- The Short Answer: What a GDSA Is
- The Name, the Issuer, and the Naming Quirk
- What the Credential Is Meant to Show
- The 13 Exam Domains at a Glance
- Zero Trust as the Organizing Idea
- Exam Format and Rules
- Fees, Access Window, and Renewal
- The SANS SEC530 Connection
- Who Holds It and Who Hires for It
- Sequencing Your Preparation Around the Domains
- Frequently Asked Questions
- GDSA is a GIAC credential in defensible security architecture, centered on zero trust, network defense, cloud, and data-centric security.
- The exam is one proctored web-based test: 75 questions, 2 hours, with a minimum passing score of 63%.
- It is open book, but only hardcopy books, notes, and an index; electronic references are prohibited.
- A standalone attempt costs USD 999, with a retake at USD 899 and renewal at USD 499.
The Short Answer: What a GDSA Is
A GDSA is a person who holds the GIAC Defensible Security Architecture certification, or the credential itself. It is issued by GIAC Certifications and aimed at practitioners who design, build, and improve the security architecture of an organization's networks, endpoints, cloud environments, and data flows. The word "defensible" matters: the emphasis is on architectures that assume attackers will get in and are built to limit damage, expose intrusions, and be maintained over time, rather than on perimeter-only thinking.
If you have landed on this page after seeing "GDSA" in a job posting, a resume, or a conference bio, this article explains exactly which credential that refers to, what it covers, and how the exam works. For a deeper treatment of the acronym itself, see our companion pieces on what GDSA stands for and the meaning of GDSA.
The Name, the Issuer, and the Naming Quirk
GIAC, the Global Information Assurance Certification program run by GIAC, LLC, administers the credential. Two names appear in official materials, and it helps to know both so you are not confused when you search:
- GIAC's pricing table, the SANS course page, and the SANS course brochure use the name GIAC Defensible Security Architecture.
- GIAC's current certification page titles the same credential GIAC Defensible Security Architect Certification (GDSA).
These refer to one and the same GDSA. Treat the difference as a labeling inconsistency rather than two separate certifications. When you register, the exam code and objectives are what matter, and you can confirm them through your GIAC account.
For the longer-form versions of this question, our pages on what GDSA certification is and the GDSA certification overview cover the same ground from other angles.
What the Credential Is Meant to Show
The certification targets architectural judgment. A holder should be able to look at a hybrid enterprise, with on-premises networks, cloud workloads, remote users, and sprawling data stores, and reason about where controls belong and why. That includes:
- Choosing and placing network defenses such as firewalls and proxies, and understanding what each can and cannot enforce.
- Applying zero trust principles to identity, endpoints, and networking rather than treating them as marketing vocabulary.
- Securing the lower layers (Layer 1, Layer 2, and Layer 3) that are often neglected once a design reaches the cloud.
- Planning for IPv6, which many networks run partially or unknowingly and frequently leave unmonitored.
- Locating, classifying, and protecting data wherever it moves, including on mobile devices.
- Designing network encryption and remote access that holds up under real operational constraints.
Note what this is not: it is not a pure penetration-testing or incident-response credential. It sits on the design and engineering side of defense, which shapes the kinds of questions you should expect.
The 13 Exam Domains at a Glance
GIAC publishes the exam objectives as thirteen domain headings. The public outline does not state percentage weights for them, so be wary of any source that claims precise weightings. The headings, in published order, are:
- Cloud-based Security Architecture
- Data Discovery, Governance, and Mobility Management
- Data-Centric Security
- Fundamental Layer 3 Defense
- Fundamental Security Architecture Concepts
- IPv6
- Layer 1/Layer 2 Defense
- Network Defenses
- Network Encryption and Remote Access
- Network Proxies and Firewalls
- Zero Trust Endpoints
- Zero Trust Fundamentals
- Zero Trust Networking
Below are a few of the domains and the kind of understanding each demands. For the full walkthrough, see our complete guide to all 13 GDSA content areas.
Network Proxies and Firewalls
Expect to reason about what different inspection and filtering technologies actually see and control.
- Where proxy-based and packet-filtering approaches differ in visibility
- How placement and policy design affect what an attacker can reach
- Why rule hygiene and change control are architectural concerns, not just operational ones
Layer 1/Layer 2 Defense
Low-layer attacks and controls are easy to overlook, which is exactly why they appear as a separate domain.
- Switch and local-network hardening concepts
- How lower-layer weaknesses undermine higher-layer controls
- Segmentation as a defensive foundation
IPv6
IPv6 is its own domain because dual-stack environments create blind spots when defenses and monitoring were built for IPv4 only.
- Differences in addressing and neighbor discovery that matter for security
- Ensuring filtering and visibility cover both protocols
Data Discovery, Governance, and Mobility Management
This domain pairs data protection with the realities of devices and information that leave the building.
- Finding and classifying data before trying to protect it
- Governance as the link between policy and technical controls
- Managing mobile access to organizational data
Zero Trust as the Organizing Idea
Three of the thirteen domains carry "Zero Trust" in their names: fundamentals, endpoints, and networking. That is a strong signal about the credential's philosophy, and the SANS course that supports it is titled around implementing zero trust for the hybrid enterprise. A productive way to study is to treat the other domains as supporting zero trust rather than as isolated topics:
- Network defenses, proxies, and firewalls become enforcement points in a zero trust design.
- Encryption and remote access become the mechanism for extending trust decisions to users who are off-network.
- Data-centric security shifts controls toward the data itself, a core zero trust move.
- Cloud architecture is where many zero trust ideas are easiest to put into practice and easiest to get wrong.
Key Takeaway
Learn the zero trust fundamentals domain first and use it as a lens. When you later study firewalls, VPNs, or cloud networking, ask what trust assumption each control makes and how a zero trust design would challenge it.
Exam Format and Rules
The GDSA exam is a single proctored, web-based test. The public specifications are:
| Item | Detail |
|---|---|
| Number of exams | One proctored web-based exam |
| Questions | 75 |
| Time allowed | 2 hours |
| Minimum passing score | 63% |
| Reference policy | Open book: hardcopy books, notes, and an index permitted |
| Prohibited | Electronic references and practice or exam question-and-answer materials |
| Testing options | Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules |
Two details deserve emphasis. First, the 63% minimum applies to exam versions released on or after August 3, 2019; it is a scoring specification, not a statement about how many candidates pass. GIAC has not published a verified pass rate, so be skeptical of any figure presented as official. Our pages on the GDSA passing score and what the pass-rate data does and does not show go into this in more detail.
Second, your specific attempt may differ slightly in objectives, question types, or format. GIAC identifies the candidate's own account at its attempts page as the authority for attempt-specific details, so check there once you are registered.
What the open-book rule really means
Open book does not mean easy. With 75 questions in 2 hours, you have well under two minutes per question on average, which leaves little room to hunt for answers. The practical approach is to build an index that points you to the right page quickly and to know the material well enough that the index is a safety net rather than a crutch. Our GDSA cheat sheet helps you identify which facts deserve a place in your own notes, and our overview of how hard the GDSA exam is discusses the time pressure in more depth.
Fees, Access Window, and Renewal
The published cost structure, excluding applicable sales tax and any training tuition, is:
| Item | Amount |
|---|---|
| Standalone exam attempt | USD 999 |
| Separately listed practice exam | USD 399 |
| Retake | USD 899 |
| Standard renewal | USD 499 |
| Exam attempt associated with SANS training | USD 999 (course tuition additional) |
A standalone attempt gives you 120 days of access from activation, so schedule your study plan backward from that window rather than activating early. The certification is valid for four years. To renew, you submit 36 CPE credits or pass a renewal examination, and you also pay the renewal fee. For a fuller financial picture, read our GDSA certification cost breakdown, and for scheduling considerations see GDSA exam dates and scheduling.
There are no formal certification prerequisites; training is recommended but not required. Our GDSA requirements page explains what that means for people coming from different backgrounds.
The SANS SEC530 Connection
The affiliated preparation course is SANS Institute's SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise. It is the training most closely tied to the credential, but a few cautions are worth stating clearly:
- The course syllabus is preparation curriculum, not the official exam outline. Its sections, labs, and capstone do not define exam-domain counts, weights, or exhaustive coverage.
- The live SEC530 web page and the linked public brochure differ in section names and content. The live page includes expanded AI-era material, which reflects course updates and is not evidence of a newly versioned GDSA exam.
- The authoritative list of what can be tested is GIAC's own objectives, which are the thirteen domains above.
If you are weighing training options, our GDSA training overview compares the routes available, and the GDSA study guide shows how to combine course material with independent preparation.
Who Holds It and Who Hires for It
The credential maps most naturally onto roles where someone is accountable for how security controls are designed and deployed across an environment. Common fits include:
- Security architects and security engineers responsible for network, cloud, and endpoint designs.
- Network and infrastructure engineers who are taking on more security responsibility, particularly around segmentation, firewalls, proxies, and remote access.
- Cloud security engineers who need to apply zero trust patterns to hybrid environments.
- Security operations and defensive leads who want to move from monitoring toward improving the underlying architecture.
- Consultants and assessors who review client environments and recommend architectural remediation.
Employers that value this kind of design-focused credential tend to be organizations with complex hybrid estates, regulated data, or an active zero trust initiative. Pay varies widely by location, seniority, and employer, and we do not cite specific figures here; our GDSA salary guide, GDSA jobs page, and analysis of whether the certification is worth it discuss the career side qualitatively.
Sequencing Your Preparation Around the Domains
Rather than a generic schedule, sequence your study so each stage builds on the previous one. The outline below is one reasonable arrangement for a candidate with working networking knowledge; stretch or compress it to fit your 120-day access window.
Foundations and Zero Trust Concepts
- Fundamental Security Architecture Concepts
- Zero Trust Fundamentals
- Begin building your index as you read
The Network Stack
- Layer 1/Layer 2 Defense and Fundamental Layer 3 Defense
- IPv6, studied alongside Layer 3 so the protocols are compared directly
- Network Defenses, then Network Proxies and Firewalls
Access, Encryption, and Zero Trust Applied
- Network Encryption and Remote Access
- Zero Trust Networking and Zero Trust Endpoints
Cloud and Data
- Cloud-based Security Architecture
- Data Discovery, Governance, and Mobility Management
- Data-Centric Security
Consolidation
- Timed practice using permitted formats, then index refinement
- Review the domains where lookups were slowest
The reasoning is that the network-layer domains are conceptual prerequisites for the zero trust networking and remote access material, and the cloud and data domains are easiest once you have a firm zero trust mental model. Timed practice in the final stretch is where you test whether your index actually works under the 2-hour limit. You can run realistic drills on our GDSA practice test site, and the main practice platform lets you check weak domains before you spend on an official attempt.
Key Takeaway
Because the exam is open book with a tight clock, your index quality decides how much time you recover. Build it by domain as you study, not in a rush afterward, and test it with timed practice at least twice before exam day.
Frequently Asked Questions
In this context it refers to the GIAC Defensible Security Architecture certification. GIAC's current certification page titles the same credential GIAC Defensible Security Architect Certification, so you may see either wording for the one GDSA credential.
No. There are no formal certification prerequisites, and training is recommended rather than required. A standalone exam attempt is available without taking the associated SANS SEC530 course.
The exam is a single proctored web-based test with 75 questions in 2 hours, and the minimum passing score is 63%. Your account's attempt details are the authority for your specific version.
Yes, it is open book, but only hardcopy books, notes, and an index are permitted. Electronic references and practice or exam question-and-answer materials are prohibited, so confirm the details for your chosen testing modality.
It is valid for four years. Renewal requires either 36 CPE credits or a renewal examination, plus the renewal fee, which is currently listed at USD 499 before applicable taxes.
In short, a GDSA is a defender who thinks in architectures: someone who can place controls across layers, apply zero trust principles, and protect data and access in a hybrid environment. If that matches the work you do or want to do, the thirteen domains above are your roadmap, and the linked guides on this site can take you from here to a scheduled exam.