- How the GDSA Outline Is Organized
- Exam Format That Shapes How You Study the Domains
- Foundational Domains: Concepts, Zero Trust, and Data
- Network Core: Layers 1 to 3, IPv6, and Network Defenses
- Proxies, Firewalls, Encryption, and Remote Access
- Zero Trust Endpoints and Zero Trust Networking
- Cloud-based Security Architecture
- Sequencing the 13 Domains Across Your Prep
- Quick-Reference Table of All 13 Domains
- Where SEC530 Fits and Where It Does Not
- Frequently Asked Questions
- GIAC's public outline lists 13 domains for GDSA, but publishes no percentage weights, so do not trust any weighting claims.
- The exam is 75 questions in 2 hours with a 63% minimum passing score, and it is open book with hardcopy materials.
- Zero trust spans three domains: fundamentals, networking, and endpoints. Treat them as one connected architecture topic.
- Layer 1/Layer 2 defense, Layer 3 defense, and IPv6 are separate domains, so networking basics are not optional.
How the GDSA Outline Is Organized
GIAC Defensible Security Architecture (GDSA) is the GIAC credential validating that a practitioner can design and engineer layered, defensible security architectures. GIAC's current certification page titles the credential "GIAC Defensible Security Architect Certification (GDSA)," and the exam objectives are published as 13 domain headings. If you are new to the credential itself, start with What Is GDSA Certification? and then return here for the domain-level detail.
One point deserves emphasis before anything else: the public outline lists the 13 domains by name only. It does not assign percentage weights to them. Any site, forum post, or study group that tells you "Domain X is 15% of the exam" is inventing a number the issuer has not published. This guide deliberately avoids weights and instead describes what each domain asks you to understand, so your preparation is balanced rather than built on a guess.
The 13 domains, in the order GIAC lists them, are: Cloud-based Security Architecture; Data Discovery, Governance, and Mobility Management; Data-Centric Security; Fundamental Layer 3 Defense; Fundamental Security Architecture Concepts; IPv6; Layer 1/Layer 2 Defense; Network Defenses; Network Encryption and Remote Access; Network Proxies and Firewalls; Zero Trust Endpoints; Zero Trust Fundamentals; and Zero Trust Networking. The alphabetical ordering means the list does not reflect a learning sequence, which is why a later section proposes one.
Exam Format That Shapes How You Study the Domains
The GDSA is a single proctored, web-based exam with 75 questions and a 2-hour time limit. The minimum passing score is 63%. GIAC applies that passing-score specification to exam versions released on or after August 3, 2019, which is a scoring applicability date and not a syllabus revision date. For a full breakdown of what that threshold means in practice, see GDSA Passing Score 2026: Exactly What You Need to Pass.
Two hours for 75 questions gives you roughly 1 minute 36 seconds per question on average. That arithmetic matters for an open-book exam: if you spend most of that time paging through books, you will run short. The domains with the densest, most architecture-heavy scenarios (zero trust, cloud, network defenses) are the ones where an index pays off most, because a well-indexed reference lets you confirm a detail in seconds instead of minutes.
- Open book: permitted hardcopy books, notes, and an index are allowed. Electronic references and practice or exam question-and-answer materials are prohibited.
- Testing options: Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules.
- Attempt access: a standalone attempt provides 120 days from activation.
- Pass rate: the minimum passing score is not a pass-rate statistic, and no issuer-published pass rate was verified. Read GDSA Pass Rate 2026: What the Data Shows for how to think about that gap.
Because the exam rewards applying concepts to architecture scenarios, memorizing definitions is a weak strategy. For the difficulty picture overall, How Hard Is the GDSA Exam? covers what makes the question style demanding.
Foundational Domains: Concepts, Zero Trust, and Data
Three conceptual areas anchor everything else in the exam: Fundamental Security Architecture Concepts, Zero Trust Fundamentals, and the data-focused pair of Data Discovery, Governance, and Mobility Management and Data-Centric Security. These are the domains where vocabulary and mental models are built, and later technical domains assume you have them.
Domain 5: Fundamental Security Architecture Concepts
Fundamental Security Architecture Concepts
This domain establishes how defensible architecture is reasoned about before any specific control is chosen. Expect questions that ask you to pick the sound design principle for a scenario, not recall a product feature.
- Defense in depth and why layered controls outlast any single control failing
- Attack surface reduction and how architecture decisions expand or shrink it
- Segmentation as a design principle rather than a one-time project
- Designing for detection and response, not just prevention
Domain 12: Zero Trust Fundamentals
Zero Trust Fundamentals
This is the conceptual core of the credential's identity. SEC530, the affiliated SANS course, is explicitly framed around implementing zero trust for the hybrid enterprise, so expect the exam to test whether you understand zero trust as an architecture, not a product category.
- Why implicit trust based on network location is the problem zero trust addresses
- The relationship between identity, device posture, and access decisions
- How policy decision and enforcement concepts divide responsibilities
- Common misconceptions about what zero trust does and does not replace
Domains 2 and 3: Data Discovery, Governance, Mobility, and Data-Centric Security
These two domains shift the lens from the network to the asset that attackers actually want. Data Discovery, Governance, and Mobility Management concerns knowing what data you have, where it lives, and how it moves. Data-Centric Security concerns protecting the data itself so protection follows it across environments. Together they address a core architecture question: if the perimeter fails, what still protects the information?
- Discovery and classification as prerequisites for any meaningful protection scheme
- Governance concepts that connect technical controls to organizational requirements
- Managing data as it moves between on-premises, cloud, and mobile contexts
- Controls that travel with the data rather than depending on network boundaries
Key Takeaway
Study Domains 2 and 3 as a pair. Discovery and governance tell you what to protect; data-centric security tells you how. Questions often combine both in one scenario.
Network Core: Layers 1 to 3, IPv6, and Network Defenses
GDSA devotes separate domains to Layer 1/Layer 2 Defense, Fundamental Layer 3 Defense, IPv6, and Network Defenses. That is a strong signal that the credential expects genuine network engineering literacy, not just policy-level architecture talk. Candidates who come from application or identity backgrounds should budget extra time here.
Domain 7: Layer 1/Layer 2 Defense
Layer 1/Layer 2 Defense
The lowest layers are where many architects have the shallowest hands-on exposure, and attackers know it. This domain covers hardening the switching and physical-adjacent layer of the network.
- Switch-level protections against common local-segment attacks
- Controlling which devices can attach to the network and how
- VLAN design as a segmentation and containment tool, including its limits
- Wireless and physical access considerations that affect the lower layers
Domain 4: Fundamental Layer 3 Defense
Fundamental Layer 3 Defense
Routing and addressing decisions are security decisions. This domain covers protecting the routed infrastructure and using Layer 3 controls to constrain how traffic flows.
- Securing routing infrastructure and the control plane
- Filtering and access control at the routed boundary
- Address-spoofing defenses and sensible ingress and egress filtering
- Router and Layer 3 device hardening as part of overall design
Domain 6: IPv6
IPv6 earns its own domain because it is routinely enabled by default on modern systems while defenders configure controls only for IPv4. The defensible-architecture question is how to secure a network where IPv6 is present whether or not you planned for it. Expect to reason about how IPv6 changes addressing, neighbor discovery, and filtering assumptions, and how controls designed for IPv4 can leave a gap if they are not mirrored.
Domain 8: Network Defenses
Network Defenses is the broad domain where detection and prevention tooling is placed within an architecture. Think of it as the question of where monitoring and enforcement belong, not just what they are. Candidates should be comfortable reasoning about visibility, traffic inspection placement, and how defensive layers complement each other without creating blind spots.
Proxies, Firewalls, Encryption, and Remote Access
Two domains cover the controls that sit between users and the resources they reach: Network Proxies and Firewalls, and Network Encryption and Remote Access. These are the most product-adjacent topics on the outline, yet the exam still frames them as architecture decisions.
Domain 10: Network Proxies and Firewalls
Network Proxies and Firewalls
This domain is about choosing and placing enforcement points, and understanding what each type can and cannot see or stop.
- Differences between packet filtering, stateful inspection, and application-aware enforcement
- Forward and reverse proxy roles and where each fits in a design
- Placement of enforcement points relative to zones and trust boundaries
- Policy design that stays maintainable rather than accumulating exceptions
Domain 9: Network Encryption and Remote Access
Network Encryption and Remote Access
Encryption protects data in transit, and remote access defines how outside users and sites join the environment. This domain connects naturally to zero trust, since modern remote access design increasingly moves away from broad network-level connectivity.
- Protecting traffic in transit and understanding where encryption helps or hinders inspection
- VPN architectures and the tradeoffs among them
- Secure remote access patterns for a distributed workforce
- How remote access design changes when identity, not location, drives trust
Zero Trust Endpoints and Zero Trust Networking
Beyond the fundamentals, GDSA splits zero trust into two implementation-focused domains. This split is the most distinctive feature of the outline compared with general security architecture credentials, and it mirrors the SANS course's emphasis on implementing zero trust across a hybrid enterprise.
Domain 11: Zero Trust Endpoints
Zero Trust Endpoints
If access decisions depend on device posture, the endpoint becomes a policy input, not just a protected asset. This domain addresses how endpoints participate in a zero trust architecture.
- Establishing and verifying device trust before granting access
- Endpoint hardening and configuration baselines as architectural requirements
- Endpoint visibility and telemetry feeding access and response decisions
- Handling managed versus unmanaged and personally owned devices
Domain 13: Zero Trust Networking
Zero Trust Networking
This domain turns zero trust principles into network design: how traffic is segmented, authenticated, and authorized between workloads and users rather than assumed safe inside a perimeter.
- Microsegmentation and limiting lateral movement
- Per-session access decisions instead of persistent network-wide trust
- Software-defined and identity-aware approaches to network access
- Migrating a flat or perimeter-based network toward zero trust incrementally
Key Takeaway
Domains 11, 12, and 13 are one body of knowledge viewed from three angles: principles, devices, and network. A scenario about one will often depend on understanding the other two.
Cloud-based Security Architecture
Domain 1: Cloud-based Security Architecture
Because SEC530 targets the hybrid enterprise, cloud is treated as part of the architecture rather than a separate specialty. Expect questions about applying defensible design principles when workloads and data span on-premises and cloud environments.
- Shared responsibility and what the architect still owns in each service model
- Applying segmentation, identity, and monitoring concepts in cloud environments
- Securing connectivity between on-premises and cloud resources
- Avoiding architecture drift when cloud resources are provisioned quickly
Cloud ties directly to the data domains and the zero trust domains. A cloud question may really be testing data classification, identity-based access, or network segmentation expressed in a cloud context, so do not study this domain in isolation.
Sequencing the 13 Domains Across Your Prep
Because GIAC lists the domains alphabetically and publishes no weights, you have to decide your own order. The timeline below sequences them by dependency: concepts first, then network layers from the bottom up, then enforcement and access, then zero trust implementation, then data and cloud as integrating topics. Adjust it to your background, and see the GDSA Study Guide 2026 for broader planning guidance.
Concepts and zero trust fundamentals
- Domain 5: Fundamental Security Architecture Concepts
- Domain 12: Zero Trust Fundamentals
- Start building your hardcopy index with consistent terminology
Lower network layers
- Domain 7: Layer 1/Layer 2 Defense
- Domain 4: Fundamental Layer 3 Defense
- Domain 6: IPv6, reviewed against what you learned for IPv4
Enforcement, visibility, and access
- Domain 10: Network Proxies and Firewalls
- Domain 8: Network Defenses
- Domain 9: Network Encryption and Remote Access
Zero trust implementation
- Domain 11: Zero Trust Endpoints
- Domain 13: Zero Trust Networking
- Revisit Domain 12 now that the implementation pieces are familiar
Data, cloud, and integration
- Domain 2: Data Discovery, Governance, and Mobility Management
- Domain 3: Data-Centric Security
- Domain 1: Cloud-based Security Architecture
- Take timed practice sets and finalize your index
If your background is heavily network engineering, compress weeks 2 and 3 and spend the saved time on the data domains. If you come from cloud or identity, do the reverse. Timed practice on the GDSA practice test platform helps expose which domains are actually slowing you down.
Quick-Reference Table of All 13 Domains
| Domain | Core Focus | Pairs Well With |
|---|---|---|
| 1. Cloud-based Security Architecture | Applying design principles across hybrid and cloud environments | Domains 2, 3, 13 |
| 2. Data Discovery, Governance, and Mobility Management | Knowing what data exists and how it moves | Domain 3 |
| 3. Data-Centric Security | Protection that follows the data | Domains 2, 9 |
| 4. Fundamental Layer 3 Defense | Routing and addressing security | Domains 6, 7 |
| 5. Fundamental Security Architecture Concepts | Design principles and layered defense | All domains |
| 6. IPv6 | Securing networks where IPv6 is present | Domain 4 |
| 7. Layer 1/Layer 2 Defense | Switching and local-segment protections | Domains 4, 13 |
| 8. Network Defenses | Placement of detection and prevention | Domain 10 |
| 9. Network Encryption and Remote Access | Traffic protection and secure access patterns | Domains 12, 13 |
| 10. Network Proxies and Firewalls | Enforcement point selection and placement | Domain 8 |
| 11. Zero Trust Endpoints | Device trust and posture as policy inputs | Domains 12, 13 |
| 12. Zero Trust Fundamentals | Principles of zero trust architecture | Domains 11, 13 |
| 13. Zero Trust Networking | Microsegmentation and identity-aware access | Domains 7, 9, 12 |
For a compressed version of must-know facts you can reference during review, the GDSA Cheat Sheet 2026 condenses the highest-value points.
Where SEC530 Fits and Where It Does Not
The affiliated SANS course is SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise. It is the natural companion for the GDSA, and the course title alone tells you why zero trust occupies three domains. Training is recommended but there are no formal certification prerequisites, which the GDSA Requirements 2026 article covers in more detail.
On cost, a standalone GDSA attempt is USD 999, a separately listed practice exam is USD 399, a retake is USD 899, and standard renewal is USD 499, all excluding sales tax and training tuition. The SANS-associated exam attempt is also USD 999 with course tuition additional. The full financial picture is in GDSA Certification Cost 2026. The credential is valid four years and renews with 36 CPE credits or a renewal exam, plus the renewal fee.
As for who values the credential, architecture-focused roles such as security architects, security engineers, and network security engineers in organizations pursuing zero trust and hybrid-cloud designs are the natural fit. See GDSA Jobs for role-level detail and Is the GDSA Certification Worth It? for the return-on-investment angle.
Frequently Asked Questions
GIAC's public exam-objective outline for GIAC Defensible Security Architecture lists 13 domains. They span cloud architecture, data security, network layers, IPv6, firewalls and proxies, encryption and remote access, and three zero trust areas. Confirm your attempt-specific objectives in your GIAC account.
The public outline provides no percentage weights, so none should be assumed. Because the domains are listed alphabetically and unweighted, prepare for all 13 rather than concentrating on a domain you guess is heavier.
Yes, with limits. Hardcopy books, notes, and an index are permitted. Electronic references and practice or exam question-and-answer materials are prohibited. With 75 questions in 2 hours, a well-organized index matters more than carrying many books.
The minimum passing score is 63% on the 75-question exam. This is a scoring threshold, not a pass rate, and no issuer-published pass rate was verified. Your GIAC account is the authority for your specific attempt.
No. There are no formal certification prerequisites, and training is recommended rather than required. SEC530 is the affiliated SANS course and aligns closely with the credential's zero trust emphasis, but you can also attempt the exam as a standalone candidate.
Mastering all 13 domains comes down to understanding how they connect: zero trust principles shape endpoint and network design, data protection survives perimeter failure, and the lower network layers underpin everything above them. When you are ready to test that integrated knowledge under timed conditions, the GDSA practice tests are built to mirror the scenario-driven style the exam rewards.