- The Number: 76% on a 75-Question Exam
- What 76% Means in Practice
- Passing Score vs. Pass Rate
- Format and Exam-Day Rules That Affect Your Score
- The Eight Objectives Behind the Score
- Does the 76% Apply to Your Exam Version?
- Using the Open-Book Allowance to Protect Your Score
- Fees, Retakes, and the Cost of Missing 76%
- A Domain-Ordered Plan Aimed at the Cut Score
- Frequently Asked Questions
- GIAC sets the GSTRT passing score at 76% for exam versions released on or after November 5, 2022.
- The exam has 75 questions in 3 hours; the scored/unscored split is not publicly specified.
- The exam is open book: hardcopy books, notes and an index are allowed, but electronic files and internet are not.
- Submitted answers cannot be changed, so commit only when you have checked your index and reasoning.
The Number: 76% on a 75-Question Exam
The GIAC Strategic Planning, Policy, and Leadership (GSTRT) certification has one published passing standard: 76%. GIAC applies it to exam versions released on or after November 5, 2022. The exam is a single web-based, proctored attempt with 75 questions and a 3-hour time limit.
That date matters, but it is easy to misread. November 5, 2022 is a score-standard applicability date, not an outline revision date and not a new "edition" of the exam. The public GSTRT objective list is undated, and GIAC does not publish a separate blueprint year. If you want the full picture of how the exam is organized, our guide to all 8 GSTRT content areas walks through each objective heading.
What 76% Means in Practice
On a 75-question exam, 76% works out to roughly 57 correct answers if every item is scored and weighted equally. Treat that as a planning estimate rather than a promise. GIAC does not publicly specify how many of the 75 questions are scored versus unscored, and it does not publish how raw performance converts to the reported result for your version. So the safest approach is to aim for comfortably above 76% on every domain rather than to count on an exact number of misses.
Three practical consequences follow:
- You can miss a meaningful number of questions and still pass, but the margin is thinner than many candidates assume once difficult wording is factored in.
- Strength in one objective will not reliably cover a gap in another, because GIAC publishes no official percentage weights and no highest-weight objective. Do not invent a weighting scheme to justify skipping an area.
- Unscored items are invisible to you. Every question deserves full effort because you cannot tell which ones count.
For a deeper look at how demanding the questions feel against that bar, see how hard the GSTRT exam really is.
Passing Score vs. Pass Rate
These two terms are constantly confused, and several competitor pages blur them together.
| Term | What it means | Is it published for GSTRT? |
|---|---|---|
| Passing score | The percentage you must reach on your attempt to earn the certification | Yes: 76% for versions released on or after November 5, 2022 |
| Pass rate | The share of all candidates who pass, across a population | No official GIAC figure was found in current sources |
A passing score is a rule for you. A pass rate is a statistic about everyone. Candidate anecdotes on forums describe personal scores and finish times, but they are not a population pass rate and should not be treated as one. Claims of a specific pass-rate range on commercial sites are unsupported by the issuer. Our write-up on what the pass-rate data actually shows goes through what can and cannot be said honestly.
Format and Exam-Day Rules That Affect Your Score
Your result depends on more than knowledge. GIAC's proctoring rules shape how you earn each point.
GSTRT Exam-Day Mechanics
These are the verified delivery rules relevant to scoring.
- Questions and time: 75 questions, 3 hours.
- Answers are final: submitted answers cannot be changed.
- Skipping: a limited skip allowance exists, so you can defer a difficult item, but not indefinitely.
- Breaks: 15 minutes of break time are available.
- Proctoring: Pearson VUE onsite or ProctorU remotely, depending on the modality permitted for your attempt.
- Question mix: the exact multiple-choice, case-study or performance-based composition is not specified in current official sources, and a CyberLive component was not verified for GSTRT.
The "answers cannot be changed" rule deserves special respect. Because you cannot revisit and revise, a rushed submission is a permanent mistake. Use the skip allowance deliberately: skip an item only when a second pass is likely to help, not as a way to avoid thinking.
The Eight Objectives Behind the Score
GIAC publishes eight exam-objective headings, listed here in source order. The count reflects the number of headings supplied, not an issuer-numbered weighted-domain system. No official weights are published.
Domain 1: Effective Management & Comms
Expect questions on communicating with executives and stakeholders, framing security in business terms, and managing teams and expectations.
Domain 2: Leadership & Change
Leading people through organizational change, influence without authority, and handling resistance to security initiatives.
Domain 3: Policy Development
Writing policy that is clear, enforceable and aligned to organizational goals, including the reasoning behind policy language.
Domain 4: Policy Management
Keeping policy alive: lifecycle, review, exceptions, communication and enforcement over time.
Domain 5: Security Program Analysis
Assessing the current state of a security program and using metrics and evidence to judge effectiveness.
Domain 6: Security Program Development
Building strategy and roadmaps, setting mission and priorities, and sequencing initiatives.
Domain 7: Understanding the Business
Reading organizational context, goals and constraints so that security decisions support the mission.
Domain 8: Understanding the Threats
Linking the threat landscape to business risk so strategy responds to realistic adversaries rather than abstractions.
Because the exam is a management-and-strategy test, the hardest items are rarely about recalling a definition. They ask you to choose the most appropriate action in a business scenario where several options are plausible. Candidate discussions mention abstract concepts and difficult wording as recurring pain points, which is consistent with a leadership-focused exam. Learning why the tempting wrong answers are wrong is more valuable than memorizing terms.
Does the 76% Apply to Your Exam Version?
For almost every candidate sitting the exam now, yes. The 76% standard applies to versions released on or after November 5, 2022, and the current exam is well past that. Still, two cautions are worth stating.
- The affiliated SANS course changed; the exam edition did not visibly change. The 2026 update to LDR514 expands AI/GenAI, PEST analysis, cloud strategy, mission and metrics, policy work and executive decision exercises. That is a preparation-curriculum update. It does not establish a new 2026 GSTRT exam edition or an additional AI objective. Anecdotes about AI-policy topics appearing on the exam are personal reports, not official specifications.
- Confirm your own attempt. The authoritative record for the specifications assigned to your purchased attempt is the Certification Information at exams.giac.org/pages/attempts. Check it when you activate your attempt, before you plan around any number.
Using the Open-Book Allowance to Protect Your Score
GSTRT is open book, but only in a specific, bounded way. Permitted: hardcopy books, notes and an index. Prohibited: exam or practice-question-and-answer references, electronic reference files and internet access. That distinction shapes how you convert preparation into points.
A well-built index is the single most reliable lever on your score because the exam rewards locating the right concept fast. For GSTRT, a useful index is organized around management ideas rather than technical commands:
- Policy lifecycle stages and who owns each one
- Decision criteria for prioritizing initiatives
- Communication approaches by audience (executive, technical, board)
- Change-management models and their stated purposes
- Metrics, mission and maturity concepts for program analysis
- Business-context frameworks such as PEST analysis
Do not build the index from memory of what "feels" important. Build it while studying your materials, then test it against independent practice scenarios to see which entries you actually reach for. Our GSTRT study guide covers how to assemble materials, and the GSTRT cheat sheet is a handy complement for last-pass review. Remember that a cheat sheet is for your study; only permitted hardcopy materials come into the exam.
Fees, Retakes, and the Cost of Missing 76%
The passing score has a real price tag attached because GIAC fees are not trivial. The numbers below are exam-related costs from GIAC's published pricing; optional training is separate.
| Item | Cost / rule |
|---|---|
| Initial exam attempt | USD 999 before applicable sales tax |
| Failed-exam retake | USD 899 |
| Practice exam | USD 399 |
| 45-day extension | USD 479 |
| Standard renewal | USD 499 |
| Wait after a failure | Normally 30 days; three failures trigger a one-year wait |
Standalone attempts normally allow 120 days from activation. Paid extensions ordinarily add 45 days within a 570-day total-access limit. These are preparation and access windows, not exam durations. GIAC lists no separate member and non-member price tiers, and tuition for the SANS LDR514 course is separate from the exam fee. For a fuller breakdown, see the complete GSTRT pricing guide, and for scheduling logistics see GSTRT exam dates and deadlines.
The math is straightforward: missing 76% once means paying USD 899 to try again and waiting at least 30 days. That is a strong argument for treating a paid practice exam as a calibration step before the real attempt, and for using independent resources to verify readiness. Be careful to separate official GIAC practice exams from independent quizzes, and understand each one's limits: independent question sets are not official exam material, are not a full mock exam, and do not produce a readiness score you can bank on.
Key Takeaway
Do not schedule a "see how it goes" first attempt. At USD 999, with a USD 899 retake and a 30-day wait, the 76% threshold is best approached as a target you have already beaten in practice conditions that mirror the open-book, time-limited format.
A Domain-Ordered Plan Aimed at the Cut Score
Generic scheduling advice is less useful than ordering your weeks around how the eight objectives depend on each other. Understanding the business and threats underpins almost every scenario question, so start there.
Context first: Domains 7 and 8
- Practice reading a business scenario and stating its goals and constraints
- Connect threats to business risk rather than to technical detail
- Start the index with business-context and risk entries
Programs: Domains 5 and 6
- Work through strategy, roadmap and mission concepts
- Learn how metrics justify program decisions
- Add maturity and prioritization criteria to the index
Policy: Domains 3 and 4
- Study policy drafting, exceptions and the full lifecycle
- Fold in AI-policy topics from updated course material
- Index lifecycle stages and ownership
People: Domains 1 and 2
- Practice executive communication and change-management reasoning
- Review why persuasive but weak answer choices fail
- Finish and refine the index
Timed rehearsal
- Sit full 75-question sets in 3 hours with only permitted materials
- Log every miss by domain, then repair the index entry that failed you
- Stop only when you consistently clear 76% with room to spare
If you want structured questions to rehearse against, the main GSTRT practice test site offers scenario-style practice, and you can try a timed practice set to see how your index performs under the clock. For the broader decision about whether the effort is justified, see whether the GSTRT certification is worth it and GSTRT requirements and prerequisites, which confirms that GIAC requires no mandatory degree or experience duration to begin an attempt.
Frequently Asked Questions
The GSTRT passing score is 76%, applicable to exam versions released on or after November 5, 2022. That date marks when the score standard applies; it is not an outline revision date.
The exam has 75 questions and a 3-hour time limit. GIAC does not publicly specify how many questions are scored versus unscored, so treat every item as if it counts.
Yes, within limits. Hardcopy books, notes and an index are permitted. Exam or practice-question-and-answer references, electronic reference files and internet access are prohibited.
No. Submitted answers cannot be changed. A limited skip allowance and 15 minutes of break time are available, so use skips to defer genuinely difficult items rather than to rush through.
A failed-exam retake costs USD 899 and normally requires a 30-day wait. Three failures trigger a one-year wait. Paid extensions ordinarily add 45 days within a 570-day total-access limit.
No. The passing score is the 76% threshold you must reach. The pass rate would describe how many candidates pass overall, and no official GIAC figure for it was found in current sources, so be skeptical of precise pass-rate claims.
Your target is simple to state and demanding to hit: consistent performance above 76% across all eight objectives, in a timed, open-book setting, with a purpose-built index. Confirm your attempt's specifications at exams.giac.org/pages/attempts, build your preparation around the published objective headings, and treat any number that contradicts GIAC's own as unreliable.