GDSA Passing Score 2026: Exactly What You Need to Pass

The Number: 63% on a 75-Question Exam

If you are preparing for the GIAC Defensible Security Architecture exam, the headline figure is simple: the minimum passing score is 63%. The exam is a single proctored, web-based test with 75 questions and a 2-hour time limit. Those three specifications, the score, the question count, and the clock, define the entire arithmetic of your attempt.

This article breaks down what 63% means in practice, what it does not mean, where the points come from across the 13 published exam domains, and how to build a preparation plan that targets a passing margin rather than a vague sense of readiness. If you are still orienting yourself, start with What Is GDSA Certification? and then return here for the scoring detail.

Doing the Math: How Many Questions Is 63%?

With 75 questions on the exam, 63% translates to roughly 47 correct answers (0.63 × 75 = 47.25). In practical terms, you should plan around getting at least 47 questions right, and you should aim well above it to leave a buffer.

The derived rows are simple arithmetic from the published figures, not additional GIAC claims. One caution: your attempt's exact question types and scoring details are attempt-specific. GIAC points candidates to their account for those, so treat the arithmetic above as a planning model rather than a guarantee about how each individual item is weighted.

What the Passing Score Is Not

Candidates frequently confuse three different numbers, and keeping them separate will save you from bad planning:

• The minimum passing score (63%) is the threshold you must meet or exceed. It is a cut score, not an average and not a target.
• A pass rate is the share of candidates who pass. GIAC has not published a verified pass rate for this exam, so any specific percentage you see quoted online should be treated skeptically. Our GDSA Pass Rate breakdown explains what can and cannot be said from available evidence.
• Difficulty is subjective and depends on your background in network and cloud architecture. See How Hard Is the GDSA Exam? for a fuller treatment.

Why Your Own Exam Version Is the Final Authority

GIAC states that the 63% passing-score specification applies to exam versions released on or after August 3, 2019. That date is a scoring applicability date. It is not a syllabus revision date, so it should not be read as "the exam was last updated in 2019."

The practical consequence is straightforward: the public specifications describe the exam in general, but GIAC identifies your candidate account, at exams.giac.org/pages/attempts, as the authority for attempt-specific objectives, question types, format, and passing score. Before you commit to a study plan, log in and confirm what your assigned attempt shows. If anything there differs from what you read on a third-party site, including this one, trust your account.

Where the Points Come From: The 13 Domains

The public outline for GDSA lists 13 domains. GIAC's public outline supplies no percentage weights for them, so there is no official way to say that one domain is worth a specific share of your 75 questions. What you can do is understand the territory and make sure you have no blind spots, because with a 63% cut score, a few neglected domains can sink an otherwise strong attempt. For deeper per-domain coverage, see the complete guide to all 13 GDSA content areas.

The domains are:

1. Cloud-based Security Architecture
2. Data Discovery, Governance, and Mobility Management
3. Data-Centric Security
4. Fundamental Layer 3 Defense
5. Fundamental Security Architecture Concepts
6. IPv6
7. Layer 1/Layer 2 Defense
8. Network Defenses
9. Network Encryption and Remote Access
10. Network Proxies and Firewalls
11. Zero Trust Endpoints
12. Zero Trust Fundamentals
13. Zero Trust Networking

Clustering the domains by how you will study them

Because the outline is unweighted, a useful approach is to group the 13 domains into clusters and make sure each cluster gets real attention.

One caution from the sourcing: the SEC530 course sections, labs, and capstones are preparation material. They do not establish official exam-domain counts, weights, or exhaustive exam coverage. Use the course to learn the material, but use the published domain list as your coverage checklist.

Open-Book Rules and Their Effect on Your Score

GDSA is an open-book exam, with strict limits on what you can bring. Permitted items are hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice or exam question-and-answer materials. That last restriction matters: you cannot bring a printed set of practice questions and answers into the exam.

Open book changes how you earn your 63%, but not in the way many candidates assume.

• It rewards retrieval speed, not just knowledge. With roughly 1.5 minutes per question, you cannot afford to hunt through unindexed material. Your index should let you find a concept in seconds.
• It does not replace understanding. Scenario-style architecture questions require you to apply concepts, and a book rarely contains your exact scenario. The index helps you confirm details, not reason from scratch.
• Your index should map to the 13 domains. Organize by topic so that questions on, say, IPv6 or proxy placement lead you straight to the right pages.

Pacing 75 Questions in 2 Hours

The pace math is tight but workable. At just over 1.5 minutes per question on average, you have no room for long stalls. A sensible approach:

1. First pass: answer what you know. Move quickly through questions you can answer from understanding, and mark the ones that need an index lookup.
2. Second pass: look things up. Use your hardcopy index for the marked items, budgeting a firm cap per question.
3. Final pass: review flagged answers. Reserve a few minutes at the end for any items you were unsure about.

Because the minimum is about 47 correct answers, you do not need perfection. Burning five minutes on one stubborn question costs you the time to answer several easier ones. Skipping and returning is almost always the better trade.

Fees, Access Window, and the Cost of Missing 63%

Missing the passing score has a real price, so the fee structure is relevant to how seriously you plan. From GIAC's published figures:

Prices exclude applicable sales tax and training tuition. A standalone attempt carries 120 days of access from activation, which is your window to schedule and sit the exam, so plan your preparation so that you activate only when you are close to ready. The full financial picture, including how training tuition factors in, is covered in our GDSA certification cost breakdown, and scheduling mechanics are discussed in GDSA exam dates and scheduling.

The takeaway is that a retake costs USD 899, which is a strong incentive to treat the first attempt as the one that counts. Using a practice exam to measure readiness against the 63% line before you sit the real thing is a sensible hedge. You can also check your readiness on our GDSA practice tests.

A Score-Focused Prep Sequence

Rather than a generic weekly template, here is a sequence organized by the domain clusters above. It assumes you have already reviewed your attempt details in your GIAC account. Adjust the length to your background; the point is the ordering.

For a broader plan, including how SEC530 and self-study can complement each other, see the GDSA study guide and the overview of GDSA training options.

After You Pass: Validity and Renewal

Clearing the 63% line earns a certification that is valid for four years. To renew, you can submit 36 CPE credits or take a renewal examination, and either route requires the renewal fee (the standard renewal fee is listed above as USD 499).

If you are weighing whether the investment pays off, our GDSA ROI analysis and salary guide cover earnings and career value, and GDSA jobs looks at the roles where this credential is relevant. For prerequisite questions, note that there are no formal certification prerequisites, though training is recommended; details are in GDSA requirements.

Frequently Asked Questions