- The Exam at a Glance
- Fees, Delivery and Attempt Window
- Open-Book Rules You Must Respect
- The 16 Objective Headings, Quick-Reference
- Core 802.11 Facts: Basics, Encryption, WPA Variants
- Attack Surface Cheat Notes: Clients, Rogues, Hotspots, DoS
- Bluetooth, BLE, RFID, NFC and SDR Notes
- Building a Hardcopy Index That Works
- Format Caveat: CyberLive and Zigbee
- Sequencing Domains Across Your Prep
- Validity and Renewal in One Glance
- Frequently Asked Questions
- GAWN is one proctored exam: 75 questions, two hours, 70% minimum passing score.
- Hardcopy books, notes and an index are allowed; electronic references and internet access are prohibited.
- GIAC publishes 16 objective headings but no percentage weights, so do not assume any domain dominates.
- Standard attempt fee is $999; you have 120 days from activation to complete the attempt.
The Exam at a Glance
This page condenses what a GIAC Assessing and Auditing Wireless Networks (GAWN) candidate needs to keep in front of them. It is a reference, not a substitute for hands-on practice. If you are still deciding whether to pursue the credential, start with What Is GAWN Certification? and come back here once you have committed to an attempt.
| Item | Fact |
|---|---|
| Issuer | GIAC Certifications |
| Credential | GIAC Assessing and Auditing Wireless Networks (GAWN) |
| Exam structure | One web-based, proctored examination |
| Questions | 75 |
| Time limit | Two hours |
| Minimum passing score | 70% |
| Delivery | Remote via ProctorU or onsite via Pearson VUE, per the options authorized for your attempt |
| Attempt window | 120 days from activation |
| Prerequisites | No formal prerequisites to begin an attempt |
| Validity | Four years |
Two hours for 75 questions works out to a little over a minute and a half per item on average. That sounds comfortable until you hit the questions that require you to hunt through an index. Pacing is covered in the index section below. For a deeper look at the numeric threshold, see GAWN Passing Score 2026: Exactly What You Need to Pass.
Fees, Delivery and Attempt Window
The current standard USD fees, excluding applicable sales tax, are listed below. Training is separate from all of them.
| Fee type | Amount (USD) |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Practice examination | $399 |
| Attempt extension | $479 |
| Renewal | $499 |
The practical implication of the 120-day window is that activation starts a clock. Activate only when your hardcopy index is finished and you have completed enough lab time to be confident, because the extension costs $479. A full breakdown of how these line items combine is in GAWN Certification Cost 2026: Complete Pricing Breakdown.
Open-Book Rules You Must Respect
GAWN is open book in a specific, narrow sense. Hardcopy books, notes and an index are permitted. Electronic references and internet access are prohibited. Two further rules trip candidates up:
- No practice-question lookalikes. Hardcopy materials resembling practice or examination questions and answers are prohibited. Do not print question banks or exam-dump content into your binder.
- No going back. Submitted answers cannot be reviewed or changed. Treat each submission as final and flag nothing you cannot commit to.
Because you cannot revisit answers, the right rhythm is to answer what you know immediately, spend a bounded amount of time on index lookups, and never leave a question planning to return to it.
The 16 Objective Headings, Quick-Reference
The GIAC credential page lists 16 objective headings in a specific order. GIAC does not publish percentage allocations for them on that page, so there is no basis for claiming one domain is worth more than another. Study all sixteen. For narrative coverage of each, see GAWN Exam Domains 2026: Complete Guide to All 16 Content Areas.
- 802.11 Fuzzing Attacks
- Attacking Weak Encryption
- Bluetooth Attacks
- Bluetooth Low Energy Attacks
- Bridging the Air Gap
- DoS on Wireless Networks
- High-Frequency RFID Attacks
- Hotspots
- Low-Frequency RFID Attacks
- NFC
- Practical SDR Attacks
- Rogue Networks
- Sniffing Wireless
- Wireless Basics
- Wireless Client Attacks
- WPA Variants
Core 802.11 Facts: Basics, Encryption, WPA Variants
The 802.11 cluster is the backbone of the credential and the place where your foundations get tested before anything exotic.
Wireless Basics
Everything else assumes you can read a wireless environment fluently.
- Know the frame categories (management, control, data) and which are protected and which are not.
- Be comfortable with channels, bands, monitor mode versus managed mode, and adapter capabilities such as injection support.
- Be able to interpret a capture and identify what each frame type tells you about the network.
Attacking Weak Encryption
Understand why legacy protections fail rather than memorizing tool commands.
- Know the structural weaknesses of legacy wireless encryption and what data an attacker needs to collect.
- Understand the relationship between captured traffic volume, injection and key recovery.
- Be ready to explain what a given capture does or does not allow you to do.
WPA Variants
Distinguish the personal and enterprise families and what each exposes.
- Contrast pre-shared-key designs with enterprise authentication, and identify what an attacker can capture in each.
- Know where offline guessing applies and where it does not.
- Understand how authentication-method choices in enterprise deployments change the attack path.
802.11 Fuzzing Attacks
A less common topic that rewards conceptual clarity.
- Understand what fuzzing means in the context of wireless frames and implementations.
- Know why malformed management or control traffic can cause unexpected behavior in drivers or access points.
Attack Surface Cheat Notes: Clients, Rogues, Hotspots, DoS
These headings describe attacks against the people and devices around the network, not just the network itself.
- Wireless Client Attacks: Think about what a client broadcasts and trusts. Probe behavior, preferred-network handling and automatic reconnection are the conceptual levers.
- Rogue Networks: Know the difference between an unauthorized access point plugged into a wired network and an impersonating access point designed to lure clients. Detection and attack perspectives both matter.
- Hotspots: Public and captive-portal environments. Understand how portals gate access, what they typically fail to protect, and how clients behave around them.
- DoS on Wireless Networks: Understand how the shared medium and unauthenticated frames enable disruption, and which protections reduce exposure.
- Sniffing Wireless: Know what you can and cannot see depending on encryption, adapter mode and positioning. Capture placement and filtering are practical skills that show up as scenario reasoning.
Key Takeaway
For attack-surface domains, practice answering "what does the attacker need, and what stops them?" for each technique. Scenario questions reward that two-sided reasoning far more than command recall.
Bluetooth, BLE, RFID, NFC and SDR Notes
This is the breadth portion of the credential, and it is where candidates with only Wi-Fi experience feel exposed. The full list of headings is covered in the domain guide linked earlier, but the essentials follow.
Bluetooth Attacks and Bluetooth Low Energy Attacks
Treat these as two related but distinct domains.
- Understand the differences between classic Bluetooth and BLE in discovery, pairing and data exchange.
- Know how pairing methods differ in the protection they offer, and where eavesdropping or manipulation becomes feasible.
- Be prepared to reason about what a sniffer needs to capture a connection and why timing and hopping matter.
High-Frequency and Low-Frequency RFID Attacks, and NFC
Frequency band drives nearly everything in these domains.
- Know which common card technologies fall in the low-frequency and high-frequency categories.
- Understand reading, cloning and emulation concepts, and why simple identifier-only credentials are weaker than ones with cryptographic protection.
- Place NFC in context as a short-range technology related to high-frequency RFID, and understand its attack considerations such as relay and emulation.
Practical SDR Attacks and Bridging the Air Gap
These test whether you can think beyond standard protocols.
- Understand the SDR workflow: capture, demodulate, analyze, replay.
- Know why unprotected wireless remotes and sensors are susceptible to record-and-replay approaches.
- Be able to explain how an air-gapped system can still be reached or leak data through wireless or other radio-adjacent channels.
If these areas are new to you, the sequence in GAWN Study Guide 2026: How to Pass on Your First Attempt shows how to build them on top of your 802.11 foundation without getting overwhelmed.
Building a Hardcopy Index That Works
Because the exam permits only hardcopy references, your index is effectively your search engine. A few principles specific to this credential:
- Index by concept and by technique. A question may name a technology without naming a tool. Entries should be findable by either.
- Cross-reference across families. NFC, high-frequency RFID and Bluetooth share vocabulary. A single term may belong in more than one cluster.
- Record page numbers for diagrams and tables. Comparison tables of protocols and frame types are exactly what you will want fast.
- Keep personal notes short and labeled. Your own summaries of each of the 16 headings should be one or two pages, so you can orient quickly before diving into longer material.
- Respect the prohibition on question-like content. Notes should be explanatory, not formatted as practice questions with answers.
Format Caveat: CyberLive and Zigbee
You may encounter two details in GIAC marketing material that are not mirrored on the credential page. The GIAC 2026 catalog shows a CyberLive badge for GAWN and mentions Zigbee in marketing text. The credential page itself does not specify the composition of practical items and has no separate Zigbee objective heading.
The safe interpretation is straightforward. Treat the 16 published headings as your baseline scope. Do not assume a purely multiple-choice format, and do not assume a specific lab-item count. The Certification Information and objective list tied to your purchased attempt control question types, scope and passing criteria. Check them when you activate, and prepare with hands-on practice so that practical-style items do not surprise you. A wireless protocol that appears in a marketing blurb is worth a brief conceptual read, but it should not displace time from the published headings.
Sequencing Domains Across Your Prep
Generic scheduling advice is easy to find; the useful question is which GAWN domains belong together and in what order. One workable arrangement:
Foundations
- Wireless Basics and Sniffing Wireless, since every later domain depends on reading captures.
- Begin your hardcopy index structure.
802.11 Cryptography
- Attacking Weak Encryption, then WPA Variants, in that order so the progression from broken to hardened makes sense.
Network-Level Attack Scenarios
- Rogue Networks, Hotspots, Wireless Client Attacks, DoS on Wireless Networks and 802.11 Fuzzing Attacks.
Short-Range and Radio Breadth
- Bluetooth Attacks, Bluetooth Low Energy Attacks, both RFID domains, NFC, Practical SDR Attacks and Bridging the Air Gap.
- Finish the index and run a timed review pass.
Adjust the pace to your background. A candidate who works daily with enterprise Wi-Fi may compress the first three weeks, while someone with a hardware or RFID background will do the reverse. For a realistic view of where candidates struggle, read How Hard Is the GAWN Exam? Complete Difficulty Guide 2026. When you want to test your recall under timed conditions, the GAWN practice tests are designed for exactly that kind of checkpoint.
Validity and Renewal in One Glance
| Renewal item | Detail |
|---|---|
| Validity period | Four years |
| CPE requirement | 36 approved continuing professional education credits earned during the active cycle |
| Alternative | Successful re-examination |
| Renewal fee | $499 applies in either case |
Plan your continuing education from the moment you pass. Credits must be earned within the active cycle, so scattering them over four years is easier than compressing them at the end. Whether the investment pays off for your career is explored in Is the GAWN Certification Worth It? Complete ROI Analysis 2026, and roles that value the credential are discussed in GAWN Jobs.
Frequently Asked Questions
The GAWN exam has 75 questions with a two-hour time limit. The minimum passing score is 70%. Remember that submitted answers cannot be reviewed or changed.
Yes, hardcopy books, notes and an index are permitted. Electronic references and internet access are prohibited, as are hardcopy materials that resemble practice or exam questions and answers.
No. The credential page lists 16 objective headings but does not publish percentage allocations. Prepare across all of them rather than betting on a presumed high-weight area. See the domains guide for coverage of each.
No. GIAC requires no formal prerequisites, and SANS training is optional. Preparation can come from practical experience, coursework or independent study. For training options, see GAWN Training.
You have 120 days from activation to complete the attempt. An extension is available for $479 if you need more time, so activate only when you are ready to schedule.