- The GDSA exam is 75 questions in 2 hours with a 63% minimum passing score, so aim for about 48 correct answers.
- It is open book with hardcopy materials only; electronic references and practice question-and-answer materials are prohibited.
- GIAC's public outline lists 13 domains with no published weights, so cover all of them rather than betting on a few.
- A standalone attempt costs USD 999 and gives 120 days of access from activation, so schedule deliberately.
What You Are Actually Studying
GDSA stands for GIAC Defensible Security Architecture, issued by GIAC Certifications. GIAC's current certification page titles the credential "GIAC Defensible Security Architect Certification," while the pricing table, the SANS course page, and the course brochure use the "Defensible Security Architecture" wording. They are the same credential. If you are new to the name, our explainers on what GDSA certification is and what GDSA stands for cover the basics.
This is an architecture-and-engineering exam, not a tooling exam. The published objectives revolve around how you design networks, endpoints, data protections, and cloud environments so that an attacker who breaches one control still meets another. The recurring idea is defense in depth combined with zero trust principles: assume compromise, shrink trust zones, verify explicitly, and make detection and containment part of the design rather than an afterthought.
There are no formal prerequisites for sitting the exam (see GDSA requirements for the full picture), but the content assumes working fluency with networking, TCP/IP, firewalls, and general security operations. Candidates who have never read a packet capture or configured a routing policy will find the early domains steeper than they expect.
Exam Mechanics That Shape Your Prep
Your study plan should be built around the exam's actual constraints. Here is what GIAC's public specifications state:
| Item | Detail |
|---|---|
| Format | One proctored, web-based exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 63% |
| Reference policy | Open book: hardcopy books, notes, and an index permitted; electronic references and practice/exam Q&A materials prohibited |
| Delivery | Pearson VUE onsite or ProctorU remote, subject to GIAC modality rules |
| Standalone access window | 120 days from activation |
| Certification validity | Four years |
Do the arithmetic early. Two hours for 75 questions is 96 seconds per question on average. That is generous for a recall question and tight for a scenario that asks you to reason through a firewall rule set or an IPv6 transition design. You cannot afford to hunt through your materials for every item, which is why your index matters so much (more on that below).
The 63% figure is a minimum passing score, which works out to roughly 48 of 75 questions if every question counts equally. GIAC applies this specification to exam versions released on or after August 3, 2019. That date is a scoring applicability date, not a syllabus revision. It also is not a pass rate. We have not verified any issuer-published pass rate, and we discuss what can and cannot be said in GDSA pass rate: what the data shows and GDSA passing score explained.
The 13 Domains, Grouped by How They Behave on Exam Day
GIAC's public outline lists 13 domain headings and does not publish percentage weights. That means any claim that "Domain X is 20% of the exam" is unsupported. The safe strategy is broad coverage with extra depth where your own background is thinnest. For a heading-by-heading walkthrough, see our complete guide to all 13 GDSA content areas. Below, we group the domains by the kind of thinking they demand.
Foundation and framing domains
Fundamental Security Architecture Concepts and Zero Trust Fundamentals
These two domains establish the vocabulary and design philosophy the rest of the exam leans on.
- Be able to explain why perimeter-only models fail and what replaces implicit trust.
- Know how to reason about trust zones, segmentation, and least privilege as design decisions.
- Expect questions that ask which architectural choice best reduces attacker movement, not which product to buy.
Network-layer domains
Five domains form the classic network core: Layer 1/Layer 2 Defense, Fundamental Layer 3 Defense, Network Defenses, Network Proxies and Firewalls, and IPv6. Together they probably demand the most hands-on familiarity.
Layer 1/Layer 2 Defense and Fundamental Layer 3 Defense
Expect to reason about attacks and mitigations at the lower layers and about routing-level controls.
- Know common switch-level attack classes and the controls that counter them.
- Understand how routing and Layer 3 filtering contribute to containment.
- Be comfortable reading a described topology and spotting where a control is missing.
Network Proxies and Firewalls, and Network Defenses
These domains test how you choose and place enforcement points.
- Distinguish stateless filtering, stateful inspection, and proxy-based mediation, and know what each can and cannot see.
- Understand where inspection fits relative to encryption.
- Practice judging whether a described control actually addresses the stated threat.
IPv6
IPv6 earns its own domain because it is routinely overlooked in real architectures, and attackers know it.
- Understand addressing and how IPv6 behavior differs from IPv4 in ways that affect security controls.
- Know why unmanaged IPv6 on a "v4-only" network is a defensive blind spot.
- Work through filtering and transition scenarios rather than memorizing address formats alone.
Zero trust applied
Zero Trust Networking, Zero Trust Endpoints, and Network Encryption and Remote Access
This cluster is where theory becomes design.
- Connect identity, device posture, and policy enforcement into a coherent access decision.
- Understand how remote access and network encryption change visibility and trust assumptions.
- Be ready to compare legacy VPN-style access with more granular approaches and explain the tradeoffs.
Data and cloud
Data Discovery, Governance, and Mobility Management; Data-Centric Security; Cloud-based Security Architecture
These domains shift the focus from the network to the asset being protected and the environment it lives in.
- Know why you cannot protect data you have not located and classified.
- Understand controls that travel with the data rather than relying on a boundary.
- Be prepared to apply architecture principles to cloud and hybrid scenarios, including shared-responsibility reasoning.
Key Takeaway
Because GIAC publishes no domain weights, treat all 13 headings as fair game. Spend your first pass making sure you can say something precise about each one, then use practice questions to find the gaps and deepen those areas.
Building an Open-Book Index That Works
Open book is the single most misunderstood feature of GIAC exams. Hardcopy books, notes, and an index are permitted; electronic references and practice or exam question-and-answer materials are not. That means no laptop notes, no PDFs, and no bringing in a printed bank of practice questions. The proctor rules and modality (onsite via Pearson VUE or remote via ProctorU) can affect what is allowed at your desk, so read the GIAC Proctored Exam Reference Guide and the candidate agreement before test day.
An open-book exam rewards a good index and punishes a lazy one. With 96 seconds per question on average, an index is a retrieval tool, not a substitute for understanding. Build it like this:
- Index concepts, not page numbers alone. For each entry, record the term, a short disambiguating note, and the book and page. "Stateful inspection: tracks connection state; Book 2, p. 41" beats a bare term.
- Index by question trigger. Add entries for how a question might phrase the idea ("which control prevents...", "best placement for...") rather than only the textbook name.
- Build it during study, not the week before. Every time a practice question surprises you, add or refine an entry. Your index becomes a record of your own weak points.
- Keep it sortable. A spreadsheet you print and bind at the end lets you re-sort, merge, and prune as you learn.
- Prune before exam day. A bloated index slows you down. Cut entries you never needed during practice runs.
Training Path: SEC530 vs. Self-Study
The affiliated preparation course is SANS SEC530, "Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise." It is the natural companion to this certification, and the course materials are what many candidates turn into their open-book reference set. Our GDSA training overview goes deeper on options.
Two cautions about how to treat course content:
- The course is preparation, not the official exam outline. SEC530 sections, labs, and capstones do not establish official exam-domain counts, weights, or exhaustive exam coverage. GIAC's published exam objectives are the scope document; the course is one way to learn that scope.
- Course descriptions change. The current SEC530 web page and its linked undated brochure PDF differ in section names and content, and the live page includes expanded AI-era material. That is preparation content, not evidence of a newly versioned GDSA exam. Map whatever material you study back to the 13 published domains rather than assuming the course outline and the exam outline match.
| Approach | Strengths | Watch-outs |
|---|---|---|
| SANS SEC530 plus the exam attempt | Structured curriculum and course books that double as open-book references; the SANS-associated attempt is also USD 999, with course tuition additional | Course tuition is a significant added cost; you must still map content to the 13 published domains |
| Standalone exam attempt with self-study | Lower total outlay; training is recommended but not required | You must assemble and index your own reference materials; 120-day access window starts at activation |
Whichever route you choose, the full GDSA cost breakdown shows how the fees stack up, and our ROI analysis helps you decide whether the investment fits your goals.
A Domain-Sequenced Study Schedule
Rather than a generic weekly template, sequence the domains by dependency: concepts first, then the network stack from the bottom up, then applied zero trust, then data and cloud. Adjust the length to your own background and to the 120-day standalone access window if you are using that route.
Concepts and Zero Trust Fundamentals
- Work through Fundamental Security Architecture Concepts and Zero Trust Fundamentals.
- Start your index immediately, with definitions and trigger phrases.
- Why first: every later domain assumes this vocabulary.
The network stack
- Cover Layer 1/Layer 2 Defense, Fundamental Layer 3 Defense, and IPv6.
- Then Network Defenses and Network Proxies and Firewalls.
- Why bottom-up: firewall and proxy reasoning is easier once the lower layers are solid.
Applied zero trust and secure access
- Study Network Encryption and Remote Access, Zero Trust Networking, and Zero Trust Endpoints.
- Practice design-comparison questions: legacy access versus policy-based access.
Data and cloud
- Cover Data Discovery, Governance, and Mobility Management, Data-Centric Security, and Cloud-based Security Architecture.
- Tie these back to zero trust: protect the asset, not only the path to it.
Timed practice and index refinement
- Take timed full-length practice runs against the 2-hour limit and 63% target.
- Log every missed question, then fix the underlying concept and the index entry.
- Prune the index and finalize your hardcopy materials.
Practice questions are most useful in the second half of the plan. Our GDSA practice tests are designed for this phase: use them to find domains where your reasoning is shaky, not just to confirm what you already know. Remember that practice question-and-answer materials cannot be brought into the exam room, so rely on your own indexed notes.
Budget, Access Window, and Logistics
Plan the money and the calendar together, because both are fixed by GIAC's published terms.
- Standalone attempt: USD 999, excluding applicable sales tax and training tuition.
- Practice exam: USD 399, separately listed by GIAC.
- Retake: USD 899.
- Renewal: USD 499 standard renewal fee. The certification is valid for four years, and you renew with 36 CPE credits or by taking a renewal examination, plus the fee.
- Access window: 120 days from activation for a standalone attempt, so do not activate until you are close to ready.
Because a retake costs USD 899, a failed first attempt is expensive. That is the practical argument for finishing your timed practice runs and index pruning before you activate. Sitting the exam a few weeks later than planned costs far less than a retake. For scheduling mechanics, see GDSA exam dates and scheduling.
Calibrating Difficulty Honestly
The exam is not designed to be memorized; it is designed to test whether you can apply architecture principles to described situations. Candidates with strong networking backgrounds usually find the IPv6, Layer 2, and firewall material familiar and the data-centric and cloud domains newer. Candidates from cloud or identity backgrounds often have the reverse experience. Identify which camp you are in during week one and give your weaker clusters more time. For a fuller discussion, read how hard the GDSA exam is, and for the broader landscape of study resources, our main GDSA study guide hub collects related material.
Frequently Asked Questions
The public specification lists one proctored, web-based exam with 75 questions and a 2-hour time limit. Your account at exams.giac.org is the authority for attempt-specific format details, so verify it there.
The minimum passing score is 63%, which GIAC applies to exam versions released on or after August 3, 2019. That is a passing threshold, not a candidate pass rate, and no issuer-published pass rate has been verified.
Yes, within limits. Permitted items are hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited. Review GIAC's proctored exam guidance for your delivery method before test day.
No. GIAC lists no formal certification prerequisites, and training is recommended rather than required. SEC530 is the affiliated preparation course, but its content should be mapped to the 13 published exam domains rather than treated as the official outline.
GIAC lists a retake at USD 899, compared with USD 999 for a standalone first attempt. Prices exclude applicable sales tax and training tuition, and the standalone attempt gives you 120 days of access from activation.