GAWN Study Guide 2026: How to Pass on Your First Attempt

What the GAWN Exam Actually Tests

GIAC Assessing and Auditing Wireless Networks (GAWN) validates that you can assess, attack and audit wireless environments, and that you can explain why each technique works. It reaches well beyond Wi-Fi. The published objectives span Bluetooth and Bluetooth Low Energy, RFID at both high and low frequency, NFC, software-defined radio and several flavors of wireless denial of service. Candidates who prepare as though this were a pure 802.11 exam tend to be surprised by how much of the blueprint sits outside the access point.

If you are still deciding whether the credential suits you, read What Is GAWN Certification? first, then return here for the preparation plan. This guide assumes you have decided to sit the exam and want a structured route to a first-attempt pass.

Format, Fees, and Delivery Mechanics

The exam is a single web-based proctored test with 75 questions and a two-hour limit. That works out to roughly 96 seconds per question, which is generous for recall items and tight for anything that requires you to work through a scenario or hunt through your index. The minimum passing score is 70%. For the full breakdown of how that threshold is applied, see GAWN Passing Score 2026.

Training is priced separately from all of the above. The numbers matter for planning: a failed attempt costs you $899 to retake, which is the strongest financial argument for spending extra weeks on preparation rather than rushing to sit. A fuller accounting lives in GAWN Certification Cost 2026.

Eligibility and prerequisites

GIAC requires no formal prerequisites to begin a certification attempt. Affiliated SANS training is optional, and preparation can come from practical experience, college coursework or independent study. The prerequisites listed for the associated SANS SEC617 course are not exam eligibility requirements. The details are in GAWN Requirements 2026.

A note on question types

Be careful here. GIAC's 2026 catalog shows a CyberLive badge for GAWN, which suggests hands-on item styles may exist, while the credential page itself does not specify the composition of practical items. Do not assume the exam is multiple-choice only, and do not assume a particular number of lab items. The Certification Information and objective list attached to your purchased attempt control question types, scope and passing criteria. Read them the day you activate, not the day before you test.

Working Through the 16 Objective Headings

The sixteen headings below reproduce GIAC's published objective titles. Grouping them by technology family makes the volume manageable. For a heading-by-heading companion, see GAWN Exam Domains 2026: Complete Guide to All 16 Content Areas.

Foundations and Wi-Fi core

Active Wi-Fi attacks and infrastructure

Four headings cover the adversarial side of Wi-Fi: Wireless Client Attacks, Rogue Networks, Hotspots and DoS on Wireless Networks. Study them as a connected set. A rogue network exploits client probing behavior, a hotspot attack exploits user trust and captive portals, and deauthentication-style denial of service often serves as the opening move for the others. Questions tend to test whether you understand the chain, not isolated facts.

Short-range and proximity technologies

This is where many Wi-Fi-only candidates lose ground. Bluetooth Attacks, Bluetooth Low Energy Attacks, NFC, High-Frequency RFID Attacks and Low-Frequency RFID Attacks each have their own protocols, tooling and failure modes. Build a comparison sheet that places them side by side: operating frequency, typical range, pairing or authentication model and the classic attack for each.

Advanced and cross-cutting topics

If you have noticed marketing mentions of other protocols such as Zigbee, remember that the credential page has no separate Zigbee objective heading. Prioritize the 16 published headings, and treat anything beyond them as enrichment rather than required scope.

Building an Open-Book Index That Works

The exam is open book, but only for hardcopy books, notes and an index. Electronic references and internet access are prohibited, and hardcopy materials that resemble practice or exam questions and answers are also prohibited. Your index is a retrieval tool, not a crutch, and a poorly built one is worse than none because it burns your 96 seconds per question.

1. Index by concept and by tool. Questions arrive phrased around a scenario, so you need to find "client probing" as quickly as you find a specific command.
2. Record the why, not just the what. A line saying what a flag does is less useful than a line saying when you would choose it.
3. Add a comparison page per technology family, as described above for RFID and Bluetooth.
4. Test it under the clock. Pick twenty topics at random and time how long each takes to find. Anything over thirty seconds needs restructuring.
5. Keep it clean. Do not build notes that read like question-and-answer pairs lifted from a practice bank, since that material is prohibited at the exam.

Hands-On Lab Work That Pays Off

Reading about wireless attacks and performing them are different skills, and the exam rewards the second. You do not need an expensive lab, but you do need to touch the tools. Keep everything inside hardware and networks you own or have written permission to test.

• Wi-Fi capture and handshake analysis: A compatible adapter, your own access point and a packet analyzer cover Wireless Basics, Sniffing Wireless and WPA Variants in one setup.
• Rogue network exercises: Stand up a test access point in an isolated environment and observe how your own devices react.
• Bluetooth and BLE enumeration: Use your own devices to practice discovery and service inspection.
• RFID and NFC: Inexpensive readers and blank or sample tags let you see the difference between low- and high-frequency behavior firsthand.
• SDR basics: An entry-level receiver is enough to capture and inspect a simple signal from a device you own.

SANS SEC617, Wireless Penetration Testing and Ethical Hacking, is the natural companion course, and its public curriculum is a useful source of topics. Treat it as preparation context rather than an exhaustive statement of exam coverage, and note that course labs and its final-day capture-the-flag exercise do not tell you how the GAWN exam composes its practical items. More on the training route is in GAWN Training.

A Domain-Ordered Study Schedule

The only generic method worth borrowing is spaced repetition, and here it is tied to the actual domains. The logic: start with fundamentals everything else depends on, move to the attack families in dependency order, and finish with the cross-cutting topics that benefit from everything before them. Adjust the length to your background and to your 120-day attempt window.

For extra question practice, the GAWN practice test site offers original questions you can use alongside your own lab work. Pair them with the one-page review in GAWN Cheat Sheet 2026 in the final days.

Exam-Day Realities and Retake Planning

Decide early whether you will test remotely through ProctorU or onsite through Pearson VUE, keeping in mind that available options depend on what is authorized for your attempt. Remote delivery means your room, desk and hardcopy materials will be inspected, so rehearse your setup. Only hardcopy materials are allowed, and everything electronic is off limits.

• Pace yourself. Aim to finish a first pass with time in hand, but remember you cannot return to change submitted answers, so do not rush commitments.
• Triage honestly. If an index lookup is not paying off within about a minute, make your best-supported choice and move on.
• Know your window. You have 120 days from activation to complete an attempt, and an extension costs $479. Do not activate until your index and lab hours are largely done.
• Treat a retake as a plan B, not a plan. At $899 it is cheaper than the first attempt but still a meaningful expense.

For realistic expectations about difficulty, see How Hard Is the GAWN Exam? and, for what the numbers do and do not tell you, GAWN Pass Rate 2026. Scheduling specifics are covered in GAWN Exam Dates 2026.

Where GAWN Fits in a Career

The credential is aimed at people whose work touches wireless risk: penetration testers who include wireless in their scope, security auditors reviewing site and campus wireless estates, red team operators and security engineers responsible for wireless architecture. Because the objectives reach into Bluetooth, RFID, NFC and SDR, it also appeals to practitioners assessing physical access systems, IoT deployments and facilities with proximity-card infrastructure.

Whether the investment pays back depends on your role and employer. We cover that question in Is the GAWN Certification Worth It?, and you can explore the kinds of roles that value it in GAWN Jobs. For compensation discussion, see GAWN Salary Guide 2026. Remember that the certification stays valid for four years, with renewal through 36 approved continuing professional education credits or re-examination, plus the $499 renewal fee.

Frequently Asked Questions