- The Number: 65% on the GIAC Machine Learning Engineer Exam
- What the 65% Is Measured Against
- Format, Timing, and What Shapes Your Score
- Ten Domains, No Published Weights
- CyberLive Tasks and Your Total
- Open-Book Rules That Affect Your Score
- What Missing 65% Costs
- Sequencing Your Prep Around the Score
- Verifying the Standard for Your Own Attempt
- Frequently Asked Questions
- The GIAC Machine Learning Engineer (GMLE) minimum passing score is 65%, applying to exam versions released on or after September 18, 2023.
- The exam has 82 questions in 3 hours, mixing multiple-choice items with performance-based CyberLive tasks.
- GIAC publishes 10 unweighted domain headings, so you cannot target a "cheap" domain and skip the rest.
- A failed attempt means a USD $899 retake, and answers cannot be changed once submitted.
The Number: 65% on the GIAC Machine Learning Engineer Exam
The minimum passing score for the GIAC Machine Learning Engineer (GMLE) exam is 65%. That is the whole headline, but the number only becomes useful when you understand what it is applied to, how the exam is built, and what a realistic preparation target looks like. This article works through those pieces for the GMLE specifically, the cybersecurity-focused credential issued by GIAC Certifications and administered by GIAC, LLC.
One notice matters for anyone comparing older forum posts or study notes: the 65% passing standard applies to exam versions released on or after September 18, 2023. That date is when the passing-standard notice takes effect. It is not the publication date of the exam objectives, and GIAC does not state a separate public edition date for the objective list. If you encounter a different passing figure in an older source, treat it with suspicion and check your own attempt's page, as described near the end of this article.
What the 65% Is Measured Against
The score is calculated across the full exam: all 82 questions, including both the multiple-choice items and the performance-based CyberLive tasks. GIAC's detailed explanation of its practitioner exams describes multiple-choice items followed by CyberLive, and the time limit of 3 hours covers the complete exam, CyberLive included. There is no separate clock for the hands-on portion and no separate passing threshold that GIAC publishes for it. You are trying to clear one overall standard.
If you are still orienting yourself on the credential itself, the explainers on what GMLE certification is and what GMLE stands for cover the basics, and the GMLE requirements guide covers eligibility. For this article, the important point is narrower: the 65% is a single bar across a mixed-format exam, and that mix shapes how you should allocate your preparation.
Format, Timing, and What Shapes Your Score
Here is the GMLE exam format at a glance, drawn from GIAC's published details.
| Item | GMLE Detail |
|---|---|
| Total questions | 82 |
| Time limit | 3 hours, covering the entire exam including CyberLive |
| Question types | Multiple-choice plus performance-based CyberLive tasks |
| Minimum passing score | 65% |
| Reference materials | Open book: hardcopy books, notes, and an index |
| On-screen tools | Calculator and scratch notepad in the exam engine |
| Breaks | 15 minutes of break time allowed |
| Answer changes | Submitted answers cannot be changed |
| Delivery | Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
Three of those details deserve extra attention because they interact directly with the passing score.
Submitted answers are final
Because you cannot change an answer after submitting it, there is no end-of-exam review pass to rescue a rushed response. Every item is effectively a one-way door. That raises the value of reading each question completely the first time, especially CyberLive tasks where a misread requirement can cost you the item. Budget your time so you are not forced to submit guesses in the final stretch.
One clock, mixed formats
With 82 questions in 3 hours you have, on average, a little over two minutes per item. But the average hides the real issue: hands-on tasks consume more time than a typical multiple-choice question, so the time you save on quick recall items is the time you spend on CyberLive work. Candidates who burn their buffer early on lookups in their index tend to feel it later.
The break is part of the 3 hours' logistics, not extra time
GIAC allows 15 minutes of break time. Plan when you would use it before exam day so you are not deciding mid-exam. For the broader picture of how demanding the sitting is, see how hard the GMLE exam is.
Ten Domains, No Published Weights
GIAC lists ten exam-objective headings for the GMLE, and it does not publish official percentage weights for them. The headings, in GIAC's published order, are:
- Anomaly Detection and Optimization
- Clustering
- Convolutional Neural Networks
- Data Acquisition
- Leveraging Python
- Neural Networks
- Probability and Frequency
- Regressions
- Statistics Fundamentals
- Supervised Learning
This absence of weights has a direct consequence for how you think about 65%. With a published weight table, a candidate could calculate a strategic floor, such as securing the heavy domains and accepting losses in the light ones. Without it, any claim that "domain X is only a small slice" is speculation. The safe interpretation is that you should aim for working competence across all ten, because you cannot know how many items you will face from any one of them. The full breakdown is in the GMLE exam domains guide.
Where the foundations sit
Several headings are foundational rather than model-specific, and weakness in them tends to leak into other areas.
- Statistics Fundamentals and Probability and Frequency underpin how you interpret model output and anomaly scores.
- Leveraging Python matters because hands-on tasks reward fluent code reading and writing.
- Data Acquisition sets up everything downstream: bad inputs produce bad models.
Where the modeling concepts sit
The remaining headings cover the techniques you apply to that data.
- Supervised Learning and Regressions for labeled prediction problems.
- Clustering and Anomaly Detection and Optimization for unlabeled data and finding the unusual, a natural fit for security telemetry.
- Neural Networks and Convolutional Neural Networks for deep learning concepts and architectures.
CyberLive Tasks and Your Total
CyberLive is GIAC's performance-based format, where you demonstrate skill in a live environment rather than choosing from options. For the GMLE, GIAC's detailed explanation supports an exam composed of multiple-choice items followed by CyberLive. Generic promotional language about CyberLive does not spell out the exact composition, so avoid relying on secondhand descriptions of how many items are hands-on or how they are weighted. GIAC does not publish that breakdown in the sources used for this article.
What you can reason about is the effect on your preparation. Because CyberLive items count toward the same 65% as multiple-choice items, strength in one format can offset weakness in the other, but you should not plan around that offset. A candidate who is excellent at conceptual questions yet shaky when asked to actually manipulate data in Python is carrying risk that the open-book allowance will not cover, since a hardcopy index cannot write the code for you.
Open-Book Rules That Affect Your Score
The GMLE is open book, but narrowly. You may use hardcopy books, notes, and an index. You may not use internet access, personal electronic references, or materials resembling practice or exam questions and answers. That last prohibition is easy to overlook when assembling your reference set, so audit what you bring.
The practical effect on scoring is that your index quality becomes a competitive advantage. A well-built index lets you retrieve a definition or procedure in seconds, preserving time for the items that genuinely require thinking. A poor one tempts you into long searches that cost minutes you cannot recover, particularly because submitted answers cannot be revisited. Organize your index by concept across all ten domains, since you cannot predict the distribution of questions. A fuller walkthrough of what to review sits in the GMLE cheat sheet.
What Missing 65% Costs
The financial side of the passing score is simple and worth stating plainly, using GIAC's published figures (prices exclude applicable sales tax):
- Certification attempt: USD $999
- Retake: USD $899
- Official practice exam: USD $399
- SANS training tuition: separate and not included
So a miss at 65% means paying USD $899 to try again. Your attempt also carries a completion window of 120 days from activation, which frames how long you have to sit the exam. Compare the value of the official practice exam against the retake price when deciding how much rehearsal to buy, and see the GMLE certification cost breakdown for the full picture. Because the expense of a miss is high, many candidates also find it useful to rehearse under timed conditions with a practice test before committing to a sitting.
If you pass, the credential is valid for four years. Renewal requires 36 approved CPE credits earned during the active period, or a renewal exam, plus the standard USD $499 renewal fee. Whether the outlay pays off is a separate question, explored in the ROI analysis.
Sequencing Your Prep Around the Score
Since the 65% applies to a mix of conceptual and hands-on items across ten unweighted domains, a sensible sequence builds foundations first, then techniques, then integration under time pressure. This is one possible arrangement, tied to the domain order that makes sense for dependencies rather than to any published weighting.
Foundations
- Statistics Fundamentals and Probability and Frequency, because later domains lean on them.
- Leveraging Python and Data Acquisition, writing real code against real data.
Core modeling
- Regressions and Supervised Learning.
- Clustering and Anomaly Detection and Optimization, framed around security data.
Deep learning and integration
- Neural Networks, then Convolutional Neural Networks.
- Build your index, run timed full-length rehearsals, and drill CyberLive-style tasks in Python.
For a broader plan, the GMLE study guide goes deeper, and the SEC595 course page and brochure can anchor your reading order. Remember that SEC595's six sections are an unweighted preparation curriculum; they do not establish exhaustive exam coverage or define the exam's domain count.
Verifying the Standard for Your Own Attempt
GIAC states that the assigned attempt's objectives, format, and passing score at exams.giac.org/pages/attempts take precedence over any other source. That includes this article. Exam versions change, and the page tied to your specific attempt is the authority on what applies to you. Check it when you register and again before your sitting.
Also confirm the logistics that affect your day: whether you are testing onsite through Pearson VUE or remotely through ProctorU, subject to attempt-specific eligibility, and the proctoring rules in GIAC's candidate agreement and proctored exam reference guide. For scheduling mechanics, see GMLE exam dates. If you are curious how outcomes look in aggregate, the GMLE pass rate article discusses what is and is not publicly known. And for the career context that motivates the whole effort, the GMLE jobs and salary guide articles cover where the credential tends to be applied.
Frequently Asked Questions
The minimum passing score is 65%. This standard applies to exam versions released on or after September 18, 2023. Always confirm the figure on the page for your assigned attempt at exams.giac.org, which takes precedence.
GIAC does not publish separate thresholds for each format in the sources used here. The exam has 82 questions in a single 3-hour sitting that includes CyberLive, and the 65% standard applies to the exam as a whole.
No. GIAC publishes ten domain headings but no official percentage weights. Because the distribution is unknown, aim for working competence across all ten rather than trying to skip any domain.
You would need to pay the retake fee of USD $899 (excluding applicable sales tax) to try again. Note that submitted answers cannot be changed during the exam, so careful reading on the first pass matters.
Yes, the exam is open book with hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited, and an index cannot replace hands-on Python skill for CyberLive tasks.