What Is GDSA Certification?

What GDSA Certification Actually Is

GDSA stands for GIAC Defensible Security Architecture. It is issued by GIAC Certifications, the certification body closely associated with the SANS Institute. The credential validates that a practitioner can design, evaluate, and improve security architectures that withstand real adversaries, rather than merely pass a compliance checklist.

The word "defensible" is the key to the whole certification. A defensible architecture is one where defenders hold structural advantages: segmentation that limits blast radius, identity and policy controls that make lateral movement hard, visibility that makes intrusions detectable, and data protections that reduce the damage of a breach. The exam tests whether you can reason about those properties across networks, endpoints, data, and cloud environments.

If you are comparing definitions you have seen elsewhere, our short explainers on what GDSA is and what GDSA stands for cover the naming basics, and the GDSA certification overview provides a quick orientation. This article goes deeper into how the credential is structured and what it demands.

The Name Issue: Architecture vs. Architect

You will see two slightly different names for this credential. GIAC's pricing table, the SANS course page, and the SANS brochure use "GIAC Defensible Security Architecture." GIAC's current certification page titles the same credential "GIAC Defensible Security Architect Certification (GDSA)." They refer to the same certification and the same exam.

Exam Format and Testing Rules

The GDSA exam is a single proctored, web-based exam with 75 questions and a 2-hour time limit. The minimum passing score is 63%. GIAC applies this passing-score specification to exam versions released on or after August 3, 2019. That date describes when the scoring specification applies; it is not a syllabus revision date.

Two caveats matter. First, your assigned exam version is visible in your GIAC account, and GIAC identifies your account's attempts page as the authoritative source for attempt-specific objectives, question types, format, and passing score. Check it before you sit. Second, the minimum passing score is not a pass rate. No issuer-published pass rate has been verified, so be skeptical of any site quoting one; see our discussion of the GDSA pass rate and the GDSA passing score for what can and cannot be said.

Open-book, with limits

GIAC exams are open book, which surprises many first-time candidates. You may bring hardcopy books, notes, and an index. Electronic references are prohibited, and so are practice-exam or exam question-and-answer materials. The practical consequence is that your index becomes a core study artifact: a well-built index lets you locate a concept in seconds, while a poor one wastes the minutes you need for 75 questions in 2 hours.

Where and how you test

Testing is delivered through Pearson VUE onsite or ProctorU remotely, subject to GIAC modality rules. Because the exam is proctored, the environment rules for remote sessions are strict; read GIAC's proctor guidance well before exam day rather than discovering a restriction in the check-in process.

The 13 Domains, Explained by Theme

GIAC publishes thirteen exam-objective headings for GDSA. The public outline does not assign percentage weights to them, so treat every domain as potentially examinable rather than assuming some count more. For a deeper walk-through, see our complete guide to all 13 GDSA content areas. Here is how the domains cluster conceptually.

Foundations and strategy

Network-layer defense

A large share of the domain list is network-centric, reflecting the discipline's roots. These domains reward candidates who can trace traffic through each layer and explain what a control does and does not stop.

• Layer 1/Layer 2 Defense: switch and local-segment protections, and the attacks that target them.
• Fundamental Layer 3 Defense: routing, filtering, and addressing-layer controls.
• IPv6: a dedicated domain, signaling that dual-stack environments and IPv6-specific risks are fair game.
• Network Defenses: broader perimeter and internal network protection strategy.
• Network Proxies and Firewalls: placement, policy design, and the limits of each control type.
• Network Encryption and Remote Access: protecting traffic in transit and designing secure access paths for remote users.

Zero trust

Three domains carry the zero trust name directly: Zero Trust Fundamentals, Zero Trust Networking, and Zero Trust Endpoints. Together they treat zero trust not as a product but as an architectural approach that assumes breach and verifies access continuously.

Data and cloud

Three domains move beyond the network: Cloud-based Security Architecture, Data Discovery, Governance, and Mobility Management, and Data-Centric Security. The first applies architectural thinking to cloud environments. The latter two ask how you find sensitive data, govern where it lives and moves, and protect it directly rather than relying solely on perimeter controls.

Where SANS SEC530 Fits

The affiliated preparation course is SANS SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise. It is the natural training path, though training is recommended rather than required.

Be careful about one point: the course is a preparation curriculum, not the exam specification. Its sections, labs, and capstone do not establish official exam-domain counts, weights, or exhaustive exam coverage. The live SEC530 page also includes expanded AI-era material, and the separately linked public brochure differs from the current page in section names and content. That expanded material is preparation content and should not be read as evidence of a newly versioned GDSA exam.

For the training landscape and what it involves, see our page on GDSA training.

Registration, Fees, and Attempt Mechanics

There are no formal certification prerequisites. Anyone can register, though the exam assumes working knowledge across networking, security controls, and cloud concepts. Our breakdown of GDSA requirements covers eligibility in more detail.

All figures exclude applicable sales tax and training tuition. The full cost picture depends heavily on whether you attend the SANS course, so our GDSA certification cost breakdown walks through the scenarios.

Who Benefits From This Certification

GDSA suits practitioners whose work involves deciding how security controls fit together, not just operating a single tool. Typical profiles include:

• Security architects and engineers designing segmentation, access, and monitoring for enterprise or hybrid environments.
• Network security engineers broadening from firewalls and proxies into zero trust and cloud design.
• Security operations and defensive analysts who want to understand why architectures succeed or fail under attack, and to influence design upstream.
• Technical leads and consultants who review or advise on architecture and need a credible, vendor-neutral baseline.

Because the certification is vendor-neutral and concept-driven, it signals architectural judgment rather than proficiency with a specific product. Employer demand varies by region and sector, and we avoid quoting numbers we cannot verify; our pieces on GDSA jobs, the GDSA salary guide, and whether the certification is worth it discuss the career side in qualitative terms.

Sequencing Your Preparation Around the Domains

Because the domains build on one another, order matters. A sensible sequence moves from concepts to layers to zero trust to data and cloud, then closes with index refinement and timed practice. This is one possible arrangement over six weeks:

Foundations come first because later zero trust material assumes you already understand segmentation, filtering, and encryption. For a fuller method, see our GDSA study guide, and for a condensed reference to review near exam day, the GDSA cheat sheet. To judge how much preparation you personally need, read how hard the GDSA exam is.

Pressure-test with realistic questions

Since the exam is scenario-flavored and time-boxed, practicing under conditions that resemble the real thing matters. Use our GDSA practice tests to check whether you can locate and apply concepts in your index at pace. Remember that practice and question-and-answer materials are not allowed in the exam room, so your index should contain your own notes and concept explanations rather than memorized question banks.

Staying Certified: The Four-Year Cycle

A GDSA certification is valid for four years. To renew, you can earn 36 CPE credits or pass a renewal examination, and in either case you pay the standard renewal fee of USD 499 (excluding tax). Because ongoing learning is built into the cycle, the credential signals continuing currency in a field where architecture guidance shifts as cloud, identity, and zero trust practices evolve.

Plan renewal early. Logging relevant conference attendance, training, and security work as you go is far easier than reconstructing four years of activity at the deadline. GIAC's renewal guidance in your account is the authoritative reference for what qualifies.

If you are weighing GDSA against your own goals, the what is GDSA certification overview and the main practice test site are good next stops.

Frequently Asked Questions