What Is GDSA?

The Short Answer: What GDSA Is

GDSA stands for GIAC Defensible Security Architecture. It is a security certification administered by GIAC Certifications (GIAC, LLC), the certification body associated with the SANS Institute ecosystem. It validates that a practitioner can design, engineer, and reason about security architecture that holds up under real attack, not just architecture that looks tidy on a diagram.

The emphasis is deliberately architectural. Where many security credentials test whether you can recognize a threat or recite a control family, GDSA tests whether you can decide where controls belong: how to segment a network, how to push enforcement toward endpoints and data, how to build trust decisions into every connection, and how to extend all of this into cloud and hybrid environments. If you want the shorter definitional versions of this topic, our pages on what GDSA certification is and what GDSA stands for cover the basics; this article goes further into how the credential is built and who it serves.

The Name, the Issuer, and Why the Acronym Needs Care

The acronym GDSA is not unique across the security and IT world, so precision matters. On this site, GDSA always means the GIAC credential, issued by GIAC, and nothing else. One naming wrinkle is worth knowing about: GIAC's current certification page titles the credential "GIAC Defensible Security Architect Certification (GDSA)," while GIAC's pricing table, the SANS course page, and the SANS brochure use "GIAC Defensible Security Architecture." Both labels point to the same credential. You may see either on job postings, training pages, and your GIAC account.

The credential's public exam-objective outline, which GIAC publishes under "Exam Certification Objectives & Outcome Statements," is the authoritative public statement of scope. For attempt-specific details such as the exact objectives, question types, and passing score attached to your assigned exam version, GIAC points candidates to their own account at exams.giac.org. Treat that account as the final authority; everything in public summaries, including this one, is a description of the public specification.

The Exam at a Glance

The format is compact and consistent with GIAC's general approach: one proctored, web-based exam. Here are the specifications published by GIAC:

Two pieces of arithmetic put this in perspective. Two hours for 75 questions averages out to well under two minutes per question, which is tight when scenarios require you to reason through a network diagram or a policy decision. And a 63% minimum means you need to answer roughly 48 of the 75 questions correctly if every question carries equal weight, though GIAC's own account guidance governs how your attempt is actually scored.

A note on the 63% figure: GIAC applies this passing-score specification to exam versions released on or after August 3, 2019. That date is a scoring applicability date, not a syllabus revision date, and the candidate's assigned exam version was not part of the public specifications. The 63% is also a cut score, not a pass rate. No issuer-published pass rate has been verified, so be skeptical of any site quoting one. For a deeper treatment, see our pages on the GDSA passing score and what the pass-rate data does and does not show.

The 13 Published Exam Domains

GIAC's public outline lists 13 domains. The outline does not assign percentage weights to them, so this article does not either. Anyone presenting a neat weight table for this exam is guessing or importing numbers from elsewhere. The domains, in the order GIAC publishes them, are:

1. Cloud-based Security Architecture
2. Data Discovery, Governance, and Mobility Management
3. Data-Centric Security
4. Fundamental Layer 3 Defense
5. Fundamental Security Architecture Concepts
6. IPv6
7. Layer 1/Layer 2 Defense
8. Network Defenses
9. Network Encryption and Remote Access
10. Network Proxies and Firewalls
11. Zero Trust Endpoints
12. Zero Trust Fundamentals
13. Zero Trust Networking

The list reads like two cooperating halves. One half is the classic network-defense stack, moving up from physical and data-link attacks through routing and IPv6, then into firewalls, proxies, and encrypted remote access. The other half is the modern re-architecture of trust: zero trust principles, zero trust applied to endpoints and networks, data-centric controls, and cloud architecture. A strong candidate understands why the first half is insufficient on its own and how the second half builds on it. Our complete guide to all 13 GDSA content areas walks through each one in detail.

Domains that tend to surprise candidates

What "Defensible" Actually Means in This Credential

The word "defensible" is the philosophical core of the credential. A defensible architecture is one designed with the assumption that attackers will get in, so that the design limits what they can do, makes their actions visible, and keeps a single failure from becoming total compromise. That mindset shows up throughout the domain list:

• Segmentation and containment: Network defenses, Layer 3 defense, and firewall and proxy placement all serve the goal of restricting lateral movement.
• Explicit trust decisions: The three zero trust domains replace implicit "inside means trusted" assumptions with per-request verification of users, devices, and context.
• Protection that follows the data: Data-centric security and data governance move controls closer to the asset itself rather than relying on a perimeter.
• Encrypted, authenticated access: Network encryption and remote access address how legitimate users reach resources without exposing the network.

How SANS SEC530 Relates to the Exam

The affiliated training for this credential is SANS SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise. It is the most direct preparation path, but it is worth being precise about what that relationship means. The course is preparation curriculum, and its sections, labs, and capstones do not by themselves define the official exam domains, their weights, or the exam's exhaustive coverage. GIAC's published objectives remain the scope statement for the exam.

There is another wrinkle. The current SEC530 web page and the linked public syllabus brochure differ in section names and content, and the brochure carries no verified printed revision date. The live page includes expanded material on AI-era topics; that is preparation content and is not evidence that the GDSA exam itself has been newly versioned. If you are building a study plan, anchor it to the 13 GIAC domains first and use course material to fill in depth. Our page on GDSA training options covers the preparation landscape, and the GDSA study guide turns it into a plan.

Fees, Testing Modality, and Attempt Access

The costs below come from GIAC's published pricing and exclude applicable sales tax and any training tuition:

A standalone attempt gives you 120 days of access from activation, which is a real planning constraint: activating too early burns the clock before you have studied, and activating too late invites scheduling pressure. You test either onsite at a Pearson VUE center or remotely via ProctorU, subject to GIAC's modality rules. For the full cost picture, including how these pieces combine, see the GDSA certification cost breakdown, and for scheduling mechanics see GDSA exam dates and scheduling.

Validity and renewal

The certification is valid for four years. To renew, you either earn 36 CPE credits or pass a renewal examination, and in both cases you pay the renewal fee. Because the credential is built on fast-moving topics such as cloud, zero trust, and hybrid enterprise design, renewal by CPE tends to fit practitioners who stay active in the field.

Working With an Open-Book Exam

GDSA is open book, but the permitted materials are strictly defined: hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice or exam question-and-answer materials. That second restriction matters: you cannot bring a printed set of practice questions and answers into the room.

For a 75-question, two-hour exam, an open-book policy is not a safety net so much as a speed tool. If you have to look up every topic, you will run out of time. The value of a well-built index is that it lets you confirm a detail in seconds, such as the behavior of a specific protocol feature or the name of a control, while your actual understanding of the architecture carries you through the scenario reasoning. Build your index around concepts and decision points across the 13 domains rather than copying passages. Our GDSA cheat sheet is a good starting point for deciding which facts deserve the fastest lookup.

Who the Credential Fits and Who Hires for These Skills

The skills in the domain list map to roles where someone is responsible for how systems are structured, not only how alerts are triaged. Common fits include:

• Security architects and engineers designing segmentation, remote access, and zero trust programs
• Network security engineers who own firewalls, proxies, and routing and switching defenses
• Cloud and hybrid-infrastructure security specialists translating on-premises principles into cloud designs
• Security consultants and assessors who evaluate and recommend architectural improvements
• Senior defenders and leads who need to move beyond reactive monitoring toward design

Employers who value this skill set tend to be organizations running hybrid enterprises, regulated environments, and security consultancies, anywhere a zero trust migration or network redesign is underway. Job postings rarely list this credential alone, so treat it as a differentiator alongside hands-on experience. For market-oriented views, see GDSA jobs, the GDSA salary guide, and the ROI analysis of whether the certification is worth it. Eligibility specifics are in GDSA requirements: there are no formal prerequisites, though training is recommended, and the question of how hard the exam is depends heavily on your prior architecture experience.

Sequencing the Domains in a Study Plan

Generic study routines matter far less than the order in which you tackle the content. The 13 domains build on one another, so a sensible sequence follows dependency rather than the published list order. Here is one way to structure it, tied directly to the domains:

The logic is simple: the lower-layer and enforcement domains give you the vocabulary and mechanics, zero trust then reframes how those mechanics are used, and data and cloud domains show where the model is applied at the edges of the enterprise. Adjust the pacing to your background; a network engineer may compress Week 1, while a cloud specialist may need more time on layer-2 and IPv6 material. The full GDSA study guide expands this into a detailed plan, and our practice test site lets you check your readiness by domain before you commit your exam attempt. Working through timed questions on the main practice platform is also the best way to confirm your index actually speeds you up.

Frequently Asked Questions