GAWN Exam Domains 2026: Complete Guide to All 16 Content Areas

How GIAC Lists the GAWN Objectives

The GIAC Assessing and Auditing Wireless Networks (GAWN) credential page publishes its exam objectives as a list of 16 headings. Those headings are the formal examination-objective titles, presented in source order. This guide mirrors that list rather than inventing a weighting scheme, because GIAC does not publish percentage allocations on that page. Any article that tells you "Domain X is 18% of the exam" is making that number up.

That absence matters for how you study. With no official weights, you cannot safely skip a domain on the theory that it is lightly tested. With 75 questions spread across 16 headings, each objective could surface a handful of times, or fewer, and you cannot predict which. The sensible posture is breadth first, depth second, and an index that lets you find anything quickly.

If you are new to the credential itself, start with What Is GAWN Certification? for orientation, then return here for the domain-by-domain breakdown. For a broader preparation plan built on top of these domains, see the GAWN Study Guide 2026.

Exam Mechanics That Shape Your Domain Strategy

Your domain plan should reflect how the exam is actually delivered. The credential page specifies one web-based proctored examination with 75 questions, a two-hour limit and a 70% minimum passing score. That works out to roughly 96 seconds per question on average, which is tight if you spend it flipping through unindexed notes.

Two rules deserve emphasis. First, electronic references and internet access are prohibited, so your index must be on paper. Second, hardcopy materials that resemble practice or exam questions and answers are prohibited, so build your notes from concepts and tool behavior, not from question banks. For the scoring specifics, read GAWN Passing Score 2026, and for scheduling logistics see GAWN Exam Dates 2026.

Wi-Fi Core: Basics, Encryption, WPA Variants, Sniffing

Four domains form the foundation of everything else on the exam. They are the ones where a gap will hurt you in the most other domains, because later attack topics assume you understand frame types, association flow and key hierarchies.

Spend your earliest study time here. If Wireless Basics is shaky, questions in Wireless Client Attacks and Rogue Networks will feel far harder than they are. For a sense of how these foundations feed into overall difficulty, see How Hard Is the GAWN Exam?

Wi-Fi Attack Surface: Clients, Rogues, Hotspots, DoS, Fuzzing

Once the foundation is in place, the next cluster covers what an assessor actually does to or around wireless infrastructure and devices.

Wireless Client Attacks (Domain 15)

Assessments are not only about the access point. Client devices constantly broadcast preferences, accept familiar network names and trust whatever answers first. Know why client behavior creates exposure, how clients can be steered toward attacker-controlled infrastructure, and what protections reduce that risk. Pair this domain with Rogue Networks, since the two scenarios often overlap.

Rogue Networks (Domain 12)

This domain covers unauthorized and malicious access points: how they appear, how defenders and assessors detect them, and how they are used for interception. Be able to distinguish a misconfigured but benign device from an evil-twin style deployment, and know the detection approaches that apply to each.

Hotspots (Domain 8)

Public and captive-portal networks carry their own weaknesses. Study how captive portals gate access, what they do and do not protect, and how assessors evaluate hotspot environments. Questions here tend to test reasoning about trust: what a user can safely assume on an open or portal-fronted network.

DoS on Wireless Networks (Domain 6)

Wireless is uniquely vulnerable to disruption because management traffic can be forged and the medium is shared. Understand the categories of availability attacks, why certain frames are abusable, and what protections exist to blunt them. Know the difference between attacks that exploit protocol behavior and those that simply overwhelm the radio environment.

802.11 Fuzzing Attacks (Domain 1)

Fuzzing sends malformed or unexpected input to discover how a driver, firmware or access point handles it. For the exam, focus on the concept and workflow: what you fuzz, why 802.11 parsing code is a rich target, and how crashes or anomalous responses are interpreted. You are more likely to be tested on the logic of the technique than on obscure tool flags.

Bluetooth, BLE, NFC and RFID Domains

This is where GAWN diverges sharply from a pure Wi-Fi credential. Five headings cover short-range and proximity technologies, and candidates who only practiced on access points are often underprepared here.

A useful way to organize these five domains is by asking the same questions of each technology: what is the range, how does a device authenticate, what can be passively observed, and what can be cloned or replayed. That structure turns five seemingly separate topics into one repeatable analysis pattern.

Practical SDR Attacks and Bridging the Air Gap

Two domains push beyond standard protocols into the radio layer itself.

Both domains reward conceptual fluency over memorized procedures. If you can explain why a technique works and what conditions it needs, you can reason through unfamiliar question wording.

The CyberLive and Zigbee Question

You may notice conflicting signals when researching the format. The GIAC Catalog 2026 displays a CyberLive badge for GAWN and mentions Zigbee in its marketing text. However, the credential page itself does not specify the composition of practical items, and it has no separate Zigbee objective heading among its 16 headings.

A practical response is to prepare for hands-on reasoning, not just recall, while still treating Zigbee as at most a supporting concept within the broader short-range domains rather than a standalone objective. To understand how format and difficulty interact, the GAWN Pass Rate 2026 article discusses what public data can and cannot tell you.

Sequencing the 16 Domains Across Your Prep

The 120-day attempt window from activation gives you room to sequence deliberately. One ordering that follows dependency logic is below; adjust the pacing to your experience.

Scheduling the foundations first is not arbitrary: later domains reuse their vocabulary constantly. You can compress or extend this plan, and our study guide shows how to adapt it to your available time. Use original practice questions and authorized lab scenarios to test yourself, such as the ones on the main practice test site, rather than anything that claims to reproduce real exam content.

Building an Open-Book Index Around the Domains

Because the exam permits hardcopy books, notes and an index, your index is effectively a seventeenth skill. Organize it by the 16 published headings so you can jump to the right section in seconds, then add cross-references for concepts that appear in multiple domains, such as handshakes, pairing and replay.

• Index by concept, not by page order. You will search for a term, not a chapter.
• Record tool behavior and output. Questions often present output and ask what it means.
• Keep step sequences together. Attack workflows are easier to retrieve as a single block.
• Avoid question-like material. Hardcopy materials resembling practice or exam questions and answers are prohibited.

Because submitted answers cannot be reviewed or changed, your index should help you answer correctly the first time rather than hunting for confirmation afterward. For a condensed reference format that complements a full index, see the GAWN Cheat Sheet 2026.

Who Values the Domains

The breadth of the 16 headings maps to a recognizable set of roles. Wireless penetration testers use the Wi-Fi attack domains daily, while physical security assessors care about RFID and NFC. Embedded and IoT security engineers lean on BLE and SDR, and security operations teams value rogue network detection and wireless sniffing. Consultants who run red team engagements often need all of them, since physical and wireless pathways frequently overlap.

No concrete earnings or hiring figures are asserted here, since none are in the verified facts for this credential. For qualitative discussion of roles and career context, read GAWN Jobs, and for cost-benefit reasoning see Is the GAWN Certification Worth It? and GAWN Certification Cost 2026. The cost article covers the current standard fees: $999 for the certification attempt, $899 for a retake and $399 for a practice examination, excluding applicable sales tax and with training priced separately.

FAQ

Mastering all 16 headings takes sustained effort, but the structure is learnable: build the Wi-Fi foundation, apply one analysis pattern to every short-range technology, and keep a clean index. When you are ready to test your recall under realistic conditions, try the GAWN practice test and revisit the domain overview as you close gaps.