Security architects are judged on designs that survive a breach, yet most architecture credentials test frameworks and vocabulary rather than the network, endpoint and data controls that make a design defensible. The GIAC Defensible Security Architect (GDSA) certification is GIAC's practitioner credential for that engineering side of architecture: layer 1 to layer 3 defences, IPv6, proxies and firewalls, data-centric controls, cloud architecture and Zero Trust. This guide sets out what GIAC publishes about GDSA (exam format, the 13 objectives, delivery, prices and renewal), then adds a preparation plan, a decision on when GDSA is the right choice and where it sits on an architect's career path. It is written for network and security engineers moving into architecture, existing architects who want a technical credential, and managers deciding whether to fund it. Facts are as published on giac.org, checked 27 October 2026; GIAC states that prices can change, so check current fees and exam details in your GIAC account before you register.
Key takeaways
- It is a short, dense exam. GDSA is one proctored exam of 75 questions in 2 hours, with a minimum passing score of 63% for exam versions released on or after 3 August 2019.
- The scope is engineering, not governance. The 13 objectives run from VLAN hopping, 802.1X and bogon filtering to database activity monitoring, micro-segmentation and Zero Trust endpoints.
- Zero Trust carries real weight. Three objectives are explicitly Zero Trust (fundamentals, networking, endpoints) and a fourth covers presumption of compromise and micro-segmentation as core concepts.
- It costs the standard GIAC price. GIAC lists a certification attempt at $999, a retake at $899 and a practice exam at $399 (USD, excluding tax), usually on top of SANS SEC530 training.
- Renewal is every four years. Holders earn 36 CPEs and pay the renewal fee ($499), or renew by retaking the exam.
Who the certification is for
GIAC classes GDSA as a practitioner certification. Its published audience is security architects, network engineers and architects, security analysts, senior security engineers, system administrators, technical security managers, computer network defence (CND) analysts, security monitoring specialists and cyber threat investigators.
- Good fit: network or infrastructure engineers who already build firewalls, VLANs and remote access and want to be recognised for designing them defensibly; architects who came up through governance and need to prove technical depth; SOC and monitoring staff who are asked to design the telemetry and controls they rely on.
- Good fit for employers: the GDSA page carries DoD 8140, DORA and NIS2 alignment badges, without listing specific work roles. If you need GDSA for a DoD 8140 role, confirm the mapping with the hiring organisation.
- Weaker fit: enterprise architects whose work is capability modelling and portfolio governance (the exam has almost no governance content); cloud-only architects, for whom GCAD may be closer (see the GIAC Cloud Certifications Compared Guide); and leaders who need a management credential (see the Security Leadership Certifications Compared Guide).
For certifications across all levels and vendors, see the Cybersecurity Certifications Guide. This page covers GDSA only.
Exam format and domains
Format
| Item | GDSA (as published by GIAC, checked 27 October 2026) |
|---|---|
| Certification type | Practitioner certification |
| Exam | 1 proctored exam |
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 63% (exam versions released on or after 3 August 2019; confirm your attempt in the Certification Information section of your GIAC account) |
| Attempt window | 120 days from activation, which follows approval of your application |
| Delivery | Web-based and proctored: remotely through ProctorU or on site at a Pearson VUE centre |
| Practice tests | Sold separately; the question bank is limited, so questions can repeat, and they never contain live exam questions |
| Aligned training | SANS SEC530: Defensible Security Architecture and Engineering (live and OnDemand); affiliate training is also listed |
At 75 questions in 120 minutes you have 96 seconds a question. GIAC exams allow printed reference material, but GDSA leaves less lookup time per question than most GIAC exams, so the index is a fallback, not a strategy. Check GIAC's current proctoring rules for what you may bring.
The 13 certification objectives
GIAC lists the objectives without weightings. The grouping and the design question in the last column are ours; objective names are GIAC's.
| Group | GIAC objective | What GIAC lists under it | The design question to be able to answer |
|---|---|---|---|
| Concepts | Fundamental Security Architecture Concepts | Perimeter weaknesses, presumption of compromise, Zero Trust, kill chain, diamond model, SDN, micro-segmentation, threat and attack surface analysis | Where does this design assume the perimeter holds, and what happens when it does not? |
| Zero Trust Fundamentals | Zero Trust architecture, credential rotation, responding to pivoting adversaries and insider threats | Which trust decisions are made per request, and on what signals? | |
| Network layers | Layer 1/Layer 2 Defense | VLANs, CDP, MAC spoofing, ARP poisoning, DHCP starvation, VLAN hopping, 802.1X, NAC | Can an unknown device on a wall port reach anything useful? |
| Fundamental Layer 3 Defense | Securing layer 3 hardware and protocols, CIDR, routing attacks, auditing tools, SNMP, NTP, bogon filtering | Are router management planes, SNMP and NTP locked down and audited? | |
| IPv6 | Addressing, dual stack, tunnelling, router advertisement attacks and mitigations | Is IPv6 enabled but unmonitored on segments that are "IPv4 only"? | |
| Zero Trust Networking | Authenticating and encrypting traffic, domain isolation, single packet authentication, red herring and proactive defences | Is east-west traffic authenticated, or merely allowed by subnet? | |
| Inspection and access | Network Proxies and Firewalls | Web proxies, SMTP proxies, next-generation firewalls | Where is outbound traffic forced through inspection, and what bypasses it? |
| Network Defenses | NIDS, NIPS, network security monitoring, sandboxing, encryption, DDoS protection | Which sensors see which segments, including encrypted flows? | |
| Network Encryption and Remote Access | Secure remote access, two-factor authentication for VPNs, jump boxes | Does every administrative path go through a hardened, logged jump host with MFA? | |
| Zero Trust Endpoints | Automated patching, reduced user privileges, host hardening, host IDS/IPS, endpoint firewalls, endpoint log collection at scale | Could you collect and use logs from every endpoint during an incident? | |
| Data and cloud | Data-Centric Security | Reverse proxies, WAFs, database firewalls, database activity monitoring | Which controls sit in front of the data itself, not just the network? |
| Data Discovery, Governance, and Mobility Management | File classification, DLP, database governance, MDM | Do you know where sensitive data lives and which devices can carry it? | |
| Cloud-based Security Architecture | Cloud security, on-premises hypervisors, segmentation, attack surface reduction, delivery models, containers | Do the same segmentation principles hold in the hypervisor and the cloud account? |
Nine of the 13 objectives are network-centric. Candidates from an application, cloud or governance background should expect most of their study time to go on layer 2 and layer 3 attacks and mitigations, IPv6 and inspection architecture. For background reading, see the Network Segmentation Guide and the NIST SP 800-207 Zero Trust Architecture Guide.
Where identity fits: the Zero Trust objectives name credential rotation, reduced user privileges, 802.1X and NAC, two-factor VPN access and jump boxes. In practice the accounts that most often defeat a segmented design are service accounts and machine credentials with broad network reach. Revise them alongside user accounts; see the Privileged Access Management Guide.
Prerequisites and experience
The GDSA page lists no formal prerequisite and no minimum experience. GIAC notes that practical work experience, college courses or self-paced study can build the mastery needed. In practice the exam assumes you can already:
- Read a network design: VLANs, trunking, routing, CIDR, and where firewalls, proxies and sensors sit.
- Explain layer 2 attacks and their fixes: ARP poisoning, DHCP starvation, MAC spoofing and VLAN hopping, and what 802.1X, NAC and switch hardening do about each.
- Work with IPv6: addressing, dual stack, tunnelling and router advertisement behaviour.
- Describe data and endpoint controls: WAFs, database firewalls and activity monitoring, DLP, MDM, host IDS/IPS and endpoint firewalls.
Two to three years in network or security engineering is a realistic starting point; this is our judgement, not a GIAC requirement.
Preparation plan
- Decide on training first: SEC530 is the aligned course. If your employer funds it, the course books become your reference set. If not, plan a reading list per objective from vendor hardening guides and standards such as NIST SP 800-207.
- Baseline (week 1): rate yourself red, amber or green against each of the 13 objectives. For most candidates IPv6, layer 3 protocol security (SNMP, NTP, routing attacks) and data-centric controls are the reds.
- Labs (weeks 2 to 6): build a small lab with a managed switch or virtual equivalent, a firewall, a proxy and an IDS. Configure port security and 802.1X, enable IPv6 and observe router advertisements, push traffic through a proxy and watch what the IDS sees. Architecture questions are easier when you have broken a design yourself.
- Design drills (weeks 5 to 7): for each objective, sketch a reference design for a mid-sized organisation and write the three ways it fails. This mirrors the "presumption of compromise" thinking the objectives describe.
- Index (alongside study): build your own sorted index of terms, protocols, ports and controls with book and page references.
- Practice exam (week 8): sit one practice exam under real conditions, timed at 96 seconds a question, and log each lookup that took too long.
- Close gaps and sit (weeks 9 to 10): restudy the weakest objectives, take the second practice exam about a week before the real one, and book the proctored slot well inside the 120-day window.
Small vs large organisations: a small team weighing a $999 exam plus SANS training should ask whether the architect will actually own network and data control design; if the role is mostly cloud, GCAD is a closer match. Large organisations with a SANS agreement can pair SEC530 with GDSA for network and security engineers being developed into architects, and use the objectives as a common design review vocabulary.
Measuring readiness
- Practice scores: both practice exams clearly above 63%, ideally above 75% to allow for exam-day nerves.
- Pace: 75 questions finished with at least 15 minutes to spare.
- Lookup rate: fewer than one question in six needing the index.
- Objective coverage: all 13 objectives amber or green before booking.
- After certification: 36 CPEs logged across the four-year cycle within GIAC's category caps.
Cost, renewal and continuing education
| Item | Amount or rule (GIAC, USD excluding tax, checked 27 October 2026) |
|---|---|
| Certification attempt | $999 |
| Exam retake | $899 |
| Attempt extension | $479 |
| Practice exam | $399 |
| Missed proctored appointment (reseating) | $175, with a 7-day extension from the current deadline |
| Renewal cycle | Four years: 36 CPEs, or retake the exam |
| Renewal fee | $499; further renewals within two years of a full-price renewal are $249 each |
These are GIAC fees only; check current fees before booking. SANS training is priced separately and is normally the larger cost.
CPE categories and caps
| Category | Maximum CPEs | Applies to up to |
|---|---|---|
| GIAC/SANS affiliated programmes | 36 | 5 certifications |
| Career development activities | 36 | 3 certifications |
| Other industry training | 18 | 3 certifications |
| SANS NetWars | 12 | 3 certifications |
| Cyber ranges | 12 | 3 certifications |
| Work experience | 12 | 3 certifications |
| Community participation | 12 | 3 certifications |
Holders of several GIAC certifications save by aligning renewals so that later ones fall within two years of a full-price renewal and qualify for the $249 rate.
Common failure patterns
- Studying Zero Trust as a slogan: the objectives ask about mechanisms (domain isolation, single packet authentication, authenticated east-west traffic), not definitions.
- Skipping IPv6: it has its own objective, and candidates who have never worked with router advertisements lose easy marks.
- Ignoring layer 1 and 2: architects who think in cloud accounts often forget CDP, DHCP starvation and VLAN hopping.
- Treating data controls as an application topic: database firewalls, activity monitoring and DLP are architecture objectives here.
- Running out of time: at 96 seconds a question, a lookup-heavy approach does not finish.
- Letting the 120-day window lapse: an extension costs $479.
Where it fits on the career path
| Stage | Typical credential | Relationship to GDSA |
|---|---|---|
| Foundation | GSEC or Security+ | Breadth before architecture depth |
| Engineering and monitoring | GMON, GCDA | The detection side of the same defensible design |
| Architecture | GDSA (network and data), GCAD (cloud) | Technical architecture credentials; many architects hold one of each |
| Senior architect or management | CISSP and its ISSAP concentration, or GSLC | Broader governance and leadership scope |
- Before it: the GIAC GSEC Guide or the CompTIA Security+ Guide.
- Alongside it: the GIAC Detection and Monitoring Guide covers GMON, whose objectives overlap with GDSA on NIDS, proxies and endpoint monitoring.
- After it: the CISSP Certification Guide for breadth, or a cloud architecture credential.
- Role: see the Security Architect Career Guide and the Security Architecture Review Guide.
GIAC does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates.
Practitioner checklist
- Confirm the current price, passing score and exam version in your GIAC account before you activate.
- Rate yourself against all 13 objectives and plan extra time for IPv6, layer 2 and layer 3.
- Build a lab with a switch, firewall, proxy and IDS, and break your own designs.
- Write a reference design and its failure modes for each objective group.
- Build your own index with book and page references.
- Sit practice exams timed at 96 seconds a question.
- Book the proctored appointment early and inside the 120-day window.
- After passing, diarise the four-year expiry and log 36 CPEs within the category caps.
Standards and references
- GIAC: GIAC Defensible Security Architect (GDSA)
- GIAC: Certification Pricing
- GIAC: How to Renew
- GIAC: CPE Information
- GIAC: Certifications
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Security Architect Career Guide · Network Segmentation Guide · GIAC Cloud Certifications Compared Guide · GIAC GSEC Guide