- Which GMLE This Sheet Covers
- Exam Format and Numbers at a Glance
- Fees, Windows, and Validity
- The Ten Objective Headings, Decoded
- Open-Book Rules and Index Strategy
- Handling CyberLive Tasks
- SEC595 Preparation Map
- Renewal Math
- A Domain-Ordered Review Sequence
- Roles That Value This Credential
- Frequently Asked Questions
- The exam has 82 questions in 3 hours, mixing multiple-choice items with CyberLive performance-based tasks; 65% is the minimum passing score.
- The attempt costs USD $999, a retake USD $899, and the official practice exam USD $399, before sales tax.
- Open book means hardcopy books, notes, and an index only; internet and personal electronic references are prohibited.
- Submitted answers cannot be changed, so flag-and-return habits matter more than second-guessing after submission.
Which GMLE This Sheet Covers
Several unrelated credentials share the same four letters. This page covers one thing only: the GIAC Machine Learning Engineer (GMLE), issued by GIAC Certifications and focused on applying machine learning and data science to cybersecurity work. If you are still orienting yourself, the explainers at What Is GMLE Certification? and What Does GMLE Stand For? cover the naming and scope in more depth.
Treat this cheat sheet as a compression of the facts you need to hold in your head before you sit down, not as a replacement for studying. The goal is a single reference you can reread the night before your attempt. For a deeper plan, pair it with the GMLE Study Guide.
Exam Format and Numbers at a Glance
| Item | GMLE Fact |
|---|---|
| Issuer | GIAC Certifications (administered by GIAC, LLC) |
| Delivery | Proctored, web-based; Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
| Total questions | 82 |
| Time limit | 3 hours, covering the complete exam including CyberLive |
| Question types | Multiple-choice plus performance-based CyberLive tasks |
| Minimum passing score | 65% |
| Built-in tools | On-screen calculator and scratch notepad |
| Break allowance | 15 minutes |
| Changing answers | Submitted answers cannot be changed |
| Prerequisites | No formal certification prerequisites; training optional and recommended |
Two details deserve emphasis. First, the three-hour clock is a single pool: time you spend in CyberLive tasks comes out of the same budget as the multiple-choice items. Second, GIAC's own description of the practitioner exam experience places multiple-choice items first, followed by CyberLive, so plan your pacing around finishing the multiple-choice portion with real time left for hands-on work.
For the scoring threshold in context, see GMLE Passing Score, and for eligibility questions, GMLE Requirements.
Fees, Windows, and Validity
The money and calendar facts are the ones candidates most often get slightly wrong, so here they are in one place.
| Item | Amount or Duration |
|---|---|
| Certification attempt | USD $999 |
| Retake | USD $899 |
| Official practice exam | USD $399 |
| Renewal fee | USD $499 |
| Attempt completion window | 120 days from activation |
| Certification validity | Four years |
Listed prices exclude applicable sales tax, and SANS training tuition is a separate cost entirely. The 120-day window starts at activation, not at purchase of training, so activate when you are close to ready rather than as a motivational tactic. A full breakdown, including how training changes the total, lives in the GMLE Certification Cost guide, and scheduling considerations are in GMLE Exam Dates.
The Ten Objective Headings, Decoded
GIAC publishes ten objective headings for GMLE, listed below in published order. GIAC does not publish percentage weights for them, so do not trust any source that claims to know how many questions each heading contributes. Treat all ten as fair game. For a longer treatment, see GMLE Exam Domains: Complete Guide to All 10 Content Areas.
Domain 1: Anomaly Detection and Optimization
The most security-flavored heading: finding the unusual in network, host, or log data, and tuning the models that do it.
- Know why anomaly detection differs from classification when labeled attack data is scarce
- Understand how thresholds trade false positives against missed detections
- Be comfortable with optimization concepts such as loss functions and how models are tuned
Domain 2: Clustering
Unsupervised grouping of data without labels, common for malware families, user behavior, and traffic segmentation.
- Distinguish centroid-based, density-based, and hierarchical approaches conceptually
- Know how the choice of distance measure and feature scaling changes the result
- Recognize how to judge cluster quality when no ground truth exists
Domain 3: Convolutional Neural Networks
Architectures built for grid-like data such as images, and applied in security to things like byte-as-image malware representations.
- Understand convolution, pooling, and what each layer contributes
- Know why CNNs share weights and what that means for parameter counts
- Be able to reason about input shape and how it flows through layers
Domain 4: Data Acquisition
Getting data into a usable state before any modeling happens.
- Understand sources, formats, and the cleaning and preparation steps that precede modeling
- Recognize how sampling and collection choices introduce bias into later results
- Know where security telemetry typically originates and what quality problems it brings
Domain 5: Leveraging Python
The hands-on glue. This is the heading most likely to surface in CyberLive-style tasks.
- Be fluent with the data-handling and numerical workflow patterns used throughout machine learning work
- Practice reading and debugging short snippets, not just writing them
- Know how to inspect shapes, types, and intermediate results quickly
Domain 6: Neural Networks
The general foundation beneath CNNs and other deep architectures.
- Understand layers, activations, forward passes, and backpropagation at a conceptual level
- Know how training behaves: learning rates, overfitting, and regularization
- Be able to explain why a network is or is not learning from its training behavior
Domain 7: Probability and Frequency
The reasoning layer that makes detection and scoring defensible.
- Handle conditional probability and the way base rates distort alert accuracy
- Understand distributions and frequency-based features
- Practice working problems by hand, since the on-screen calculator is your only electronic aid
Domain 8: Regressions
Predicting continuous values and understanding relationships between variables.
- Know linear and logistic regression and what each is used to predict
- Interpret coefficients, fit, and error measures
- Understand where regression assumptions break down on real security data
Domain 9: Statistics Fundamentals
The vocabulary the rest of the exam assumes.
- Be solid on central tendency, spread, and the shape of distributions
- Understand sampling, variance, and basic inference ideas
- Know how to read summary statistics critically rather than taking them at face value
Domain 10: Supervised Learning
Training models on labeled data to classify or predict.
- Understand the train, validate, and test workflow and why leakage ruins results
- Know common evaluation metrics and when accuracy misleads on imbalanced data
- Be able to compare model families and choose among them for a described scenario
Notice the structure: Domains 7 and 9 are the mathematical floor, Domains 4 and 5 are the practical floor, and the rest build on them. Candidates who skip the floor and chase the neural network material tend to find the exam harder than expected, a theme explored in How Hard Is the GMLE Exam?
Open-Book Rules and Index Strategy
The exam is open book, but the definition is narrow. Allowed: hardcopy books, notes, and an index. Prohibited: internet access, personal electronic references, and any materials resembling practice or exam questions and answers. That last category matters. Do not bring printed practice-test answer keys or question dumps; doing so violates the candidate agreement, which GIAC updated on February 18, 2025.
Because there is no internet and no electronic lookup, anything you cannot find in paper must come from memory. Build your index while studying, not the week before, and mark the entries you consulted repeatedly during practice: those are the ones to memorize outright.
Handling CyberLive Tasks
CyberLive is GIAC's hands-on, performance-based format. Rather than selecting an answer, you complete a task in a live environment. GIAC's description of the practitioner exam experience supports a structure of multiple-choice items followed by CyberLive, though generic promotional wording about CyberLive does not spell out the exact composition, so rely on your attempt-specific information for details.
- Budget time before you start. Decide in advance how many minutes you will hold back for the hands-on portion so the multiple-choice section cannot consume it.
- Use the notepad. The scratch notepad is part of the exam engine; use it to jot intermediate results and plans for multi-step tasks.
- Read first, run second. Python fluency means reading code accurately. Misreading a snippet costs more time than writing one.
- Remember that answers lock. Because submitted answers cannot be changed, verify your work before you submit rather than after.
Key Takeaway
Practice in a real Python environment under a timer. Reading about data science workflows does not prepare you for completing one against the clock, and Domain 5 is where that gap shows up.
SEC595 Preparation Map
The associated SANS course is SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals. Training is optional and recommended, not required, and its tuition is separate from the exam fees. SEC595 has six preparation sections, and the course's own materials are the most direct preparation path for the exam. Details on options are in GMLE Training.
Some points to keep straight:
- Course sections are unweighted curriculum. They do not prove exhaustive exam coverage and do not map one-to-one onto the ten objective headings.
- The live SEC595 page asks for intermediate Python, while the linked brochure describes a fundamental understanding of Python. That is a course-readiness question, separate from GIAC certification eligibility.
- The live page uses descriptive titles for Sections 3 through 6, while the brochure labels them "Essentials of Machine Learning" Parts I through IV. Do not be confused if two sources name the same sections differently.
If your Python is rusty, fix that before the course starts, not during it. The practical sections assume you can already move around in code comfortably.
Renewal Math
Certification is valid for four years. To renew, you need either 36 approved CPE credits earned during the active four-year period or a renewal exam, plus the standard USD $499 renewal fee. The CPE route rewards people who stay active in the field through conferences, courses, and approved activities. Start logging credits early; scrambling for 36 in the final months is stressful and avoidable.
Whether the whole investment pays back is a separate question, covered in Is the GMLE Certification Worth It?
A Domain-Ordered Review Sequence
This is the one place for methodology, and it is tied directly to the ten headings. The ordering logic: build the mathematical and data foundation first, then models, then the security applications that sit on top.
Foundations
- Domain 9 (Statistics Fundamentals) and Domain 7 (Probability and Frequency)
- Work problems by hand using only the on-screen-calculator-level tools
Data and Code
- Domain 4 (Data Acquisition) and Domain 5 (Leveraging Python)
- Timed coding drills in a real environment
Classical Models
- Domain 8 (Regressions), Domain 10 (Supervised Learning), Domain 2 (Clustering)
- Practice choosing a method from a scenario description
Deep Learning and Detection
- Domain 6 (Neural Networks), Domain 3 (Convolutional Neural Networks), Domain 1 (Anomaly Detection and Optimization)
- Finish and tidy your index
Adjust the pace to your background; a working data scientist may compress Weeks 1 and 2, while a security analyst new to statistics may need to stretch them. After this pass, take timed practice questions at our practice test site and revisit whichever domain they expose as weakest.
Roles That Value This Credential
GMLE sits at the intersection of security operations and applied machine learning, so it speaks most clearly to roles where both matter: detection engineering, security data science, threat hunting with analytic tooling, and teams building machine learning into security products or pipelines. It also helps analysts who want to move from consuming vendor-supplied detections to building and evaluating their own.
Be cautious about specific salary claims. Pay depends on location, seniority, and employer, and any single number quoted without context deserves skepticism; see the GMLE Salary Guide for how to think about earnings, and GMLE Jobs for role types. If you are weighing your first steps, the practice resources at GMLE Exam Prep are a sensible place to test your readiness against real question styles.
Frequently Asked Questions
The exam has 82 total questions with a 3-hour time limit. The limit covers the entire exam, including the hands-on CyberLive tasks, which are mixed with multiple-choice items.
The minimum passing score is 65%. That standard applies to exam versions released on or after September 18, 2023, and the assigned attempt's page takes precedence if details differ.
Yes. The exam is open book with hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
No. Submitted answers cannot be changed, so review your work before submitting. You also get 15 minutes of break time during the exam.
It is valid for four years. Renewal requires 36 approved CPE credits earned in that period or a renewal exam, plus the standard USD $499 renewal fee.
For a broader look at difficulty and outcomes, continue with GMLE Pass Rate: What the Data Shows, and keep this page's quick-reference tables handy in the final days before your attempt.