- Exam Snapshot: The Numbers on One Screen
- Naming and Identity: Which GDSA This Is
- The 13 Domains at a Glance
- Core Architecture Facts to Memorize
- Network, Layer 2/3, IPv6 and Encryption Facts
- Zero Trust Facts: Fundamentals, Endpoints, Networking
- Data-Centric and Cloud Facts
- Open-Book Rules and Index Strategy
- Fees, Access Window and Renewal
- Where the Credential Gets Used
- Sequencing the Domains Across Your Prep
- Frequently Asked Questions
- The GDSA exam is one proctored, web-based test: 75 questions, 2 hours, minimum passing score of 63%.
- GIAC publishes 13 objective domains but no percentage weights, so never trust a source claiming exact domain weightings.
- The exam is open book with hardcopy books, notes and an index; electronic references are prohibited.
- Standalone attempt is USD 999 with 120 days of access; retake USD 899; renewal USD 499 every four years.
Exam Snapshot: The Numbers on One Screen
This page is built to be scanned the night before you sit down for the exam, or pinned beside your index while you build it. Every number below comes from GIAC's public specifications for GIAC Defensible Security Architecture. If your assigned exam version differs, your candidate account at GIAC's attempts page is the authority for attempt-specific objectives, question types, format and passing score.
| Item | Fact |
|---|---|
| Issuer | GIAC Certifications (GIAC, LLC) |
| Format | One proctored, web-based exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 63% (applies to exam versions released on or after August 3, 2019) |
| Testing venue | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Reference materials | Open book: hardcopy books, notes and an index permitted |
| Prerequisites | None formal; training recommended |
| Validity | Four years |
A quick pacing calculation helps: 75 questions in 120 minutes leaves roughly 96 seconds per question on average. That sounds generous until you remember that open-book candidates burn time flipping through binders. The cheat-sheet mindset is therefore twofold: know the material cold enough that you only look things up to confirm, and make your index fast enough that confirmation takes seconds, not minutes.
Naming and Identity: Which GDSA This Is
Several unrelated credentials use the same four-letter acronym, which is a frequent source of bad information online. This site covers one credential only: the GIAC certification administered by GIAC and aligned with the SANS course SEC530, Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise.
Be aware of a naming wrinkle. GIAC's pricing table, the SANS course page and the SANS brochure use the name GIAC Defensible Security Architecture, while the current certification page titles the same credential GIAC Defensible Security Architect Certification. It is one credential with two name forms. If you want the plain-language basics, our explainers on what GDSA certification is and what GDSA stands for cover the terminology.
The 13 Domains at a Glance
GIAC's public exam-objective outline lists 13 domains. It does not publish percentage weights, so any study plan that allocates "X percent of the exam" to a specific domain is guesswork. Treat all 13 as fair game and use the list below as your master checklist. For narrative coverage of each area, see the complete guide to all 13 GDSA content areas.
- Cloud-based Security Architecture
- Data Discovery, Governance, and Mobility Management
- Data-Centric Security
- Fundamental Layer 3 Defense
- Fundamental Security Architecture Concepts
- IPv6
- Layer 1/Layer 2 Defense
- Network Defenses
- Network Encryption and Remote Access
- Network Proxies and Firewalls
- Zero Trust Endpoints
- Zero Trust Fundamentals
- Zero Trust Networking
Core Architecture Facts to Memorize
The domain called Fundamental Security Architecture Concepts sets the vocabulary for everything else. Questions in this exam reward candidates who think like an architect rather than a tool operator: given a design constraint, which control belongs where, and why?
Fundamental Security Architecture Concepts
Expect scenario framing around defensible design principles rather than product trivia.
- Defense in depth: layered controls so no single failure exposes the environment
- Attack-surface reduction and least privilege as design inputs, not afterthoughts
- Assume-breach thinking: design for detection, containment and recovery, not only prevention
- Segmentation as a way to limit blast radius and lateral movement
- Trade-offs between security control placement, performance and operational burden
When you build your index, create entries for each principle with a one-line definition and the page where you worked a related example. Concept questions often hide the answer in a design rationale, so your notes should capture the "why" as well as the "what."
Network, Layer 2/3, IPv6 and Encryption Facts
Five domains sit in classic network-defense territory: Layer 1/Layer 2 Defense, Fundamental Layer 3 Defense, IPv6, Network Defenses, and Network Encryption and Remote Access, plus Network Proxies and Firewalls. Together they form the largest block of named domains in the outline, though again, no weights are published.
Layer 1/Layer 2 Defense
Know what attackers can do on a local network segment and which switch-level controls stop them.
- Common Layer 2 attack classes: ARP spoofing, MAC flooding, VLAN-related abuse, rogue DHCP
- Switch-port hardening and access control concepts at the edge
- Physical-layer considerations: cabling, tapping risk, port exposure
Fundamental Layer 3 Defense
Routing and addressing are a security surface, not just plumbing.
- Filtering at the routed boundary and the purpose of ingress and egress controls
- Router and infrastructure hardening, including control-plane protection concepts
- Spoofed-source traffic and how network design limits it
IPv6
IPv6 earns its own domain because many defensive assumptions built for IPv4 do not carry over cleanly.
- Address structure and the role of neighbor discovery in place of ARP
- Why dual-stack environments create unmonitored attack paths when IPv6 is ignored
- Extension headers and the filtering challenges they introduce
- Applying firewall and segmentation policy consistently across both protocols
Network Proxies and Firewalls
Understand what each control sees, and where it is blind.
- Stateful versus application-aware inspection, and what encrypted traffic does to visibility
- Forward versus reverse proxy roles and where each fits in an architecture
- Rule-base design: default deny, ordering, and egress filtering
Network Defenses and Network Encryption and Remote Access
These domains cover detection and protection in transit, plus secure access for users outside the perimeter.
- Network monitoring and detection architecture, including where sensors belong
- VPN and remote-access design, and how it differs from identity-aware access models
- Encryption in transit: what it protects, and the visibility trade-off it creates for defenders
A useful memory hook for this cluster: for every network control, ask "what layer does it operate at, what can it see, and what can it not see?" That three-part question resolves a surprising number of scenario items.
Zero Trust Facts: Fundamentals, Endpoints, Networking
The course title itself, Implementing Zero Trust for the Hybrid Enterprise, signals how much emphasis this credential places on zero trust thinking. Three domains carry the label directly: Zero Trust Fundamentals, Zero Trust Endpoints and Zero Trust Networking.
Zero Trust Fundamentals
- Core premise: no implicit trust based on network location; verify explicitly and continuously
- Policy decision and enforcement concepts: who or what decides, and where enforcement happens
- Identity, device posture and context as inputs to access decisions
- Why zero trust is an architecture and operating model rather than a single product
Zero Trust Endpoints
- Device trust: posture assessment, hardening and management as prerequisites for access
- Endpoint protection as part of the access decision, not separate from it
- Handling unmanaged and personally owned devices within a policy model
Zero Trust Networking
- Microsegmentation and limiting east-west movement
- Moving from perimeter-centric VPN access to per-application, identity-aware access
- How legacy network controls fit into, and sometimes conflict with, zero trust designs
Key Takeaway
Do not memorize zero trust as slogans. Practice translating a described environment into a decision: what is being verified, by which component, using which signals, and what happens when verification fails.
Data-Centric and Cloud Facts
Three domains move the conversation away from the network and toward the asset being protected and the environment it lives in.
Data Discovery, Governance, and Mobility Management
- You cannot protect what you cannot find: discovery and classification come first
- Governance concepts: ownership, handling rules and lifecycle
- Mobility management: controlling how data and devices move beyond the traditional boundary
Data-Centric Security
- Protecting data itself through controls that travel with it, rather than relying only on the perimeter
- Encryption, access control and loss-prevention concepts applied at the data layer
- How data-centric controls complement network and endpoint controls
Cloud-based Security Architecture
- Shared responsibility: what the provider secures and what remains with the customer
- Architecting segmentation, identity and logging in cloud and hybrid environments
- Extending zero trust principles across on-premises and cloud workloads
These domains reward breadth. Rather than chasing vendor-specific features, focus on the architectural question each addresses: where does the control live, who owns it, and what failure does it contain?
Open-Book Rules and Index Strategy
GIAC permits hardcopy books, notes and an index. Electronic references and practice or exam question-and-answer materials are prohibited. Proctoring is done through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules, so confirm what your chosen modality allows on your desk before exam day. The GIAC Proctored Exam Reference Guide and the Candidate Agreement are the documents to read.
- Index by concept, not by page order. Questions are scenario-based, so you will search by idea ("egress filtering," "neighbor discovery," "policy enforcement point"), not by chapter.
- Add a "confusable pairs" tab. Proxy versus firewall, VPN versus identity-aware access, discovery versus classification: list the distinguishing feature of each pair.
- Annotate lab experiences. If a hands-on exercise made a concept click, tag that page in your index.
- Test your index under time pressure. If you cannot locate an entry in well under a minute, restructure it.
To pressure-test your index and pacing, take timed sessions on our GDSA practice test platform and note which concepts you had to look up repeatedly. Those become your index priorities.
Fees, Access Window and Renewal
| Item | Amount or Rule |
|---|---|
| Standalone exam attempt | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| SANS-associated attempt | USD 999, with course tuition additional |
| Standard renewal fee | USD 499 |
| Standalone attempt access | 120 days from activation |
| Certification validity | Four years |
| Renewal requirement | 36 CPE credits or a renewal exam, plus the renewal fee |
Listed prices exclude applicable sales tax and training tuition. The 120-day access clock starts at activation, so activate when you are close to ready rather than months ahead. A full walkthrough of fee scenarios is in our GDSA certification cost breakdown, and timing considerations are covered in GDSA exam dates and scheduling.
On eligibility: there are no formal prerequisites, though training is recommended. Details are in GDSA requirements. Regarding pass rates, no issuer-published figure was verified. The 63% number is a minimum passing score, not a statistic about candidate outcomes, and our GDSA pass rate analysis explains how to interpret that distinction.
Where the Credential Gets Used
This credential targets practitioners who design and engineer defenses rather than only operate them. Roles where the domain list maps naturally onto daily work include security architects, security engineers responsible for network and cloud controls, and senior defenders who lead segmentation, remote-access modernization or zero trust programs. Organizations migrating from perimeter-centric designs to hybrid and zero trust models are the most natural audience, since the exam content mirrors that transition.
We do not cite salary figures here because we have no verified issuer data to support them. For discussion of role types and market positioning, see the GDSA jobs overview, and for a framework to weigh cost against benefit, read whether the GDSA certification is worth it.
Sequencing the Domains Across Your Prep
Generic study hacks matter less than ordering the 13 domains sensibly. Here is one dependency-based sequence; adjust the durations to your background and to whether you take SEC530. The broader plan lives in our GDSA study guide.
Foundations
- Fundamental Security Architecture Concepts
- Layer 1/Layer 2 Defense and Fundamental Layer 3 Defense
- Start the index skeleton with principle definitions
Protocols and Perimeters
- IPv6, since its habits differ from IPv4 and need dedicated time
- Network Proxies and Firewalls, then Network Defenses
- Network Encryption and Remote Access
Zero Trust Block
- Zero Trust Fundamentals first, because the other two build on it
- Zero Trust Endpoints, then Zero Trust Networking
- Revisit remote access to contrast VPN with identity-aware models
Data, Cloud and Consolidation
- Data Discovery, Governance, and Mobility Management; Data-Centric Security
- Cloud-based Security Architecture
- Finish and time-test the index with practice sessions
The logic: concepts and lower network layers establish the vocabulary, protocol and perimeter domains reuse it, zero trust integrates both, and data and cloud domains apply everything to modern hybrid estates. Finish with timed practice at the main practice test site to expose gaps before your exam attempt window closes.
Frequently Asked Questions
The exam is one proctored, web-based test with 75 questions and a 2-hour limit. The minimum passing score is 63%. Confirm attempt-specific details in your GIAC candidate account.
GIAC's public outline lists 13 domains but supplies no percentage weights. Treat every domain as testable and be skeptical of any source that claims exact weightings.
Yes. The exam is open book with permitted hardcopy books, notes and an index. Electronic references and practice or exam question-and-answer materials are prohibited, so verify your modality's desk rules beforehand.
A standalone attempt is USD 999, a retake is USD 899, and renewal is USD 499, excluding sales tax and training tuition. The credential is valid four years and renews via 36 CPE credits or a renewal exam plus the fee.
No formal prerequisites exist, and training is recommended rather than required. SEC530 is the affiliated preparation course, but its content is preparation material and does not define official exam scope. See the GDSA training overview for options.