first, then the layers that build on them, with the modern Zero Trust material placed after you understand what it is replacing. This is one possible arrangement, which you should compress or stretch based on your starting knowledge.

Placing Domain 12 before Domains 11 and 13 matters because endpoint and networking questions assume you can already articulate what makes a design Zero Trust. Likewise, saving data and cloud topics for the end lets you apply the network and identity concepts you have just absorbed.

Keeping the Credential Current

The certification is valid for four years. To renew, you can earn 36 CPE credits or pass a renewal examination, and in either case pay the renewal fee (listed above as USD 499 for standard renewal). GIAC's renewal guidance is the authority on how CPE credits are documented and submitted, so consult it early in your four-year cycle rather than near the deadline. Because renewal can be done through continuing education, ongoing work in architecture, conferences, and relevant training can count toward staying certified.

Frequently Asked Questions