- You need 69% correct on the GASF exam for versions released on or after September 26, 2016.
- The exam has 75 questions and a two-hour time limit - roughly 96 seconds per question.
- All eight domains count toward the same 69% cutoff; there is no separate per-domain minimum.
- A failed attempt costs $899 to retake, on top of the original $999 registration.
The Exact Passing Score You Need
If you're searching for one number, here it is: 69%. That's the passing threshold GIAC set for GASF exam versions released on or after September 26, 2016, and it applies to the current version of the exam. Out of 75 scored questions delivered in a two-hour proctored session, you need to answer roughly 52 of them correctly to cross the line.
That number sounds simple, but it hides an important nuance: GASF doesn't ask you to be "pretty good" at mobile forensics in general. It asks you to be reliably correct across eight distinct domains - from Android file system artifacts to Apple application analysis to mobile malware behavior. Missing the passing score usually isn't about total knowledge; it's about uneven coverage across those domains. For a full breakdown of what each domain actually tests, see the GASF Exam Domains 2026 guide.
How GIAC Actually Scores the GASF Exam
GIAC exams, including GASF, are scored as a single composite percentage across the entire question set. There is no publicly weighted breakdown that tells you "Domain 3 is worth 20% of your score" - the exam blends questions from all eight domains and reports one overall pass/fail result along with a percentage. This matters practically: you cannot compensate for a total blind spot in one domain by being flawless in another domain that carries similarly modest weight, but you also don't need a perfect score in any single area.
What this means for prep is straightforward. You want broad, even competence across all eight domains rather than depth in two or three favorites. Candidates who ace Android artifacts but guess their way through Apple application analysis tend to land in the low 60s - close, but under the 69% line. If you want a sense of how this uneven-coverage problem plays out in real attempts, the GASF Pass Rate 2026 data is worth reviewing alongside your own domain self-assessment.
Key Takeaway
Treat all eight GASF domains as equally important for scoring purposes. A 69% overall average built on uneven domain knowledge is riskier than the same average built on consistent competence everywhere.
Passing Score by Domain: Where the Points Live
Since GASF doesn't publish a per-domain score requirement, your best strategy is to assume each of the eight domains contributes a meaningful share of the 75 questions and prepare accordingly. Here's what candidates actually need to master in each area to keep their overall percentage above 69%.
Domain 1: Android Device Application Analysis
Focuses on how third-party and system apps store data on Android devices - messaging apps, browsers, and social media clients.
- Know where app-specific SQLite databases typically live and what artifacts they retain
Domain 2: Android Device File System Artifacts
Covers the Android file system layout itself, independent of any single app.
- Understand partition structures, system logs, and how deleted data can persist
Domain 3: Apple Device Application Analysis
Mirrors the Android application domain but for iOS-native and third-party apps.
- Study plist files, app sandboxing, and iMessage/backup artifact locations
Domain 4: Apple Device File System Artifacts
Tests knowledge of the iOS file system structure, backups, and system-level artifacts.
- Be comfortable interpreting backup structures and system property lists
Domain 5: Introduction to Mobile Forensics
Foundational concepts that underpin the rest of the exam: acquisition types, legal considerations, and general methodology.
- Know the differences between logical, physical, and file system extractions
Domain 6: Mobile Device Application Analysis
A cross-platform domain looking at application behavior patterns that aren't OS-specific.
- Understand common data storage patterns shared across app categories
Domain 7: Mobile Device File System Artifacts
General file system artifact analysis that applies across device types.
- Practice identifying timestamps, metadata, and artifact correlation across sources
Domain 8: Mobile Device Malware Analysis
Covers identifying and analyzing malicious code and behavior on mobile devices.
- Recognize indicators of compromise and common mobile malware persistence mechanisms
For a deeper dive into terminology, question phrasing, and how these domains overlap on the actual exam, the complete domains guide walks through each area in more depth than a passing-score article can.
Format, Fees, and Timing Mechanics
The passing score doesn't exist in isolation - it's tied to specific logistics that affect how you should prepare and schedule your attempt.
| Detail | Specification |
|---|---|
| Question count | 75 questions |
| Time limit | 2 hours |
| Passing score | 69% (versions released on/after 9/26/2016) |
| Delivery | Web-based, proctored - remote via ProctorU or onsite via Pearson VUE |
| Initial registration fee | $999 |
| Retake fee | $899 |
| Attempt window | 120 days from activation |
| Certification validity | 4 years |
| Renewal requirement | 36 CPE credits, $499 fee |
With roughly 96 seconds per question on average, pacing matters as much as knowledge. Some questions - particularly those involving scenario-based artifact interpretation - take longer to read and reason through than straightforward definitional questions. Budget your two hours knowing that a handful of Domain 4 or Domain 7 scenario questions may eat more time than a Domain 5 conceptual question. For the full cost picture, including training bundle pricing, see the GASF Certification Cost breakdown.
Open-Book Rules and Why They Matter for the Score
GASF, like other GIAC exams, is open book - but only for printed books, notes, and printed indexes. Electronic materials and internet access are explicitly prohibited during the exam. This changes your prep strategy in a way that directly affects your ability to hit 69%.
Because you can reference printed material, the exam isn't purely a memorization test. It's a test of whether you can quickly locate the right concept under time pressure. That means your index - a personally built, well-organized printed reference - is arguably as important as your raw study hours. Many candidates who fall short of the passing score didn't lack knowledge; they lacked a fast way to confirm details during the exam and burned time flipping through unindexed material.
The GASF Study Guide 2026 covers index-building in more detail, including how to structure it so retrieval during the exam takes seconds, not minutes.
A Four-Week Runway Built Around the Passing Threshold
You don't need a generic study calendar - you need one that maps directly onto the eight domains and the 69% target. Here's a compressed structure that assumes you're balancing prep with a full-time job.
Foundations and Android Coverage
- Work through Domain 5 (Introduction to Mobile Forensics) first - everything else builds on it
- Move into Domain 1 and Domain 2 (Android application and file system artifacts)
- Start building your printed index as you go, organized by domain
Apple Ecosystem Deep Dive
- Cover Domain 3 and Domain 4 (Apple application and file system artifacts)
- Compare Apple and Android artifact locations side by side to reinforce differences
- Add cross-references to your index for overlapping concepts
Cross-Platform and Malware Topics
- Study Domain 6 and Domain 7, the cross-platform application and file system domains
- Dedicate focused time to Domain 8 (mobile malware analysis), often the least familiar area for candidates coming from a pure forensics background
- Begin timed practice questions to build pacing awareness against the 96-second-per-question average
Full-Length Practice and Index Refinement
- Take full timed practice exams under open-book conditions using only your printed materials
- Identify which domains consistently pull your score below 69% and revisit them specifically
- Finalize your index so every domain has a clearly labeled, fast-access section
If four weeks feels tight given the breadth of material, extend the same domain-by-domain sequence over six to eight weeks rather than compressing your review. What matters is that every domain gets dedicated time, not just the ones you find most interesting. For candidates wondering whether this timeline is realistic given the exam's reputation, How Hard Is the GASF Exam? offers an honest difficulty assessment.
What Happens If You Miss 69%
If your score comes in under 69%, GIAC allows a retake for $899. That's a meaningful cost on top of the original $999 attempt, so it's worth treating the first sitting seriously rather than viewing it as a diagnostic run. Before scheduling a retake, review your score report carefully - GIAC typically provides a breakdown showing relative performance across content areas, which can point you toward the specific domain gaps that cost you points.
Also keep the 120-day activation window in mind. If you don't pass on your first attempt and need to study further before a retake, make sure your retake is scheduled within that window, or you may need to re-register at the full fee. Practicing extensively with realistic questions before your attempt - through resources like GASF Exam Prep's practice tests - is one of the more direct ways to reduce the odds of needing a retake at all.
Key Takeaway
A retake costs $899. Investing extra practice time and using a realistic practice test platform before your first attempt is almost always cheaper than paying for a second sitting.
It's also worth putting the passing score in context of the bigger picture: whether the certification is worth pursuing at all given the cost and renewal requirements. The Is GASF Certification Worth It? analysis and the GASF Salary Guide both help frame the 69% target against the career payoff, while GASF Requirements 2026 covers what you need before you're even eligible to sit for the exam. If you're still mapping out logistics, GASF Exam Dates 2026 covers scheduling windows, and the GASF Cheat Sheet is a fast way to sanity-check your domain coverage the week before your attempt.
FAQ
You need 69% correct for exam versions released on or after September 26, 2016, which is the current version candidates take.
No. GASF reports a single overall percentage across all 75 questions spanning the eight domains. There is no published per-domain minimum, but consistent performance across all domains is the safest way to reach 69%.
With 75 total questions and a 69% threshold, you can miss roughly 23 questions and still pass, though this is an approximation since exact scoring calculations aren't publicly detailed by GIAC.
You can retake it for $899, in addition to the original $999 registration fee. Make sure any retake happens within your 120-day activation window.
Yes, GASF is open book for printed books, notes, and printed indexes only. Electronic materials and internet access are not permitted during the proctored session.