GMON (GIAC Continuous Monitoring Certification)
GMON covers deterring intrusions and detecting anomalous activity with defensible security architecture, network security monitoring, and continuous diagnostics and mitigation. Security architects, senior security engineers, SOC staff, and CND analysts are the intended audience. The aligned SANS course is SEC511.
Exam Details
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
17 domains| Domain |
|---|
| Account & Privilege Monitoring & Authentication |
| Attack Techniques |
| Configuration Monitoring |
| Cyber Defense Principles |
| Device Monitoring |
| Discovery and Vulnerability Scanning |
| Exploit Methodology and Analysis |
| HIDS/HIPS/Endpoint Firewalls |
| Network Data Encryption |
| Network Security Monitoring Tools |
| NIDS/NIPS/NGFW |
| Patching & Secure Baseline Configurations |
| Perimeter Protection Devices |
| Proxies & SIEM |
| Security Architecture Overview |
| Software Inventories and Application Control |
| Threat Informed Defense |
DoD 8140 Work Roles
4 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GMON as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Related Tool Categories
Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Infrastructure scanners, CVE audit engines, container image inspectors, and exposure management platforms.
Frequently Asked Questions
What is the GMON pass mark?→
GMON requires 74% on an 82-question exam with a 3-hour limit.
What topics does GMON cover?→
Objectives include NIDS/NIPS and next-generation firewalls, proxies and SIEM, endpoint and configuration monitoring, vulnerability scanning, and threat-informed defense.
How much does GMON cost?→
A GMON certification attempt is $999 and a retake is $899, excluding sales tax.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GMON is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.