- How the 17 Areas Are Published
- Exam Format and Mechanics
- Account, Configuration, and Endpoint Domains
- Network, Perimeter, and Encryption Domains
- Detection, SIEM, and Threat-Informed Domains
- Attack and Exploit Knowledge Domains
- Vulnerability, Patching, and Inventory Domains
- Sequencing the Domains Across Your Prep
- Registration, Fees, and Renewal
- Where These Skills Get Used
- Frequently Asked Questions
- GIAC publishes 17 GMON exam objectives, but this public outline supplies no percentage weights for any of them.
- The exam has 82 questions in 3 hours with a 74% minimum passing score, mixing multiple-choice and CyberLive practical tasks.
- The three-hour limit covers the whole exam; no separate practical timer or question-type split has been published.
- The exam is open book: hardcopy books, notes, and an index are permitted, while electronic references are prohibited.
How the 17 Areas Are Published
The GIAC Continuous Monitoring Certification (GMON) is administered by GIAC Certifications. Its public objectives page lists 17 headings under "Exam Certification Objectives & Outcome Statements." This guide walks through those headings in the order GIAC prints them, so you can map your preparation to the official outline rather than to a third party's interpretation.
Two cautions before diving in. First, GIAC's public outline provides no percentage weights. Any article, forum post, or study group that tells you "Domain X is 15% of the exam" is inventing a number for this credential. Second, your own exam attempt is the final authority: GIAC directs candidates to the attempt page in their account for attempt-specific objectives, question types, format, and passing score. The public specification is a planning aid, not a contract for your particular exam version.
SANS also publishes a GMON overview that groups the same 17 objectives into five preparation categories. Those categories, along with the six sections of the affiliated SEC511 course, are teaching structures. They are not additional official domains and they do not change the count of 17. For a broader orientation, see What Is GMON Certification? and the GMON Study Guide 2026: How to Pass on Your First Attempt.
Exam Format and Mechanics
The GMON exam is a single proctored, web-based exam with 82 total questions and a three-hour time limit. The minimum passing score is 74%. GIAC states that this passing-score specification applies to exam versions released on or after December 23, 2015; that date marks when the scoring specification took effect, not a recent syllabus revision. Note too that the 74% figure is a cut score, not a pass-rate statistic. No issuer-published pass rate has been verified, which is why our GMON Pass Rate 2026: What the Data Shows article deals in qualitative evidence only.
Multiple-Choice Plus CyberLive
The exam combines multiple-choice questions with CyberLive practical tasks. GIAC's description of its exam engine explains that candidates answer multiple-choice items and then work through hands-on CyberLive tasks in the same sitting. The three hours cover everything; no separate practical timer and no fixed split between question types has been published, so do not budget time on the assumption of one. Practice moving briskly through knowledge questions so you bank time for the hands-on portion.
Open Book, With Rules
The exam is open book. Permitted materials are hardcopy books, notes, and an index. Electronic references, along with practice-exam and exam question-and-answer materials, are prohibited. A well-built index is a genuine asset for a 17-domain exam, because the breadth means you will meet topics you have not touched in months. Our GMON Cheat Sheet 2026 covers the facts worth keeping at your fingertips, and How Hard Is the GMON Exam? discusses how the breadth and practical tasks shape difficulty.
| Exam Attribute | GMON Specification |
|---|---|
| Administrator | GIAC Certifications |
| Total questions | 82 |
| Time limit | 3 hours (entire exam) |
| Minimum passing score | 74% |
| Question styles | Multiple-choice plus CyberLive practical tasks |
| Reference policy | Open book: hardcopy books, notes, index; no electronic references |
| Proctoring | Pearson VUE onsite or ProctorU remote, subject to GIAC rules |
Account, Configuration, and Endpoint Domains
The opening domains of the outline concern who and what is touching your environment, and how the systems themselves are configured. These are the foundations of continuous monitoring: if you cannot trust identities and endpoint state, upstream alerting is noise.
Domain 1: Account & Privilege Monitoring & Authentication
Expect questions about detecting misuse of accounts and elevated rights, and about the authentication mechanisms that underpin trust.
- What privileged-account activity looks like in logs and why it deserves distinct monitoring
- How authentication events inform detection of credential abuse
- Where account monitoring feeds into central log analysis
Domain 3: Configuration Monitoring
This domain is about noticing when systems drift from their intended state.
- Detecting unauthorized or unexpected configuration change
- Relating configuration monitoring to baselines (see Domain 12)
- Understanding what evidence configuration data provides during an investigation
Domain 5: Device Monitoring
Visibility into the health, state, and activity of devices across the enterprise.
- What telemetry devices can provide and how to collect it sensibly
- Connecting device-level observations to broader monitoring goals
Domain 8: HIDS/HIPS/Endpoint Firewalls
Host-based detection, prevention, and filtering controls. Know the difference between detecting and preventing at the host, and where endpoint firewalls fit alongside network controls.
- Strengths and blind spots of host-based versus network-based sensing
- How host-level alerts complement network observations
Network, Perimeter, and Encryption Domains
A large cluster of the 17 objectives concerns the network layer. Since SEC511, the affiliated SANS course, is titled around advanced threat detection and monitoring, it is reasonable to expect network-centric reasoning throughout your preparation, though remember that course content is not the official domain list.
Domain 9: Network Data Encryption
Encryption protects data in transit but also limits what monitoring can see. This domain rewards candidates who understand that trade-off.
- How encrypted traffic affects inspection and detection strategy
- Where visibility can be restored and what is lost by doing so
Domain 10: Network Security Monitoring Tools
The tooling used to capture, inspect, and analyze network activity. Be comfortable reasoning about what different tool categories surface and how an analyst would use them in a real triage.
Domain 11: NIDS/NIPS/NGFW
Network intrusion detection and prevention systems and next-generation firewalls. Distinguish passive detection from inline prevention, and know the operational consequences of each placement.
- Placement decisions and their effect on visibility and risk
- Tuning and false-positive management in signature-driven systems
Domain 13: Perimeter Protection Devices
The traditional boundary controls and how they fit a modern monitoring architecture. Consider how they generate data as well as how they block traffic.
Detection, SIEM, and Threat-Informed Domains
This group turns raw telemetry into decisions. It is where continuous monitoring earns its name.
Domain 14: Proxies & SIEM
Proxies provide a chokepoint for web and application traffic, and a SIEM correlates data from many sources. Together they are central to an analyst's daily workflow.
- What proxy logs reveal that other sources do not
- How correlation and aggregation convert scattered events into investigable stories
- Limits of centralized logging, including coverage gaps and data quality
Domain 15: Security Architecture Overview
A big-picture domain: how defensive layers fit together, and where monitoring points belong in a coherent design.
Domain 17: Threat Informed Defense
Using knowledge of adversary behavior to prioritize detection and defense rather than treating all risk as equal.
- Translating adversary technique knowledge into monitoring priorities
- Using threat information to focus limited analyst attention
Domain 4: Cyber Defense Principles
The conceptual backbone. Principles tested here tend to reappear as the reasoning behind answers in other domains, so a solid grasp pays dividends across the whole exam.
Attack and Exploit Knowledge Domains
Two of the 17 objectives require you to think like an attacker, which is a hallmark of the credential: defenders are expected to understand how intrusions actually unfold.
Domain 2: Attack Techniques
Understanding how adversaries operate so that monitoring can be aimed at the right behaviors.
- Recognizing what common attack activity looks like from the defender's side
- Mapping technique knowledge to the data sources that would reveal it
Domain 7: Exploit Methodology and Analysis
How exploitation works and how to analyze it. This domain asks you to reason about the mechanics behind a compromise, which sharpens both detection and response.
Vulnerability, Patching, and Inventory Domains
The final cluster covers the unglamorous work that prevents incidents and shrinks the attack surface.
Domain 6: Discovery and Vulnerability Scanning
Finding assets and weaknesses on a continuing basis. Know what scanning reveals, what it misses, and how its results should drive action.
Domain 12: Patching & Secure Baseline Configurations
Keeping systems current and hardened to a known-good state. This pairs naturally with Domain 3, since baselines are the reference against which drift is measured.
Domain 16: Software Inventories and Application Control
Knowing what software is present and constraining what is allowed to run.
- Why accurate software inventory is a prerequisite for meaningful vulnerability management
- How application control reduces opportunities for unauthorized execution
Sequencing the Domains Across Your Prep
Because 120 days of attempt access begins at activation for a standalone attempt, a staged plan helps. The timeline below groups the 17 domains by dependency rather than by exam weight, since no weights are published. Adapt it to your experience; for a full methodology, see the GMON Study Guide 2026.
Principles and Architecture
- Domain 4: Cyber Defense Principles and Domain 15: Security Architecture Overview, which frame everything else
- Domain 17: Threat Informed Defense, to set detection priorities early
Network and Perimeter
- Domains 9, 10, 11, and 13 together, since they share concepts about placement and visibility
- Domain 14: Proxies & SIEM, to see how network data is consolidated
Host, Identity, and Configuration
- Domains 1, 3, 5, and 8, practicing in a hands-on lab where possible
- Domain 12 alongside Domain 3 so baselines and drift detection reinforce each other
Attacks, Hygiene, and Index Building
- Domains 2 and 7 paired with the telemetry that reveals each technique
- Domains 6 and 16, then finalize your hardcopy index
Reserve the last stretch for timed practice. Our GMON practice tests let you rehearse the pacing of a three-hour sitting and expose which of the 17 areas still need work. Remember that practice and exam question-and-answer materials may not be brought into the exam itself, so build your index from your own notes and course materials.
Registration, Fees, and Renewal
There are no formal certification prerequisites; training is recommended but not required. For the detail, see GMON Requirements 2026. The published fee structure, before applicable sales tax and training tuition, is as follows.
| Item | Fee (USD) |
|---|---|
| Standalone exam attempt | $999 |
| Separately listed practice exam | $399 |
| Retake | $899 |
| Standard renewal | $499 |
| SANS-associated exam attempt | $999 (course tuition additional) |
Testing is delivered through Pearson VUE at a test center or through ProctorU remotely, subject to GIAC's modality rules. Standalone attempt access lasts 120 days from activation, so plan your scheduling before you activate. Our GMON Exam Dates 2026 article covers scheduling mechanics, and GMON Certification Cost 2026 gives a fuller pricing breakdown.
Once earned, the certification is valid for four years. Renewal requires either 36 CPE credits or a renewal examination, in each case plus the renewal fee. Keep this in mind when judging return on investment; Is the GMON Certification Worth It? weighs these ongoing costs.
Key Takeaway
Confirm your exact exam version and objectives inside your GIAC account before you commit to a study plan. The public outline is a strong guide, but the attempt page is the authority for your sitting.
Where These Skills Get Used
The 17 domains read like the daily toolkit of a security operations analyst, a detection engineer, or a defender responsible for network and endpoint visibility. Roles that involve SIEM triage, intrusion detection tuning, vulnerability management, and hardening baselines map closely onto the outline. Hiring organizations value demonstrated, hands-on ability in these areas, and the CyberLive component signals that the credential tests applied skill. For role-oriented discussion, see GMON Jobs, and for earnings context see the GMON Salary Guide 2026. No salary figures are quoted here because none are verified in the sources underlying this guide.
If you are still deciding whether to pursue the credential, GMON Training outlines preparation options, including the affiliated SANS SEC511 course, "Cybersecurity Engineering: Advanced Threat Detection and Monitoring." That title replaces older course wording ("Continuous Monitoring and Security Operations"), but no exam revision date should be inferred from the naming change.
Frequently Asked Questions
GIAC's public outline lists 17 exam objectives. SANS groups them into five preparation overview categories, but those groupings are teaching aids and do not replace the 17 official headings.
The public outline supplies no percentage weights, so none should be assumed. Prepare across all 17 areas and use your account's attempt page for attempt-specific information.
The minimum passing score is 74% on an 82-question exam with a three-hour limit. See GMON Passing Score 2026 for more detail on how this specification applies.
Yes. The exam is open book, allowing hardcopy books, notes, and an index. Electronic references and practice or exam question-and-answer materials are prohibited.
No. There are no formal certification prerequisites, and training is only recommended. You can register for a standalone attempt, or take the exam through the SANS-associated route with course tuition additional. Try a few questions on our GMON practice test site to gauge your readiness.